23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 34:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T545,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win32_Bundled_Toolbar_Google_D_potentially_unsafe_application Sample 042e307ff5ce… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 042e307ff5ce…. Malware family: Win32_Bundled_Toolbar_Google_D_potentially_unsafe_application. Threat score 100/100. 4/28 AV engines flagged this file. 14 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/042e307ff5cef2a37d44e3ab810cd4a5d75572e3be0a26d0552bf4855776b558","keywords":["Malicious","Win32_Bundled_Toolbar_Google_D_potentially_unsafe_application","malware analysis","sandbox report","threat intelligence","042e307ff5cef2a37d44e3ab810cd4a5d75572e3be0a26d0552bf4855776b558"],"about":{"@type":"SoftwareApplication","name":"rcsetup152.exe","applicationCategory":["peexe","executable"],"identifier":"042e307ff5cef2a37d44e3ab810cd4a5d75572e3be0a26d0552bf4855776b558","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win32_Bundled_Toolbar_Google_D_potentially_unsafe_application","antivirusDetections":{"malicious":4,"total":28},"behavioralIndicators":{"malicious":14,"suspicious":31},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T4e5,"g3hjvwD0!ya498"B]o<=g_4~KNb* {^^:0c'E=JOg}t4fl;1\?b[o-v,QeMUOD:)q.bG{aQA;3a(jf~nD71r_5%p1$~.3vi;MhQ" (Indicator: "qemu") "]USV17Nt"Ptjjuu2^[]^[]UQEMUVuPEQRPVE^]UQVuVljE^]U3$D$$P0i$Q#]UQVuVE[^]UEPD]UjhhdPQVr3PEdE3P [luMuuQVEEP" (Indicator: "qemu"), "Y_^[]UR2EP3Su=3uuuMQ Eql[U;UOqPqEh-uEh$uEhjPEPEfWPMQEMuP}EE P" (Indicator: "qemu"), "Eut*FuBNuPh(wuEtf3uEVMEiMUEt,uBOuPVEVPQEMUPEetU03juuuv;AEE@E@E@MA}8}xE3@HDe;t0RQUREPE" (Indicator: "qemu") "QjS4sNHi3WQEEEEURPiNEPQitFURPiE+EMMNWQEMUuj+RU+VQRPiM^3[C]TVpt3@h#PHijjhP(sN^USW3j4^^~ SW^^A4F$sF(E_;F,dF8FF@p0Gv<[t" (Indicator: "qemu") "PBEEHJPB$Mu+;U4tmy|ePQtW+xQEMUQPRPu;t#HJ" (Indicator: "qemu") "hj)0C+;+;sEEE;sUPKM+U" wrote bytes "c2000000" to virtual address "0x6E8F4020" (part of module "SYSTEM.DLL") "" wrote bytes "e19cb775f99cb77578ebb67500bfb775fa8bb6751861b975d333b8750e45b875e74bb975e8d9b775eba8b775013cb8754d37b8752b45b875b62fb8754123b775d0d9b775000000006d42b2760000000099e59b76ec229e7600000000" to virtual address "0x6E8F3000" (part of module "SYSTEM.DLL") "" wrote bytes "cc200000da200000e6200000f420000000210000000000002a2100003c2100004a2100005a2100006c2100001a21000000000000" to virtual address "0x6E962000" (part of module "BUTTONEVENT.DLL") "" wrote bytes "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" to virtual address "0x6E963000" (part of module "BUTTONEVENT.DLL") "" wrote bytes "0857dd750478e6750000000051c1ca759498ca75ee9cca7575dccc75273ecc75efb2d0750000000046ceb775013db87538edb875cfcdb7753123b775de2fb875c4cab77580bbb775aa6eb8759fbbb77592bbb77546bab7750abfb77500000000" to virtual address "0x6E971000" (part of module "SHFOLDER.DLL") "" wrote bytes "9498ca7551c1ca75efb2d075ee9cca7575dccc759097ca751099ca7500000000013db87538edb875cfcdb7753123b775de2fb875c4cab77580bbb775aa6eb8759fbbb775707fb67592bbb77546bab7750abfb77500000000" to virtual address "0x71271000" (part of module "MSLS31.DLL")29:T5c4,"rcsetup152.exe" queries volume information of "C:\Windows\Fonts\arial.ttf" at 00008758-00002176-00000046-51025174731 "rcsetup152.exe" queries volume information of "C:\Windows\Fonts\arial.ttf" at 00008758-00002176-00000046-51218641616 "rcsetup152.exe" queries volume information of "C:\Windows\Fonts\arialbd.ttf" at 00008758-00002176-00000046-51248124876 "rcsetup152.exe" queries volume information of "C:\Windows\Fonts\arialbd.ttf" at 00008758-00002176-00000046-53079978157 "rcsetup152.exe" queries volume information of "C:\Windows\Fonts\seguisym.ttf" at 00008758-00002176-00000046-57740076688 "rcsetup152.exe" queries volume information of "C:\" at 00008758-00002176-00000046-116039647362 "rcsetup152.exe" queries volume information of "C:\Program Files\Recuva\recuva64.exe" at 00008758-00002176-00000046-116103199254 "rcsetup152.exe" queries volume information of "C:\" at 00008758-00002176-00000046-117488688815 "rcsetup152.exe" queries volume information of "C:\Program Files\Recuva\recuva64.exe" at 00008758-00002176-00000046-117491521104 "recuva64.exe" queries volume information of "\\?\Volume{e47f4f43-d863" at 00015266-00003380-00000046-278082193962 "recuva64.exe" queries volume information of "C:\" at 00015266-00003380-00000046-278138017972 "recuva64.exe" queries volume information of "\\?\Volume{e47f4f43-d863" at 00015266-00003380-00000046-293812491775 "recuva64.exe" queries volume information of "C:\" at 00015266-00003380-00000046-2938530115882a:T7c1,"recuva64.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "recuva64.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "recuva64.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "recuva64.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "recuva64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "recuva64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "recuva64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "recuva64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "recuva64.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "recuva64.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "recuva64.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "recuva64.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "recuva64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "recuva64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "recuva64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "recuva64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "recuva64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "recuva64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "recuva64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "recuva64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")2b:Tb52,"recuva64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\02FAF3E291435468607857694DF5E45B68851868"; Key: "BLOB") "recuva64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\039EEDB80BE7A03C6953893B20D2D9323A4C2AFD"; Key: "BLOB") "recuva64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "recuva64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\07E032E020B72C3F192F0628A2593A19A70F069E"; Key: "BLOB") "recuva64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\132D0D45534B6997CDB2D5C339E25576609B5CC6"; Key: "BLOB") "recuva64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\2796BAE63F1801E277261BA0D77770028F20EEE4"; Key: "BLOB") "recuva64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\323C118E1BF7B8B65254E2E2100DD6029037F096"; Key: "BLOB") "recuva64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\3679CA35668772304D30A5FB873B0FA77BB70D54"; Key: "BLOB") "recuva64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\36B12B49F9819ED74C9EBC380FC6568F5DACB2F7"; Key: "BLOB") "recuva64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\47BEABC922EAE80E78783462A79F45C254FDE68B"; Key: "BLOB") "recuva64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5"; Key: "BLOB") "recuva64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\503006091D97D4F5AE39F7CBE7927D7D652D3431"; Key: "BLOB") "recuva64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\590D2D7D884F402E617EA562321765CF17D894E9"; Key: "BLOB") "recuva64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25"; Key: "BLOB") "recuva64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\6252DC40F71143A22FDE9EF7348E064251B18118"; Key: "BLOB") "recuva64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\627F8D7827656399D27D7F9044C9FEB3F33EFA9A"; Key: "BLOB") "recuva64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\67650DF17E8E7E5B8240A4F4564BCFE23D69C6F0"; Key: "BLOB") "recuva64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\74207441729CDD92EC7931D823108DC28192E2BB"; Key: "BLOB") "recuva64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\742C3192E607E424EB4549542BE1BBC53E6174E2"; Key: "BLOB") "recuva64.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\75E0ABB6138512271C04F85FDDDE38E4B7242EFE"; Key: "BLOB")2c:T1116,"GET /installcheck.aspx?p=2&v=1.52.1086&vx=&l=1033&b=1&o=6.1W6&g=7&i=1&a=0 HTTP/1.1 User-Agent: NSIS Host: service.piriform.com Connection: Keep-Alive Cache-Control: no-cache Cookie: _ga=GA1.2.1058661717.1512499756; _vwo_uuid=8CA0CCBF0619DB9518CC1266ABF15F6E; __qca=P0-623550444-1512499759844" "GET /go/app_releasenotes?p=2&v=1.52.1086&l=1033&b=1&a=0 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.piriform.com DNT: 1 Connection: Keep-Alive Cookie: _ga=GA1.2.1058661717.1512499756; _vwo_uuid=8CA0CCBF0619DB9518CC1266ABF15F6E; __qca=P0-623550444-1512499759844" "GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" "GET /GTSGIAG3/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCCB6bUJ0NDzPN HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" "GET /GTSGIAG3.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" "GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCAzkUhA%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.starfieldtech.com" "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM%2BuArAQUJUWBaFAmOD07LSy%2BzWrZtj2zZmMCCQD52BZPtim28Q%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.starfieldtech.com" "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQUwPiEZQ6%2FsVZNPaFToNfxx8ZwqAQUfAwyH6fZMH%2FEfWijYqihzqsHWycCAQc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.starfieldtech.com" "GET /sfroot-g2.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.starfieldtech.com" "GET /sfig2s1-57.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.starfieldtech.com" "GET /auto?p=rc&v=1.52.1086&l=1033&a=0 HTTP/1.1 User-Agent: Recuva Host: www.piriform.com Cookie: _ga=GA1.2.1058661717.1512499756; _vwo_uuid=8CA0CCBF0619DB9518CC1266ABF15F6E; __qca=P0-623550444-1512499759844" "GET /recuva/update?v=1.52.1086&l=1033&a=0 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.piriform.com DNT: 1 Connection: Keep-Alive Cookie: _ga=GA1.2.1058661717.1512499756; _vwo_uuid=8CA0CCBF0619DB9518CC1266ABF15F6E; __qca=P0-623550444-1512499759844" "GET /GTSGIAG3.crl HTTP/1.1 Cache-Control: max-age = 3600 Connection: Keep-Alive Accept: */* If-Modified-Since: Sat, 29 Dec 2018 02:15:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: o.ss2.us" "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com" "GET /sca1b.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.sca1b.amazontrust.com" "GET /rootg2.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootg2.amazontrust.com" "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEA2lrpi8lkbCbJEY95Vvu%2Fw%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.sca1b.amazontrust.com" "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com" "GET /rootca1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootca1.amazontrust.com"2d:Ta93,"rcsetup152.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "rcsetup152.exe" touched "Application Registration" (Path: "HKCU\WOW6432NODE\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "rcsetup152.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "rcsetup152.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "rcsetup152.exe" touched "googletoolbar.dll, googletoolbar*.dll (* = digit), googlenav.dll, googlenav*.dll, googletoolbar_en_*.**-big.dll, googletoolbar_en_*.*.**-deleon.dll - Google Toolbar" (Path: "HKCU\WOW6432NODE\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\INPROCSERVER32") "rcsetup152.exe" touched "Microsoft Web Browser" (Path: "HKCU\WOW6432NODE\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\TREATAS") "rcsetup152.exe" touched "Shell DocObject Viewer" (Path: "HKCU\WOW6432NODE\CLSID\{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}\INPROCSERVER32") "rcsetup152.exe" touched "HTML Document" (Path: "HKCU\WOW6432NODE\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\TREATAS") "rcsetup152.exe" touched "Microsoft HTML About Pluggable Protocol" (Path: "HKCU\WOW6432NODE\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}\TREATAS") "rcsetup152.exe" touched "Browser Application State" (Path: "HKCU\WOW6432NODE\CLSID\{E569BDE7-A8DC-47F3-893F-FD2B31B3EEFD}\TREATAS") "rcsetup152.exe" touched "CActiveIMMAppEx_Trident" (Path: "HKCU\WOW6432NODE\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\TREATAS") "rcsetup152.exe" touched "History" (Path: "HKCU\WOW6432NODE\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000}\INPROCSERVER32") "rcsetup152.exe" touched "JScript Language" (Path: "HKCU\WOW6432NODE\CLSID\{842A1268-6E6A-465C-868F-8BC445B9828F}\TREATAS") "rcsetup152.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "rcsetup152.exe" touched "NetworkListManager" (Path: "HKCU\WOW6432NODE\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "rcsetup152.exe" touched "Network List Manager" (Path: "HKCU\WOW6432NODE\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS") "rcsetup152.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\TREATAS") "rcsetup152.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "recuva64.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELL") "recuva64.exe" touched "Enhanced Storage Icon Overlay Handler Class" (Path: "HKCU\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\INPROCSERVER32")2e:T4cc,Process "iexplore.exe" (UID: 00015188-00003992) was launched with new environment variables: "PATH="C:\Program Files\Internet Explorer;"" Process "iexplore.exe" (UID: 00015255-00001568) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "iexplore.exe" (UID: 00015255-00001568) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "recuva64.exe" (UID: 00015266-00003380) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "recuva64.exe" (UID: 00015266-00003380) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "recuva64.exe" (UID: 00015266-00003380) was launched with missing environment variables: "PATH" Process "iexplore.exe" (UID: 00019689-00003144) was launched with new environment variables: "PATH="C:\Program Files\Internet Explorer;"" Process "iexplore.exe" (UID: 00019689-00003144) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "iexplore.exe" (UID: 00019689-00003144) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432"2f:T575,TCP traffic to 151.101.0.64 on port 80 is sent without HTTP header TCP traffic to 151.101.2.202 on port 443 is sent without HTTP header TCP traffic to 35.186.235.23 on port 443 is sent without HTTP header TCP traffic to 108.177.122.97 on port 443 is sent without HTTP header TCP traffic to 64.233.177.138 on port 80 is sent without HTTP header TCP traffic to 64.233.177.100 on port 80 is sent without HTTP header TCP traffic to 130.211.34.183 on port 443 is sent without HTTP header TCP traffic to 108.177.122.95 on port 443 is sent without HTTP header TCP traffic to 151.139.237.73 on port 443 is sent without HTTP header TCP traffic to 74.125.21.157 on port 443 is sent without HTTP header TCP traffic to 74.125.21.95 on port 443 is sent without HTTP header TCP traffic to 216.58.194.36 on port 443 is sent without HTTP header TCP traffic to 64.233.185.94 on port 443 is sent without HTTP header TCP traffic to 50.97.40.233 on port 443 is sent without HTTP header TCP traffic to 31.13.65.7 on port 443 is sent without HTTP header TCP traffic to 192.229.163.25 on port 443 is sent without HTTP header TCP traffic to 72.167.239.239 on port 80 is sent without HTTP header TCP traffic to 72.167.239.238 on port 80 is sent without HTTP header TCP traffic to 64.233.185.101 on port 443 is sent without HTTP header TCP traffic to 13.33.164.203 on port 443 is sent without HTTP header30:T8d9,"recuva64.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "recuva64.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "recuva64.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "recuva64.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "recuva64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "recuva64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "recuva64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "recuva64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "recuva64.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "recuva64.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "recuva64.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "recuva64.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "recuva64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "recuva64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "recuva64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "recuva64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "recuva64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "recuva64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "recuva64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "recuva64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")31:Te68,"rcsetup152.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\PING.EXE" (Handle: 724) "rcsetup152.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\PING.EXE" (Handle: 724) "rcsetup152.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\PING.EXE" (Handle: 724) "rcsetup152.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\PING.EXE" (Handle: 724) "rcsetup152.exe" wrote 1500 bytes to a remote process "C:\Windows\SysWOW64\regsvr32.exe" (Handle: 396) "rcsetup152.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\regsvr32.exe" (Handle: 396) "rcsetup152.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\regsvr32.exe" (Handle: 396) "rcsetup152.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\regsvr32.exe" (Handle: 396) "rcsetup152.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\regsvr32.exe" (Handle: 396) "rcsetup152.exe" wrote 32 bytes to a remote process "C:\Program Files\Recuva\recuva64.exe" (Handle: 1228) "rcsetup152.exe" wrote 52 bytes to a remote process "C:\Program Files\Recuva\recuva64.exe" (Handle: 1228) "rcsetup152.exe" wrote 4 bytes to a remote process "C:\Program Files\Recuva\recuva64.exe" (Handle: 1228) "rcsetup152.exe" wrote 8 bytes to a remote process "C:\Program Files\Recuva\recuva64.exe" (Handle: 1228) "rcsetup152.exe" wrote 32 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 1248) "rcsetup152.exe" wrote 52 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 1248) "rcsetup152.exe" wrote 4 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 1248) "rcsetup152.exe" wrote 8 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 1248) "rcsetup152.exe" wrote 32 bytes to a remote process "C:\Program Files\Recuva\recuva64.exe" (Handle: 1264) "rcsetup152.exe" wrote 52 bytes to a remote process "C:\Program Files\Recuva\recuva64.exe" (Handle: 1264) "rcsetup152.exe" wrote 4 bytes to a remote process "C:\Program Files\Recuva\recuva64.exe" (Handle: 1264) "rcsetup152.exe" wrote 8 bytes to a remote process "C:\Program Files\Recuva\recuva64.exe" (Handle: 1264) "regsvr32.exe" wrote 4 bytes to a remote process "C:\Windows\System32\regsvr32.exe" (Handle: 300) "regsvr32.exe" wrote 8 bytes to a remote process "C:\Windows\System32\regsvr32.exe" (Handle: 300) "regsvr32.exe" wrote 32 bytes to a remote process "C:\Windows\System32\regsvr32.exe" (Handle: 300) "regsvr32.exe" wrote 52 bytes to a remote process "C:\Windows\System32\regsvr32.exe" (Handle: 300) "regsvr32.exe" wrote 1500 bytes to a remote process "C:\Windows\System32\regsvr32.exe" (Handle: 300) "iexplore.exe" wrote 32 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 908) "iexplore.exe" wrote 52 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 908) "iexplore.exe" wrote 8 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 908) "iexplore.exe" wrote 4 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 908) "iexplore.exe" wrote 8 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 2264) "iexplore.exe" wrote 4 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 2264) "iexplore.exe" wrote 32 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 2264) "iexplore.exe" wrote 52 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 2264)32:T6500,Found malicious artifacts related to "151.101.0.64": ... URL: https://disq.us/url?url=https://drw.sh/oyhexa:aTbf3oECxSGzDJZkbP685WgRo7w&cuid=5584184 (AV positives: 1/70 scanned on 12/10/2018 17:11:19) URL: http://service.piriform.com/installcheck.aspx (AV positives: 1/70 scanned on 11/24/2018 16:13:02) URL: https://disq.us/url?url=https%3A%2F%2Fconfig.apple.jp.serv.info.id.serviceac-id.com%2F%3F16shop (AV positives: 1/67 scanned on 11/13/2018 03:07:49) URL: http://disq.us/url?url=http://al-faraby.kz/images/stories/thumbnails/redirt.php:BUqWxy2boE1A6xQEbuqpUS68cF4&cuid=5584184 (AV positives: 3/69 scanned on 09/27/2018 22:24:35) URL: https://www.piriform.com/ccleaner/download/slim/downloadfile (AV positives: 1/67 scanned on 09/21/2018 11:21:49) File SHA256: 1b705a9adfa91a94002d5c3ae3b1bf8e7169dbc4d8674eb3a8996d371c096287 (AV positives: 10/71 scanned on 12/29/2018 04:26:08) File SHA256: 329b97ff79c1970e13cc690b0605f60cde0e58d531b2ca5578b77ebedaba064e (AV positives: 9/70 scanned on 12/26/2018 06:43:00) File SHA256: b207b3de89584317f14f55d71c33bdbac03364018cf638c6605bb5c6bf2918c4 (AV positives: 1/71 scanned on 12/22/2018 18:05:52) File SHA256: e118393fff5a808a47f0c83b5dfe57dbeb1588ff56dc4f82917bdb91ed12d2d3 (AV positives: 9/70 scanned on 12/13/2018 19:04:01) File SHA256: 966ebe7beba27dc7a4efd021d8cbd80cf8605eeb1bce31ba5d4ef364070799d7 (Date: 12/13/2018 02:03:14) File SHA256: 9a9747f1d90a073770571230aa74c403a789b73894abaa7193e5b6aca61c9786 (AV positives: 4/70 scanned on 12/05/2018 02:16:04) File SHA256: dc214043228ba08eef3b741d574f0c90bc4fe1d90e60e16bcf474af7ef741ee8 (Date: 11/24/2018 00:59:34) File SHA256: df1f9ee77844d8d6f359151e0e18653fd0b1e5bd7c09387d885985154d425598 (Date: 11/06/2018 21:31:33) File SHA256: 1d56a737be313ebf6bdcc3f25392cf38ca0aaa1d5d8cd409d267ee0b0e5672c7 (Date: 11/06/2018 21:28:50) File SHA256: 241b8574d78157dda83be3ca6d59c0a86202092242284199007a06c0893de833 (Date: 09/14/2018 11:27:18) Found malicious artifacts related to "151.101.2.202": ... URL: http://s.skimresources.com/ (AV positives: 1/68 scanned on 10/15/2018 12:49:53) URL: http://s.skimresources.com/js/101994X1558236.skimlinks.js (AV positives: 2/70 scanned on 10/15/2018 11:19:57) URL: https://s.skimresources.com/js/78494X1529245.skimlinks.js (AV positives: 1/68 scanned on 10/13/2018 09:58:44) URL: https://s.skimresources.com/ (AV positives: 1/68 scanned on 10/10/2018 10:02:45) URL: https://s.skimresources.com/js/100098X1555750.skimlinks.js (AV positives: 1/68 scanned on 10/08/2018 15:21:27) File SHA256: 8978d05cd20e7ee79c8c2f87d213fb2cc0455dfa6f5afdfa7e77b70f90567add (AV positives: 1/71 scanned on 12/26/2018 19:01:52) File SHA256: 6c7f1f425dd811a7ab53ce5284292ea39db650486f12d9015a7fa98c379f74ac (AV positives: 1/72 scanned on 12/22/2018 21:12:09) File SHA256: c1066aa25a53618bcae594e419cd41a159c3f074ff2eeecec9e421bbc6664049 (AV positives: 3/70 scanned on 12/22/2018 10:31:28) File SHA256: 153d6979b28560ce281105f3f886358a47c6f416cf99264900174de8def10dce (AV positives: 7/71 scanned on 12/18/2018 02:09:05) File SHA256: b52fa18baea07170c3a83b4ac2a7260fe2db44f4320f113dc21240df176f1962 (Date: 12/15/2018 19:51:25) File SHA256: cb54ab20f9b647c9442f181783b3f8f1684911270a346499c51f69d53430871f (Date: 12/15/2018 19:51:11) File SHA256: b42853a4895ffd47e3ef611fe12552c5aaf3926be1d0c3382c309b6ba34ee098 (Date: 12/15/2018 15:21:03) File SHA256: 895d9adcc50c6e5cd8f6b5d02bac24c2df9e9466568e9f198d480ebc485ebe13 (Date: 12/15/2018 15:11:43) File SHA256: ae7881fd99c60db797968663c5c0525e9dc110c65a1efb8698832a6dee64b98f (AV positives: 1/70 scanned on 12/11/2018 00:53:04) File SHA256: 713ac8187cd4eec4aaffde275aca0464f12845a9fa9eee9a3a82f9e1abe892b5 (Date: 12/03/2018 21:48:46) Found malicious artifacts related to "35.186.235.23": ... URL: https://cdn.mxpnl.com/engage/unsubscribe/done/ (AV positives: 1/68 scanned on 05/21/2018 23:33:42) File SHA256: 9cba9f93671cd9ce4be045295673c1fa56b32d982402b8d0896b9c10b266c4d3 (AV positives: 2/71 scanned on 12/20/2018 04:07:13) File SHA256: cccf136478117ac31dfcd8a8a3f12648de8e4dd76d2a22455521b47fc57db3fa (AV positives: 3/71 scanned on 12/20/2018 02:19:55) File SHA256: 9c9cf083bd1847d2e4e2fecab7bf9e54ccf3a6e41bd2ca6f2e8c42611410432b (AV positives: 2/69 scanned on 12/20/2018 02:15:51) File SHA256: 322ea24cec8c9582a35790f181f2dc6bfa02b17b6918542641d5c0e94fd02894 (AV positives: 18/72 scanned on 12/19/2018 21:40:14) File SHA256: f4118fa9ab1aa4796ecd48b38a025a3c98525472ad8beb25e66ef5cdc56c026d (AV positives: 2/71 scanned on 12/19/2018 21:06:51) File SHA256: cb54ab20f9b647c9442f181783b3f8f1684911270a346499c51f69d53430871f (Date: 12/15/2018 19:51:11) File SHA256: 98d59748022dad1a13b20631acb4a5d636763e4f02bbbf453b845007f8dc81eb (Date: 12/07/2018 07:50:49) File SHA256: 64af51f01159442abaf2592b4a61e08d877737e22dd9f23e37f485d8d89e624b (Date: 11/27/2018 16:04:51) File SHA256: 4605f57aa8f365568e601a1e4a6951749aaacf8a577a264026f5f0d10fe4a109 (Date: 11/20/2018 16:11:45) File SHA256: 53db6f199add189137476a53fa672a91a6799cbb6f25ac3206761bf34adafe18 (Date: 11/14/2018 19:39:27) Found malicious artifacts related to "108.177.122.97": ... File SHA256: e8ee893d19d13aff2643f4ceb1ae93c7ec122367e0e0fc7399eae2fe2b5279eb (AV positives: 15/69 scanned on 12/18/2018 06:08:46) File SHA256: 474cf31024385b06847a33126b217faf2bd74f92b515b3004c1c2122650db0f2 (AV positives: 13/71 scanned on 12/18/2018 05:53:01) File SHA256: 83bc1fb518333f44ab03fe3eeaaa8a442cce5f2afd5e8b2d49bbdce94f1cbe42 (AV positives: 14/71 scanned on 12/18/2018 05:41:28) File SHA256: 0dfa95df889fada7302563a1096e677fb0487be2844c55296f6ce1a88101cd9a (AV positives: 13/70 scanned on 12/17/2018 21:38:17) File SHA256: 9bb616744f1071baaa6505022dec660156595aa11dea3c3bcdedd0b6bec5bc93 (AV positives: 12/70 scanned on 12/17/2018 08:07:16) Found malicious artifacts related to "64.233.177.138": ... File SHA256: 9eec3aaccc0eec0e88ded959a5d9c74d903bc9d04c8c82342724fcaff39b4d72 (AV positives: 22/71 scanned on 12/28/2018 08:32:40) File SHA256: e856c759e2dd2e637aaebbfc0eeea4a7f8e7c7a02967b4db2e88dc8914b5b296 (AV positives: 20/71 scanned on 12/25/2018 06:17:47) File SHA256: 31fe58374685cb62070eb4aca79833e8ceb24a04a35de84fbcc29b1d74acd578 (AV positives: 39/70 scanned on 12/23/2018 02:56:16) File SHA256: f9ead8cf354ed7a25a12556cc8841fd6c87b79c315be26018908940beeb33b76 (AV positives: 21/72 scanned on 12/23/2018 02:23:16) File SHA256: c5aa05fa6742bed475e628b4dc9fd38e69e3b51b292e39f126e029dd870b840f (AV positives: 21/72 scanned on 12/23/2018 02:09:00) File SHA256: 4c210bab27ffc3783aef859883dcaf156d143fb344c0301dd82a3c25aefa2917 (Date: 01/21/2018 17:41:21) File SHA256: 59d5f3a2a212f411653e4f718ebf8b8a75bcfc0951b93d69850a2d4a73157048 (Date: 01/21/2018 16:25:02) File SHA256: 31c4030ca5998f11db8d89dc9b1ec212dad400d071887e7c68b607e06a1ec9a9 (Date: 12/14/2017 04:31:37) File SHA256: bc38ef4a38e9b6393e2c9cb55aa001ae58ad334c0f3da7b23440b65f52546cdc (Date: 12/14/2017 02:20:34) File SHA256: 5a325b18abbdc53ab1710a551a7fb055d39c4a3a60fdb7764b0bd5d37bd599c1 (Date: 12/14/2017 02:19:35) Found malicious artifacts related to "64.233.177.100": ... URL: http://p4-g5er74hgprfkw-w6dmgnnyvnq6dosm-895945-i1-v6exp3-v4.metric.gstatic.com/ (AV positives: 1/68 scanned on 07/26/2016 14:01:33) File SHA256: aeff2ded275ac9c7d81cf905e1edbdab7ba20188bef37652057ca18c94713027 (AV positives: 19/72 scanned on 12/23/2018 02:11:10) File SHA256: 2665c250b48f3a9b213f7335d9382c215e990d9d9ff5d7f1f5c3cfda9f34237b (AV positives: 21/71 scanned on 12/23/2018 02:09:45) File SHA256: c697ccc51bedb410b389e7639e3897c5fff127a50eb99930211b78cfe5c474b7 (AV positives: 21/73 scanned on 12/23/2018 02:30:35) File SHA256: 43247fd19f7075794fdbca6ca924cf284f4c3b72c727280b57c7568c0c3107b9 (AV positives: 20/70 scanned on 12/23/2018 01:46:51) File SHA256: 09a33d07526401ffef7d2bb45a5f12e293dc6b5e153cdadcac3283b4345fe75b (AV positives: 22/71 scanned on 12/23/2018 01:00:13) File SHA256: 2f4eb58dbf6f2e22ba950d5e779376edee7846d57e713247577528e3af4abfd0 (Date: 01/16/2018 17:07:52) File SHA256: 09fca2b4d9e7953e9f5e67db0d1a3772e2c29923ac724818209e5d9fa70271e6 (Date: 01/16/2018 16:33:42) File SHA256: cde751f0e9db15f771a25b7aa7cf2b015daf8d8ca236e110ebb623004573bb8b (Date: 01/16/2018 16:14:42) File SHA256: 2096f30105283b2d97076d5e51b61795a2787239e1dc4ac83e9b986c44acfe48 (Date: 01/16/2018 16:14:13) File SHA256: ca06ba4fd300cac9c97684374f9bf9c9d16db27a633fb99574be73e79e5834e5 (Date: 12/11/2017 11:58:05) Found malicious artifacts related to "130.211.34.183": ... URL: http://api.mixpanel.com/track/ (AV positives: 1/70 scanned on 11/20/2018 16:42:20) File SHA256: edde84d71b187e14fb109f38a719c7f4e5b22b9380a383cfda194e65ace94865 (AV positives: 51/69 scanned on 12/29/2018 07:22:43) File SHA256: cd408c48fa4fce46dc3779d7d1bd5586c790df58740ec041ec27a316e8bbd446 (AV positives: 52/70 scanned on 12/28/2018 21:04:41) File SHA256: 5c7cdba43950e4a81f7e952afb376dca69503b4d1e89eef1915f43c0e28030aa (AV positives: 33/69 scanned on 12/27/2018 22:35:50) File SHA256: ac14bc749c07c2da0b06a21d84c9fbba44878776268cdb96d50b27c08e407eb0 (AV positives: 53/70 scanned on 12/23/2018 14:42:20) File SHA256: 4eb314430f13813ee8b0421fa923791b030bc2e947b912567dd5c5f28dee99d4 (AV positives: 54/70 scanned on 12/23/2018 12:38:34) File SHA256: d29bc6f39150725f8e4077f94b53455ab604e82365ecee4db0eb18cdc5a3df42 (Date: 12/23/2018 07:15:10) File SHA256: 98d59748022dad1a13b20631acb4a5d636763e4f02bbbf453b845007f8dc81eb (Date: 12/07/2018 07:50:49) File SHA256: 8ac7059f4d0250f9f9749dfe9458ac4ba68d3a5efd92d013ef4a1a099829393a (Date: 11/30/2018 23:36:29) File SHA256: 42ebd2ee86e133ec26e6876f76d420a1ba28cd238835f1b6d280c43c93f7c299 (Date: 11/30/2018 23:31:29) File SHA256: b4e86738a0747a712ab5aa44268572b1db50d9f0dacab5a96b8c2aa68bb44fa8 (Date: 11/20/2018 16:20:11) Found malicious artifacts related to "108.177.122.95": ... File SHA256: 5c5548c964357c65596e3d5511e8800a3d7171900f41321894ef76413e66d169 (AV positives: 22/70 scanned on 12/27/2018 05:20:28) File SHA256: ab6eb8922d51f2153e26c81afbe252fd5f8dc2dee14246f903a864dc72bace7a (AV positives: 22/72 scanned on 12/27/2018 05:39:29) File SHA256: a982f4915aacf98a3e852c9339b1489d299325aa86d4704ee8954f1d53370091 (AV positives: 18/71 scanned on 12/27/2018 05:24:45) File SHA256: ec2d881b800288d10c27b48b51286f19c5f5166bc811ad4c3fec4207501fd7cf (AV positives: 13/73 scanned on 12/27/2018 09:50:31) File SHA256: f4d6c8ab95f8887ff9747629fb10ada30d7a567457895826adf769af8c6e959c (AV positives: 19/71 scanned on 12/27/2018 11:07:10) Found malicious artifacts related to "151.139.237.73": ... URL: http://piriformstatic.piriform1.netdna-cdn.com/ (AV positives: 1/67 scanned on 10/10/2018 09:08:49) File SHA256: 0ffc419ae874a003f5e05126c902bacd30d5d3e6f5867fa0ea1fea0564a8cc22 (AV positives: 32/70 scanned on 12/13/2018 09:35:31) File SHA256: 642ee2aa1edd7e6b2addc0994625c51746100ebdad0ecd2f5ec36828d9f171b2 (Date: 12/13/2018 10:51:34) File SHA256: 81e9d29f278d05132906b8b23f69f91ec64b1df864899dcbe8429856094982ce (AV positives: 33/70 scanned on 12/11/2018 03:05:37) File SHA256: 64af51f01159442abaf2592b4a61e08d877737e22dd9f23e37f485d8d89e624b (Date: 11/27/2018 16:04:51) File SHA256: 04b356b04a7f1786c2a42c369d731e4f8b5d96420e2771deada259024b43237b (AV positives: 20/68 scanned on 11/17/2018 16:53:18) File SHA256: 9eb9dc076fe9e03d52f1ebd35b412c487d7ec996d3992fbeba1febffcd93dc89 (AV positives: 2/69 scanned on 11/16/2018 18:36:22) File SHA256: 8b9f887eae10c179d988f3f01883b1fc4586bb295979cebcc29537ce81253e06 (AV positives: 1/69 scanned on 11/15/2018 22:06:12) File SHA256: 50815eeaace1d50373f49762d21241b3e5b30a52719c8c247ba5f1f692e295d1 (Date: 10/08/2018 01:43:24) File SHA256: 17378054906719f93374a6a32803be9decc766018f1e059c90c53cd71efe8a6f (Date: 09/04/2018 13:49:29) Found malicious artifacts related to "74.125.21.157": ... File SHA256: 429177829872781d0494dcb7d9739363f389dd17f69cfcf2752a0974ce39ba1a (AV positives: 11/72 scanned on 12/26/2018 19:42:54) File SHA256: 4b7deef0c4d82dbf8b7653f5d489653fa36001d650bce371032dd74aa1f250c2 (AV positives: 1/69 scanned on 12/23/2018 21:43:05) File SHA256: a885edf7016581406511251cbf34fd7f0358a65eb972bed366396cc947608f32 (AV positives: 8/71 scanned on 12/22/2018 13:10:10) File SHA256: a53a8a65d74950f49d9550278f908570446f57d8cc2716354aaf3963bce19e7f (AV positives: 12/72 scanned on 12/21/2018 14:27:17) File SHA256: 66476f46564040094e730bbc45022267c486841677e496467eb7e83080211a1e (AV positives: 8/72 scanned on 12/21/2018 03:12:37) Found malicious artifacts related to "74.125.21.95": ... URL: http://74.125.21.95/ (AV positives: 1/53 scanned on 06/23/2014 18:38:22) URL: http://fonts.googleapis.com/ (AV positives: 1/52 scanned on 06/18/2014 14:22:06) URL: http://fonts.googleapis.com/css?family=PT+Sans:400 700 400italic 700italic&subset=latin latin-ext (AV positives: 1/51 scanned on 05/01/2014 16:05:31) File SHA256: 8cae00b4e722591e7881e29f6c2e9ec48ba74bf318c5a061038ea17e75ef5c95 (AV positives: 35/70 scanned on 12/25/2018 03:12:10) File SHA256: e7da1bd0437a0a0e4f39a312257c2fad40140378fee4ff2ba82873083132f2d3 (AV positives: 17/71 scanned on 12/22/2018 02:47:17) File SHA256: 04f69f047750ce8242939e6d5714b7093646caac99a3215fbe32a218a283ea83 (AV positives: 8/71 scanned on 12/21/2018 14:23:45) File SHA256: 1404a5aee31c2e58a80faa652ca03d9f335795132d93f338c46a914c5641c378 (AV positives: 12/71 scanned on 12/21/2018 08:04:35) File SHA256: 3281245915c909c1f2b559ad12966f018ca0a20f19edcf32d6d2aac449589f5b (AV positives: 8/72 scanned on 12/21/2018 03:04:09) File SHA256: 1b1bcb552e8c8072589f3bcb91721773d5326366d312b26d2f3b205188fe2227 (Date: 05/01/2018 02:13:08) File SHA256: 04ead803f27ad4fb61cbbd2fd47ebd558d7bc6e5677b3c2292fc7b62078b359c (Date: 04/21/2018 13:21:00) File SHA256: a818a540e997d6293e35831e028778bfe6193da0ecba110c89b6d0ecb327991c (Date: 04/21/2018 13:19:33) File SHA256: 1736db207d4dd15a86b7582750344a57502a3fdc971eef5e2468c3890c4a99f0 (Date: 12/21/2016 23:50:03) File SHA256: 9347c043df61cf2dc8d5a3c7e85bbf94b2224caf28b3e4041982d90a0d5b7e59 (Date: 12/21/2016 23:45:16) Found malicious artifacts related to "64.233.185.94": ... URL: http://64.233.185.94/gwt/n (AV positives: 1/68 scanned on 09/20/2016 04:37:03) URL: https://p5-5f46nhzfdh65c-gmd7xydp5mgkanct-821180-i1-v6exp3-ds.metric.gstatic.com/ (AV positives: 1/67 scanned on 06/08/2016 14:01:28) URL: https://p5-7sxqm7bh6igxo-5b6ymwtp36po2dpu-510047-i2-v6exp3-ds.metric.gstatic.com/ (AV positives: 1/67 scanned on 06/08/2016 14:01:02) URL: http://64.233.185.94/gwt/n?u=http://76.126.163.202/ZDc4ODAxZDV/Er-rxxz/q0k8fBro/uO3ErcdtM/-h3Bu2F/5WlneL (AV positives: 1/60 scanned on 11/02/2014 19:20:05) URL: http://64.233.185.94/gwt/n?u=http://65.49.2.22/NzlkZTBhMTYG4/Dbbo_ND/DpkdMXufqf/jnVsJwNP/UYxeLKrg (AV positives: 1/60 scanned on 11/02/2014 19:20:05) File SHA256: 3dbf6de9d08386ba5bf5a4811d396aaf987538936e404837d09af70babc4e747 (AV positives: 37/72 scanned on 12/21/2018 14:27:44) File SHA256: 38aaf75f64f5267732fa60441a949980b94c3d0a7b9c6be419ee1cb9a685f3df (AV positives: 12/71 scanned on 12/19/2018 07:41:06) File SHA256: 8fd1cb748c4d7c0e8fb4b99140cabec204f32e5113dc7eccc1084d16db8366a8 (AV positives: 12/71 scanned on 12/19/2018 07:42:42) File SHA256: 290741368acc7c3f00052448024a20b6c2e77a87cc1811cddb097ef2c46828f9 (AV positives: 1/70 scanned on 12/19/2018 04:28:58) File SHA256: 04d8972812d9d961536dd471c030897a583d380950fe28fa950a6c5c8e8c6f7d (AV positives: 1/69 scanned on 12/18/2018 09:18:57) File SHA256: 1785562fd8ec39d53999464b99f10d6c1b9463ba661b82fc905195a589414a8c (Date: 12/05/2017 03:39:30) File SHA256: 15cea68349cc6b08d8851648dfe2cd1c5859c83af3d9c7bb37f6a119138f9483 (Date: 12/05/2017 03:25:56) Found malicious artifacts related to "50.97.40.233": ... URL: http://dev.visualwebsiteoptimizer.com/j.php?a=22762&u=http%3A%2F%2Fwww.blogmetrics.org%2F&r=0.5091848804305292 (AV positives: 1/65 scanned on 11/21/2017 02:05:57) URL: http://e9.28.6132.ip4.static.sl-reverse.com/ (AV positives: 1/68 scanned on 10/31/2016 22:12:02) URL: https://dev.visualwebsiteoptimizer.com/j.php?a=76624&u=https%3A%2F%2Fwww.reg.ru%2Fsupport%2F&r=0.6734753020722837 (AV positives: 1/68 scanned on 08/18/2016 13:19:18) URL: http://dev.visualwebsiteoptimizer.com/j.php?a=22587&u=http%3A%2F%2Fwww.youtubedownloadersite.com%2Ffr%2Fpremium.html%3Flngid%3D1033%26lt%3D6978%26isn%3DB35FFA6C5E154CE9A8E7E191C5E43AF3%26av%3D4.8.6%26ft%3D4&r=0.336133841496795 (AV positives: 1/60 scanned on 11/11/2014 15:31:40) URL: http://dev.visualwebsiteoptimizer.com/ (AV positives: 1/52 scanned on 04/26/2014 10:11:40) File SHA256: acc93327efa9bf0de48225316c56a19aab7d8956d27b8e02de15bc163e0f18ef (AV positives: 19/70 scanned on 11/23/2018 15:55:40) File SHA256: aea055ed153b33c079f55b17292675327986eeb1b6bef29c4f3d33195acb82a7 (AV positives: 9/67 scanned on 11/11/2018 01:10:25) File SHA256: 0a9f99f85118f1ce3f0192004b6524e7a3e62b88de3061d3969c1b94062ed84d (AV positives: 1/70 scanned on 10/04/2018 12:16:04) File SHA256: 5a49e94482aa7985dccf6f6cc3defc67d1b58c5f09e4babe03e9ff2e6298e87b (AV positives: 3/69 scanned on 08/11/2018 13:01:31) File SHA256: b4628b077fabd5c780660a95af64d99cd9d93e5c608e3e0065aa4523d0b9467f (AV positives: 40/70 scanned on 07/23/2018 14:30:44) Found malicious artifacts related to "31.13.65.7": ... URL: http://scontent-atl3-1.xx.fbcdn.net/v/t1.0-1/p48x48/30709086_10211657056043322_4301867823069196467_n.jpg (AV positives: 1/67 scanned on 05/09/2018 08:31:02) URL: http://scontent-atl3-1.xx.fbcdn.net/v/t1.0-1/p74x74/18119577_1455121814551489_7774319401815042858_n.jpg (AV positives: 1/67 scanned on 05/09/2018 07:18:12) URL: http://scontent-atl3-1.xx.fbcdn.net/v/t1.0-1/c122.38.476.476/s32x32/255042_102791979813780_2456523_n.jpg (AV positives: 1/67 scanned on 05/09/2018 07:18:11) URL: http://scontent-atl3-1.xx.fbcdn.net/v/t1.0-0/p480x480/18301393_10212597641247098_8753729905860471408_n.jpg (AV positives: 1/67 scanned on 05/09/2018 05:59:00) URL: http://sphotos-a.xx.fbcdn.net/hphotos-ash4/s720x720/315086_220907 (AV positives: 1/68 scanned on 10/19/2016 13:00:11) File SHA256: fc57143804f37d7f911bdfa9194f49a43571fa9a49361684c295c979374c56ba (AV positives: 8/71 scanned on 12/28/2018 09:22:58) File SHA256: 989a263195777c0c270b11473f59cbcbe14936d160bdc66cc4fd3e1b087eaf5e (AV positives: 3/71 scanned on 12/27/2018 15:26:39) File SHA256: ec2d881b800288d10c27b48b51286f19c5f5166bc811ad4c3fec4207501fd7cf (AV positives: 13/73 scanned on 12/27/2018 09:50:31) File SHA256: 429177829872781d0494dcb7d9739363f389dd17f69cfcf2752a0974ce39ba1a (AV positives: 11/72 scanned on 12/26/2018 19:42:54) File SHA256: 4b7deef0c4d82dbf8b7653f5d489653fa36001d650bce371032dd74aa1f250c2 (AV positives: 1/69 scanned on 12/26/2018 16:11:14) Found malicious artifacts related to "192.229.163.25": ... URL: http://platform.twitter.com/widgets/tweet_button.html?url=http%3A%2F%2Fzoemoon.com%2F2013%2F08%2F11%2Fzoe-moon-astrology-weekly-forecast-aug-12-18%2F&%3Bcounturl=http%3A%2F%2Fzoemoon.com%2F2013%2F08%2F11%2Fzoe-moon-astrology-weekly-forecast-aug-12-18%2F&%3Bcount=horizontal&%3Btext=ZOE+MOON+ASTROLOGY+WEEKLY+FORECAST+AUG+12-18 (AV positives: 1/67 scanned on 08/22/2018 12:09:25) URL: http://platform.twitter.com/widgets/tweet_button.html?url=http%3A%2F%2Fteruc.dnsalias.net%2Fblog%2F2012%2F05%2F10%2F319&text=%5BASP.NET%20MVC%5D%E3%83%AA%E3%82%BD%E3%83%BC%E3%82%B9%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E3%81%8B%E3%82%89%E3%81%AE%E3%83%A1%E3%83%83%E3%82%BB%E3%83%BC%E3%82%B8%E5%8F%96%E5%BE%97%E3%81%A8%E4%BB%BB%E6%84%8F%E3%81%AE%E7%BD%AE%E6%8F%9B%E6%96%87%E5%AD%97%E5%88%97%E3%81%AB%E5%AF%BE%E5%BF%9C%E3%81%97%E3%81%9F%E6%A4%9C%E8%A8%BC%E5%B1%9E%E6%80%A7%E3%81%AE%E5%AE%9F%E8%A3%85&lang=ja&count=horizontal (AV positives: 1/64 scanned on 01/30/2017 04:59:29) URL: https://pbs.twimg.com/media/CahUxqZW4AASA7m.jpg (AV positives: 1/67 scanned on 02/21/2016 16:11:36) URL: https://pbs.twimg.com/media/CahEtHBWEAERmWE.jpg (AV positives: 1/67 scanned on 02/21/2016 16:07:26) URL: https://pbs.twimg.com/media/Cbv9rE7WEAAYhTF.jpg (AV positives: 1/67 scanned on 02/21/2016 15:59:12) File SHA256: e7da1bd0437a0a0e4f39a312257c2fad40140378fee4ff2ba82873083132f2d3 (AV positives: 17/71 scanned on 12/22/2018 02:47:17) File SHA256: d4539d82927e72df973e009f5f730188447af920869d9320ebb9a0b6c3fd4cd3 (AV positives: 1/70 scanned on 09/01/2018 00:06:05) File SHA256: 183a783e4b4137053cb32215ffd258948b557afeec70aafdd4f4aa9ade31366c (AV positives: 40/71 scanned on 08/03/2018 13:54:20) File SHA256: 4d50fcf12a9057f50c84b726577c1a2a1e23e586e1817883ed55b7c426a02fe2 (AV positives: 1/69 scanned on 07/07/2018 02:27:49) File SHA256: fff82662e3589be64093618e8e4ff7836c527f3f747aede0143aff5d02450780 (AV positives: 28/68 scanned on 07/06/2018 17:51:09) File SHA256: 2c361e8fee10884b61e94d8995da90ab0f8baebd1f12af13f4e6267dc6ddb1bd (Date: 11/23/2017 15:52:33) File SHA256: 1be0c624091f49e1b67875f4bbe664cd55acdef22c28bcb7ee245c61907b0ec7 (Date: 11/23/2017 14:29:00) File SHA256: 84b0ca01bb8a82dabad215f47b090c554c5006bf4fbc9eacb80492a05750b02e (Date: 05/31/2016 05:15:27) File SHA256: 938766594817cb07b7052a309dc701356bf0c886765e8bbc6c61af9100c82703 (Date: 05/23/2016 02:48:04) File SHA256: e0213a169e337e14c8c45179a21a76d0204149b55a20b6608901537217842856 (Date: 04/22/2016 10:04:51) Found malicious artifacts related to "72.167.239.239": ... URL: http://ocsp.godaddy.com/ (AV positives: 1/67 scanned on 05/09/2018 19:02:36) URL: http://ocsp.godaddy.com/meowsdbgmeqwqjajbgurdgmcgguabbs2ca1fbgt26xpkokx4zguoujm0tgquqmk9j47mnimwojpx%C2%B22yz8lqsgm4ccqcjkgvs3jj/xw=3d (AV positives: 1/67 scanned on 05/09/2018 08:31:10) URL: http://ocsp.godaddy.com/meowsdbgmeqwqjajbgurdgmcgguabbrwksj2u38avi/vpjse6rtldiofkgqu%C3%BAaxhmpnsrdbi7ovfmrrndplozocccqcnmm6c/zfuog=3d (AV positives: 1/67 scanned on 05/09/2018 07:18:10) URL: http://ocsp.godaddy.com/meowsdbgmeqwqjajbgurdgmcgguabbs2ca1fbgt26xpkokx4zguoujm0tgquqmk9j47mnimwojpx%C2%B22yz8lqsgm4ccqcdzhowugvskg=3d (AV positives: 1/67 scanned on 05/09/2018 05:58:49) URL: http://ocsp.godaddy.com/mekwrzbfmemwqtajbgurdgmcgguabbs2ca1fbgt26xpkokx4zguoujm0tgquqmk9j47mnimwojpx%C2%B22yz8lqsgm4ccbojcglyvtyo (AV positives: 1/67 scanned on 05/09/2018 05:58:44) File SHA256: e004cd1232487d265f187f25837a3f8c4f2291aa7f7515da2a5d596cc5dbad9a (AV positives: 35/70 scanned on 12/17/2018 23:00:14) File SHA256: 01fd43a5fda66e727044b12ee0d8ed6d58ace922264b1037b574d871beb5a7b2 (Date: 11/15/2018 16:06:58) File SHA256: a8ea630961ac1dc6c67f7548fedbf4c10c7c51de71b41780c49998b9e6dbb627 (Date: 11/12/2018 02:00:54) File SHA256: d4f52c34d1380146528d388054563d83e5678e02fe3731b9c0a5d786113a16a2 (AV positives: 2/67 scanned on 11/10/2018 13:23:18) File SHA256: 26ccba986eb5a6887a12dc0afde451808b74d40ea32c452b53763e74938552e0 (Date: 11/09/2018 14:23:02) File SHA256: b12ce8d7fac5718717e0dd0fa38b41941814310aed91896a675e4e17e3518062 (Date: 11/09/2018 13:59:59) File SHA256: 1155b1bc22056751b38bd87b055d284342c33a05d8684de004419866d8fff300 (Date: 10/29/2018 10:21:48) File SHA256: 967d9a2ae4a507840e47f8fd044b2f2046f2af0531f29fe57d124120cdd6ba5a (AV positives: 1/70 scanned on 10/13/2018 06:38:51) File SHA256: 5044af6848814292a57b4b635d77323c3046ca403e7b42590627f444af13c557 (AV positives: 3/69 scanned on 10/13/2018 04:22:44) File SHA256: 785f2d356b1dd7deabaf375a6517df6ce05dbe4928d411984e3c696dc65a467f (AV positives: 34/70 scanned on 10/11/2018 09:25:33) Found malicious artifacts related to "72.167.239.238": ... URL: http://certificates.starfieldtech.com/repository/sfroot.crl (AV positives: 1/67 scanned on 09/04/2018 15:52:59) File SHA256: c6d89cc7edc7fa284c1e8ee42c5e0db672c8dd14db71be12f2fb3d0c1f044b9b (Date: 06/06/2018 17:09:32) File SHA256: 1eeef743b0e4aa010db909c0132e2dbb380727985d5462fe3b3fcf8d013e032d (Date: 11/27/2017 11:48:06) File SHA256: 2b2ec125f02c5dcfaf47eaccc272d2caf80b11a218ab152ab76d8dde62a35a6c (AV positives: 19/55 scanned on 07/14/2016 09:47:29) File SHA256: efce9fdfabada7ce7f03820614001b72a59c4d25aab55780987ee7e628903eb5 (AV positives: 6/53 scanned on 07/14/2016 07:26:26) File SHA256: d68232a9e014a7090c8ba8feb12dd8c2ee263621dfd5d17866dc5ea41ed55734 (AV positives: 14/54 scanned on 07/14/2016 04:43:49) File SHA256: 77f91f8ea0b1813bb469a2e4e5881ce03d76f439bb1b85e6b3e29f1edc875019 (AV positives: 20/57 scanned on 06/03/2016 03:04:44) File SHA256: 4a84758c8b793b575d2d255a1f67ae30bb02d3c2d61e1914a406020d4e5867d1 (Date: 05/20/2016 04:15:41) File SHA256: ccdece2498143fd7a80a384e5187100b05edd025fc462177b00da37ba0260649 (Date: 05/20/2016 04:13:55) File SHA256: ecd5dbf900c66bf42a6d5e56da0ce16a5be344eb08ebc31e8695590aeea749b9 (Date: 05/19/2016 02:40:44) Found malicious artifacts related to "64.233.185.101": ... URL: http://p4-cv7vsh3bnm4u4-y3ybee443hpdzkvr-472168-s1-v6exp3-v4.metric.gstatic.com/ (AV positives: 1/67 scanned on 02/16/2016 22:52:36) URL: http://64.233.185.101/ (AV positives: 1/62 scanned on 03/24/2015 18:26:11) File SHA256: 4b7deef0c4d82dbf8b7653f5d489653fa36001d650bce371032dd74aa1f250c2 (AV positives: 1/69 scanned on 12/26/2018 16:11:14) File SHA256: 060680b08c0d02a6262acf54bee8410497867a9227691f43d4e03f1113aafb55 (AV positives: 7/71 scanned on 12/23/2018 04:45:34) File SHA256: 1e32bdad6c20b48eea7daf8dde1049fb849fa36d0a41e3e72eaf2ee5e057fd4b (AV positives: 4/72 scanned on 12/22/2018 12:55:51) File SHA256: d55e02b65348b8f0969f915ef9c1bdb2cc88f5d6e6b961dadd6aca75335ee2e0 (AV positives: 37/71 scanned on 12/22/2018 09:01:25) File SHA256: 0ae02315041a66dd7dfcd4f33e6aa0fc71fa1b68eb2e37ec14b9d989c0d5f90d (AV positives: 38/72 scanned on 12/22/2018 12:47:30) File SHA256: ea89f12f946815f6aa662c8f1f223287320ad4bc796036c68d88734689e52312 (Date: 12/18/2017 19:45:17) File SHA256: ef821a18e326f0081095e8e2805f26ca07dc3f628fccee79ef686a2a26f0b9dd (Date: 12/18/2017 17:28:18) File SHA256: 27ad2b7aba1ae651118d68a10f5a27cf1e1a6747f78dda7a39f21ff0ea35974c (Date: 12/14/2017 04:35:29)33:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAB3AAAAAAAAAAAAAAAAAAB4/4h3cAAAd4iHcAAAAAB3iP////h3d4iP//hwAAAAeIj////4h3iIiP//9wAAAHiI/4J4iIeIiIiP//9wAAB4iP+CIiJ4iIiIiP//hwAAeIj/giImiIiIiIj///gAAHj4j4KiJ4iIiI//////cAB4+I+KMieIiI/4j////3AAePiPg3oo+IiPh3j///+AAHj/iId6OPiI/3iH////hAB4/4iHizeIiP+Ih/+Ij4QAeP+Ii7s3iI//+Hj4iIiEAHj/iIu7t4////+P+IiIgAB46PiIiHeP/////4iIiHAAeOj4iIiIf///+IiIiIhwAHho+IiIiHj///iIiIiHAAB4aPiIiIiHj///+IiIdwAAeIiIiIiIiHj///+IiHAAAHiIju7u7u7neP//iHcAAAB4iI7/+IiO7uZ3d3dAAAAAeP+P/////4iI7ucAAAAAAH//iI///////4iIh3AAAAB4+Hd3d4iIiPiIiIcAAAAAePh3d3d3d4iP//gAAAAAAI/4iIiIiIiI///4AAAAAAf/+IiIiIiIiI///3AAAAAI+IiIiIiIiIiP//9wAAAAB3iIiIiIiIiIeP//hwAAAAB3d4iIiIiIiAf/iIcAAAAAAAAAd3d3h3cHh3cAAAAADgAAAfgAAAB4AAAAOAAAABgAAAAYAAAACAAAAAgAAAAIAAAACAAAAAgAAAAIAAAACAAAAAgAAAAIAAAACAAAAAgAAAAIAAAACAAAABgAAAAYAAAAOAAAAPgAAAD4AAAA8AAAAPAAAAPwAAAD8AAAAfAAAAHwAAAB+AAAAf8AAAfw==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"042e307ff5cef2a37d44e3ab810cd4a5d75572e3be0a26d0552bf4855776b558","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790271580705,"unified_at":"2026-09-24T17:39:40.705Z","metadata":{"hashes":{"sha256":"042e307ff5cef2a37d44e3ab810cd4a5d75572e3be0a26d0552bf4855776b558","sha1":"3a850827fb087fb18c4e794850baae943d7a2b7b","md5":"93b05307afa14e1231be0d0535497a2a","sha512":"539c03c164eb1d3603a5768e93d8d87f93eb4843473d0d2f3b16cb3a309f9bbf5abd7ac9d4198f32192dd9fa94e83ac170f1e651aaa30baa7fcea94bd332622b","ssdeep":"98304:B/codOojppgYazg0zvAtG8fqGwbFlc23BTFw6Vkf31+P5:6U2YakSWGZGwbfhlFwOkfF+h","ssdeep_chunks":["98304:B/codOo","98304:/codOoj","98304:codOojp","98304:odOojpp","98304:dOojppg","98304:OojppgY","98304:ojppgYa","98304:jppgYaz","98304:ppgYazg","98304:pgYazg0","98304:gYazg0z","98304:Yazg0zv","98304:azg0zvA","98304:zg0zvAt","98304:g0zvAtG","98304:0zvAtG8","98304:zvAtG8f","98304:vAtG8fq","98304:AtG8fqG","98304:tG8fqGw","98304:G8fqGwb","98304:8fqGwbF","98304:fqGwbFl","98304:qGwbFlc","98304:GwbFlc2","98304:wbFlc23","98304:bFlc23B","98304:Flc23BT","98304:lc23BTF","98304:c23BTFw","98304:23BTFw6","98304:3BTFw6V","98304:BTFw6Vk","98304:TFw6Vkf","98304:Fw6Vkf3","98304:w6Vkf31","98304:6Vkf31+","98304:Vkf31+P","98304:kf31+P5","196608:B/codOo","196608:/codOoj","196608:codOojp","196608:odOojpp","196608:dOojppg","196608:OojppgY","196608:ojppgYa","196608:jppgYaz","196608:ppgYazg","196608:pgYazg0","196608:gYazg0z","196608:Yazg0zv","196608:azg0zvA","196608:zg0zvAt","196608:g0zvAtG","196608:0zvAtG8","196608:zvAtG8f","196608:vAtG8fq","196608:AtG8fqG","196608:tG8fqGw","196608:G8fqGwb","196608:8fqGwbF","196608:fqGwbFl","196608:qGwbFlc","196608:GwbFlc2","196608:wbFlc23","196608:bFlc23B","196608:Flc23BT","196608:lc23BTF","196608:c23BTFw","196608:23BTFw6","196608:3BTFw6V","196608:BTFw6Vk","196608:TFw6Vkf","196608:Fw6Vkf3","196608:w6Vkf31","196608:6Vkf31+","196608:Vkf31+P","196608:kf31+P5","98304:6U2YakS","98304:U2YakSW","98304:2YakSWG","98304:YakSWGZ","98304:akSWGZG","98304:kSWGZGw","98304:SWGZGwb","98304:WGZGwbf","98304:GZGwbfh","98304:ZGwbfhl","98304:GwbfhlF","98304:wbfhlFw","98304:bfhlFwO","98304:fhlFwOk","98304:hlFwOkf","98304:lFwOkfF","98304:FwOkfF+","98304:wOkfF+h"],"imphash":"32f3282581436269b3a75b6675fe3e08"},"file_info":{"file_name":"rcsetup152.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":4426120,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499295388000,"last_seen":1782406371000,"last_multi_scan":1782406371000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["adload","adware","chir","genkryptik","google","kryptik","stealer","bundlore","evasive","pua","suspicious"]},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":15},"sandbox_signatures":{"informative_count":38,"suspicious_count":31,"malicious_count":14,"total":83},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Win32_Bundled_Toolbar_Google_D_potentially_unsafe_application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"W32.Bundled.Toolbar.Google.D.lbwc.arc!","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win32_Bundled_Toolbar_Google_D_potentially_unsafe_application","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"informative","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"tactic":"Persistence","technique":"Bootkit","attack_id":"T1067","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1067","identifiers":[{"type":"malicious","value":"Interacts with the primary disk partition (DR0)"}],"sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1018","identifiers":[{"type":"suspicious","value":"Checks network status using ping"}],"sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"malicious","value":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00200062-00001848-51092-79-00404605","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\nsg2D0E.tmp\\System.dll\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\nsg2D0E.tmp\\UserInfo.dll\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"C:\\USERS\\PSPUBWS\\APPDATA\\LOCAL\\TEMP\\NSG2D0E.TMP\\SYSTEM.DLL\" at base 732E0000\n \"\" loaded module \"C:\\USERS\\PSPUBWS\\APPDATA\\LOCAL\\TEMP\\NSG2D0E.TMP\\SYSTEM.DLL\" at base 708D0000\n \"\" loaded module \"DWMAPI.DLL\" at base 745C0000\n \"\" loaded module \"COMCTL32.DLL\" at base 746E0000\n \"\" loaded module \"UXTHEME.DLL\" at base 745E0000\n \"\" loaded module \"C:\\WINDOWS\\SYSTEM32\\OLE32.DLL\" at base 76300000\n \"\" loaded module \"C:\\WINDOWS\\SYSWOW64\\MSCTF.DLL\" at base 74C60000\n \"\" loaded module \"ADVAPI32.DLL\" at base 768e0000\n \"\" loaded module \"OLEAUT32.DLL\" at base 74AE0000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"Alloc@System.dll\"\n \"Call@System.dll\"\n \"Free@System.dll\"\n \"DwmIsCompositionEnabled@dwmapi.dll\"\n \"RegOpenKeyExW@ADVAPI32.dll\"\n \"RegQueryInfoKeyW@ADVAPI32.dll\"\n \"RegEnumValueW@ADVAPI32.dll\"\n \"RegCloseKey@ADVAPI32.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"nsw2C81.tmp\" has type \"data\"\n \"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows\"\n \"SCHEDLGU.TXT\" has type \"Little-endian UTF-16 Unicode text, with CRLF, CR line terminators\"\n \"setupact.log\" has type \"ASCII text, with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionEx@KERNEL32.DLL at 00200062-00001848-76EC01AA-208377\n GetVersionExW@KERNEL32.DLL at 00200062-00001848-76EC01AA-208378\n GetVersion@KERNEL32.DLL at 00200062-00001848-51092-13-00406966\n GetVersionExW@KERNEL32.DLL at 00200062-00001848-51092-56-0040650D","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"$24","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Users\\PSPUBWS\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\Fonts\\staticcache.dat\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"suspicious","category":"Network Related","name":"Found potential URL in binary/memory","description":"\"http://nsis.sf.net/NSIS_Error\"","origin":"File/Memory","relevance":2,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00200062-00001848-51092-85-0040522D","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetAsyncKeyState@USER32.DLL at 00200062-00001848-51092-79-00404605","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Z:\\042e307ff5cef2a37d44e3ab810cd4a5d75572e3be0a26d0552bf4855776b558.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\nsg2D0E.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\nsg2D0E.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded string with suspicious keywords","description":"Found suspicious keyword \"Windows\" which indicates: \"May enumerate application windows (if combined with Shell.Application object)\"\n Found suspicious keyword \"Output\" which indicates: \"May write to a file (if combined with Open)\"\n Found suspicious keyword \"Lib\" which indicates: \"May run code from a DLL\"\n Found suspicious keyword \"Shell\" which indicates: \"May run an executable file or a system command\"\n Found suspicious keyword \"Put\" which indicates: \"May write to a file (if combined with Open)\"\n Found suspicious keyword \"FindWindow\" which indicates: \"May enumerate application windows (if combined with Shell.Application object)\"\n Found suspicious keyword \"Write\" which indicates: \"May write to a file (if combined with Open)\"\n Found suspicious keyword \"Open\" which indicates: \"May open a file\"","origin":"File/Memory","relevance":10,"id":"string-21","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetFileAttributesW\n CreateDirectoryW\n Sleep\n GetTickCount\n CreateFileW\n GetFileSize\n GetModuleFileNameW\n CopyFileW\n GetTempPathW\n GetCommandLineW\n CreateThread\n LoadLibraryW\n CreateProcessW\n GetTempFileNameW\n GetProcAddress\n LoadLibraryA\n GetModuleHandleA\n OpenProcess\n GetVersionExW\n GetModuleHandleW\n LoadLibraryExW\n WriteFile\n FindNextFileW\n FindFirstFileW\n DeleteFileW\n FindWindowExW\n ShellExecuteW\n RegEnumKeyW\n RegOpenKeyExW\n RegCloseKey\n RegDeleteKeyW\n RegDeleteValueW\n RegCreateKeyExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000407\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/56 Antivirus vendors marked sample as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 11264 bytes starting with PE header signature to file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\nsg2D0E.tmp\\System.dll\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00200062-00001848-51092-107-00403A42","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 21911-976-1000CC9F","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero\n Raw size of \".data\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$25","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 21911-778-10016DD0\n GetProcessHeap@KERNEL32.dll at 21911-1037-1000ABD5\n GetProcessHeap@KERNEL32.dll at 21911-1360-1001785F","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\"; Value: \"00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\042E307FF5CEF2A37D44E3AB810CD4A5D75572E3BE0A26D0552BF4855776B558.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\042E307FF5CEF2A37D44E3AB810CD4A5D75572E3BE0A26D0552BF4855776B558.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"h:\\Piriform\\Installers\\trunk\\src\\Google\\src\\pfWWW\\Release\\pfWWW.pdb\"\n \"c:\\work\\chromium\\src\\build\\Release\\gcapi_dll.pdb\"\n \"gtapi.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$26","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"nsDialogs.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"UserInfo.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"gcapi_dll.dll\" as clean (type is \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"System.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"ButtonEvent.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"pfWWW.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"gtapi_signed.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6DCA0000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"#32770\"\n \"\" searching for class \"MS_AutodialMonitor\"\n \"\" searching for class \"MS_WebCheckMonitor\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$27","origin":"Certificate Data","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" touched file \"C:\\Users\\29oiyef\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"\n \"\" touched file \"C:\\Users\\29oiyef\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini\"\n \"\" touched file \"C:\\Users\\29oiyef\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017082220170823\\\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"042e307ff5cef2a37d44e3ab810cd4a5d75572e3be0a26d0552bf4855776b558.exe.bin\" was detected as \"Nullsoft PiMP Stub -> SFX\"\n \"gcapi_dll.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is protecting 8192 bytes with PAGE_GUARD access rights in a remote process (Handle: 4294967295)","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"gcapi_dll.dll.202214965\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 21911-1013-10003BE8","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"\" opened \"MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017082220170823\" (Type: \"FileHandle\")\n \"\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017082220170823\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"nsDialogs.dll\" claimed CRC 0 while the actual is CRC 4463346\n \"gcapi_dll.dll\" claimed CRC 232084 while the actual is CRC 16653\n \"pfWWW.dll\" claimed CRC 172975 while the actual is CRC 49802\n \"gtapi_signed.dll\" claimed CRC 90535 while the actual is CRC 172975","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$28","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"level":"malicious","category":"Installation/Persistance","name":"Changes memory access rights in a remote process to write/execute","description":"\"\" changed protection rights in \"C:\\042e307ff5cef2a37d44e3ab810cd4a5d75572e3be0a26d0552bf4855776b558.exe\" (Handle: 4294967295) (Protection: \"read/write\")\n \"\" changed protection rights in \"C:\\042e307ff5cef2a37d44e3ab810cd4a5d75572e3be0a26d0552bf4855776b558.exe\" (Handle: 4294967295) (Protection: \"execute/read\")","origin":"API Call","relevance":3,"id":"api-21","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$29","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"rcsetup152.exe\" queries volume information of \"C:\\\" at 00008758-00002176-00000046-116039647362\n \"rcsetup152.exe\" queries volume information of \"C:\\\" at 00008758-00002176-00000046-117488688815\n \"recuva64.exe\" queries volume information of \"C:\\\" at 00015266-00003380-00000046-278138017972\n \"recuva64.exe\" queries volume information of \"C:\\\" at 00015266-00003380-00000046-293853011588","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"service.piriform.com\"\n \"www.piriform.com\"\n \"ocsp.pki.goog\"\n \"crl.pki.goog\"\n \"ocsp.starfieldtech.com\"\n \"crl.starfieldtech.com\"\n \"o.ss2.us\"\n \"ocsp.rootg2.amazontrust.com\"\n \"crl.sca1b.amazontrust.com\"\n \"crl.rootg2.amazontrust.com\"\n \"ocsp.sca1b.amazontrust.com\"\n \"ocsp.rootca1.amazontrust.com\"\n \"crl.rootca1.amazontrust.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"151.101.0.64\"\n \"151.101.0.64:80\"\n \"151.101.2.202:443\"\n \"35.186.235.23:443\"\n \"108.177.122.97:443\"\n \"64.233.177.138:80\"\n \"64.233.177.100:80\"\n \"130.211.34.183:443\"\n \"108.177.122.95:443\"\n \"151.139.237.73:443\"\n \"74.125.21.157:443\"\n \"74.125.21.95:443\"\n \"216.58.194.36:443\"\n \"64.233.185.94:443\"\n \"50.97.40.233:443\"\n \"31.13.65.7:443\"\n \"192.229.163.25:443\"\n \"72.167.239.239:80\"\n \"72.167.239.238:80\"\n \"64.233.185.101:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$2c","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00015188-00003992)\n Launches browser \"iexplore.exe\" (UID: 00015255-00001568)\n Launches browser \"iexplore.exe\" (UID: 00019689-00003144)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2d","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$2e","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"recuva64.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"PING.EXE\" with commandline \"ping -n 1 -w 5000 www.piriform.com\" (UID: 00012036-00002876)\n Spawned process \"regsvr32.exe\" with commandline \"/I \"%PROGRAMFILES%\\Recuva\\RecuvaShell64.dll\" /s\" (UID: 00012794-00003112)\n Spawned process \"regsvr32.exe\" with commandline \"/I \"%PROGRAMFILES%\\Recuva\\RecuvaShell64.dll\" /s\" (UID: 00012845-00003932)\n Spawned process \"recuva64.exe\" with commandline \"/installationComplete \"bin|folders|allusers\"\" (UID: 00012981-00003944)\n Spawned process \"iexplore.exe\" with commandline \"http://www.piriform.com/go/app_releasenotes?p=2&v=1.52.1086&l=10 ...\" (UID: 00015188-00003992)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3992 CREDAT:275457 /prefetch:2\" (UID: 00015255-00001568)\n Spawned process \"recuva64.exe\" (UID: 00015266-00003380)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3992 CREDAT:603154 /prefetch:2\" (UID: 00019689-00003144)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"PING.EXE\" with commandline \"ping -n 1 -w 5000 www.piriform.com\" (UID: 00012036-00002876)\n Spawned process \"regsvr32.exe\" with commandline \"/I \"%PROGRAMFILES%\\Recuva\\RecuvaShell64.dll\" /s\" (UID: 00012794-00003112)\n Spawned process \"regsvr32.exe\" with commandline \"/I \"%PROGRAMFILES%\\Recuva\\RecuvaShell64.dll\" /s\" (UID: 00012845-00003932)\n Spawned process \"recuva64.exe\" with commandline \"/installationComplete \"bin|folders|allusers\"\" (UID: 00012981-00003944)\n Spawned process \"iexplore.exe\" with commandline \"http://www.piriform.com/go/app_releasenotes?p=2&v=1.52.1086&l=10 ...\" (UID: 00015188-00003992)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3992 CREDAT:275457 /prefetch:2\" (UID: 00015255-00001568)\n Spawned process \"recuva64.exe\" (UID: 00015266-00003380)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3992 CREDAT:603154 /prefetch:2\" (UID: 00019689-00003144)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"regsvr32.exe\" (Access type: \"CREATE\"; Path: \"HKCR\\SOFTWARE\\CLASSES\\DIRECTORY\\SHELLEX\\CONTEXTMENUHANDLERS\\RECUVASHELLEXT\")\n \"regsvr32.exe\" (Access type: \"SETVAL\"; Path: \"HKCR\\SOFTWARE\\CLASSES\\DIRECTORY\\SHELLEX\\CONTEXTMENUHANDLERS\\RECUVASHELLEXT\"; Key: \"(DEFAULT)\"; Value: \"{435E5DF5-2510-463C-B223-BDA47006D002}\"), \"regsvr32.exe\" (Access type: \"CREATE\"; Path: \"HKCR\\SOFTWARE\\CLASSES\\FOLDER\\SHELLEX\\CONTEXTMENUHANDLERS\\RECUVASHELLEXT\"), \"regsvr32.exe\" (Access type: \"SETVAL\"; Path: \"HKCR\\SOFTWARE\\CLASSES\\FOLDER\\SHELLEX\\CONTEXTMENUHANDLERS\\RECUVASHELLEXT\"; Key: \"(DEFAULT)\"; Value: \"{435E5DF5-2510-463C-B223-BDA47006D002}\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"Pinging www.piriform.com [151.101.0.64]\"\n Heuristic match: \"Ping statistics for 151.101.0.64:\n Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"platform.twitter.com\" (Indicator: \"twitter\")\n \"staticxx.facebook.com\" (Indicator: \"facebook.com\")\n \"syndication.twitter.com\" (Indicator: \"twitter\")\n \"www.facebook.com\" (Indicator: \"facebook.com\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"rcsetup152.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")\n \"PING.EXE\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")\n \"recuva64.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\VSS\\DIAG\\VSSAPIPUBLISHER\")\n \"recuva64.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"rcsetup152.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"recuva64.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"recuva64.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"recuva64.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"recuva64.exe\" called \"OpenSCManager\" requesting access rights \"0X80000000L\"","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"cdp.rapidssl.com\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"$2f","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"ping -n 1 -w 5000 www.piriform.com\" (UID: 00012036-00002876)","origin":"Monitored Target","mitre_attack_id":"T1018","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$30","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"recuva64.exe\" created file \"D:\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Queries firmware table information (may be used to fingerprint/evade)","description":"\"recuva64.exe\" at 00015266-00003380-00000033-280463330072\n \"recuva64.exe\" at 00015266-00003380-00000033-280464801381","origin":"API Call","mitre_attack_id":"T1120","relevance":10,"id":"api-65","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET POLICY User-Agent Recuva (Recuva)\" (SID: 2011090, Rev: 8, Severity: 1) categorized as \"A Network Trojan was detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"rcsetup152.exe\" allocated memory in \"%WINDIR%\\SysWOW64\\srvcli.dll\"\n \"rcsetup152.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\IE.HTTP\"\n \"rcsetup152.exe\" allocated memory in \"%PROGRAMFILES%\\Recuva\\uninst.exe\"\n \"rcsetup152.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\IEXPLORE.EXE\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$31","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$32","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"malicious","category":"System Destruction","name":"Interacts with the primary disk partition (DR0)","description":"\"recuva64.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x7c088\n \"recuva64.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x70000\n \"recuva64.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x2d1400","origin":"API Call","mitre_attack_id":"T1067","relevance":5,"id":"api-59","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"rcsetup152.exe\" checked file \"C:\"\n \"recuva64.exe\" checked file \"D:\"\n \"recuva64.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"rcsetup152.exe\" (UID: 00008758-00002176)\n Spawned process \"PING.EXE\" with commandline \"ping -n 1 -w 5000 www.piriform.com\" (UID: 00012036-00002876)\n Spawned process \"regsvr32.exe\" with commandline \"/I \"%PROGRAMFILES%\\Recuva\\RecuvaShell64.dll\" /s\" (UID: 00012794-00003112)\n Spawned process \"regsvr32.exe\" with commandline \"/I \"%PROGRAMFILES%\\Recuva\\RecuvaShell64.dll\" /s\" (UID: 00012845-00003932)\n Spawned process \"recuva64.exe\" with commandline \"/installationComplete \"bin|folders|allusers\"\" (UID: 00012981-00003944)\n Spawned process \"recuva64.exe\" (UID: 00015266-00003380)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]}],"incidents":[{"name":"Spyware/Leak","details_count":2,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"}]},{"name":"Spyware","details_count":3,"details":[{"detail":"Accesses potentially sensitive information from local browsers"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Interacts with the primary disk partition (DR0)"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Marks file for deletion"},{"detail":"Checks network status using ping"}],"sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 40 domains and 40 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]}]},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":66,"imported_dlls_count":206,"dropped_files_count":0,"extracted_files_count":84,"files_written_count":622,"files_deleted_count":0,"registry_keys_created_count":18,"registry_keys_modified_count":0,"registry_keys_deleted_count":20,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":38,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":37,"dns_resolutions_count":40,"contacted_urls_count":19,"http_requests_count":19},"behavior_tags":["adload","adware","chir","genkryptik","google","kryptik","stealer","bundlore","evasive","pua"],"sample_flags":["Extracted Files","Multi-Process","Network Traffic","Sample Crashed","TOR analysis"],"sandbox_reports":[{"id":"6a3d5ce2885cb9750d0df2f7","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","malware_family":"W32.Bundled.Toolbar.Google.D.lbwc.arc","contacted_countries":["CAN","IRL","USA"],"submit_name":"rcsetup152.exe","analysis_start_time":"2026-06-25T16:52:52+00:00","indicators_count":{"informative":270,"suspicious":83,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":false},{"id":"5c2691cb7ca3e15cae0d0113","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Bundled.Toolbar.Google","contacted_countries":["EU","IRL","USA"],"submit_name":"rcsetup152.exe","analysis_start_time":"2018-12-29T10:33:42+00:00","indicators_count":{"informative":32,"suspicious":29,"malicious":15},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed","TOR analysis"],"is_in_unified_schema":true},{"id":"599c99717ca3e132ca5e1443","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":80,"malware_family":"Bundled.Toolbar.Google","submit_name":"Recuva - rcsetup152.exe","analysis_start_time":"2017-08-22T22:52:26+00:00","indicators_count":{"informative":21,"suspicious":23,"malicious":4},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"56fcdb96aac2ed2167ae9803","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":80,"malware_family":"Bundled.Toolbar.Google","submit_name":"rcsetup152.exe","analysis_start_time":"2016-03-31T03:11:30+00:00","indicators_count":{"informative":10,"suspicious":28,"malicious":5},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"5631d8380e316d7858c41199","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":58,"malware_family":"Bundled.Toolbar.Google","submit_name":"rcsetup152.exe","analysis_start_time":"2015-10-29T03:28:05+00:00","indicators_count":{"informative":5,"suspicious":14,"malicious":3},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"5631d8380e316d7858c41197","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":70,"malware_family":"Bundled.Toolbar.Google","submit_name":"rcsetup152.exe","analysis_start_time":"2015-10-29T03:27:29+00:00","indicators_count":{"informative":8,"suspicious":23,"malicious":4},"tags":["Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"558a46950e316d992784543c","environment_id":3,"environment_description":"Windows 8.1 32 bit (EN)","state":"SUCCESS","verdict":"suspicious","threat_score":42,"malware_family":"Bundled.Toolbar.Google","contacted_countries":["USA"],"submit_name":"Recuva_1.52.1086.exe","analysis_start_time":"2015-06-24T00:56:53+00:00","indicators_count":{"informative":6,"suspicious":10,"malicious":4},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":[{"address":"151.101.0.64","port":0,"protocol":"ICMP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"151.101.0.64","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"151.101.2.202","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"35.186.235.23","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"108.177.122.97","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"64.233.177.138","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"64.233.177.100","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"130.211.34.183","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"108.177.122.95","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"151.139.237.73","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"74.125.21.157","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"74.125.21.95","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"216.58.194.36","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"64.233.185.94","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"50.97.40.233","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"31.13.65.7","port":443,"protocol":"TCP","country":"Ireland","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"192.229.163.25","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"72.167.239.239","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"72.167.239.238","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"64.233.185.101","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"13.33.164.203","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"208.118.62.70","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"64.233.177.157","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"64.233.177.155","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"192.184.68.147","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"172.217.0.67","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"31.13.65.36","port":443,"protocol":"TCP","country":"Ireland","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"199.16.156.241","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"13.33.165.126","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"192.184.68.247","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"34.237.44.255","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"13.33.164.199","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"13.33.164.100","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"13.33.164.73","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"13.33.164.253","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"13.33.164.148","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"address":"13.33.164.164","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]}],"dns_resolutions":[{"domain":"ajax.googleapis.com","address":"216.58.206.10","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"2005-01-25T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"api.mixpanel.com","address":"107.178.240.159","ttl":3600,"country":"United States","registrar_name":"ENOM, INC.","registrar_organization":"WHOISGUARD, INC.","registrar_name_servers":"NS1.P16.DYNECT.NET","registrar_creation_date":"2007-03-13T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"cdn.mxpnl.com","address":"35.186.235.23","ttl":3600,"country":"United States","registrar_name":"ENOM, INC.","registrar_organization":"MIXPANEL, INC.","registrar_name_servers":"NS1.P16.DYNECT.NET","registrar_creation_date":"2012-08-01T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"cdn.syndication.twimg.com","address":"192.229.233.50","ttl":3600,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Twitter, Inc.","registrar_name_servers":"D01-01.NS.TWTRDNS.NET","registrar_creation_date":"2008-09-22T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"cdp.rapidssl.com","address":"93.184.220.29","ttl":3600,"country":"European Union","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Symantec Corporation","registrar_creation_date":"2002-04-05T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"connect.facebook.net","address":"157.240.20.19","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Facebook, Inc.","registrar_name_servers":"A.NS.FACEBOOK.COM","registrar_creation_date":"2004-04-01T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"crl.pki.goog","address":"64.233.177.100","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"crl.rootca1.amazontrust.com","address":"13.33.164.253","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Amazon Trust Services LLC","registrar_creation_date":"2007-05-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"crl.rootg2.amazontrust.com","address":"13.33.164.253","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Amazon Trust Services LLC","registrar_creation_date":"2007-05-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"crl.sca1b.amazontrust.com","address":"13.33.164.73","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"crl.starfieldtech.com","address":"72.167.239.238","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"dev.visualwebsiteoptimizer.com","address":"159.122.87.153","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"dnn506yrbagrg.cloudfront.net","address":"143.204.98.214","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"eb2.3lift.com","address":"3.122.93.108","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"fonts.googleapis.com","address":"216.58.206.10","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"fonts.gstatic.com","address":"216.58.207.35","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"googleads.g.doubleclick.net","address":"216.58.210.2","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"o.ss2.us","address":"13.33.164.199","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"ocsp.pki.goog","address":"64.233.177.138","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"ocsp.rootca1.amazontrust.com","address":"13.33.164.164","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"ocsp.rootg2.amazontrust.com","address":"13.33.164.100","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"ocsp.sca1b.amazontrust.com","address":"13.33.164.148","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"ocsp.starfieldtech.com","address":"72.167.239.239","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"pixel.quantserve.com","address":"3.8.42.50","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"platform.twitter.com","address":"93.184.220.66","ttl":3600,"country":"European Union","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"rules.quantcount.com","address":"52.222.150.210","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"s1.pir.fm","address":"151.139.237.73","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"secure.quantserve.com","address":"35.156.2.6","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"service.piriform.com","address":"151.101.0.64","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"static.xx.fbcdn.net","address":"157.240.20.19","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"staticxx.facebook.com","address":"157.240.20.19","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"stats.g.doubleclick.net","address":"74.125.140.156","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"status.rapidssl.com","address":"93.184.220.29","ttl":3600,"country":"European Union","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"syndication.twitter.com","address":"199.16.156.21","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"www.ccleaner.com","address":"151.101.2.202","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"www.facebook.com","address":"157.240.20.35","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"www.googleadservices.com","address":"172.217.22.98","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"www.gstatic.com","address":"172.217.18.163","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"www.piriform.com","address":"151.101.0.64","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"domain":"www.upsellit.com","address":"208.118.62.70","ttl":3600,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]}],"http_requests":[{"host":"service.piriform.com","host_ip":"151.101.0.64:80","url":"/installcheck.aspx?p=2&v=1.52.1086&vx=&l=1033&b=1&o=6.1W6&g=7&i=1&a=0","method":"GET","header":"GET /installcheck.aspx?p=2&v=1.52.1086&vx=&l=1033&b=1&o=6.1W6&g=7&i=1&a=0 HTTP/1.1\nUser-Agent: NSIS\nHost: service.piriform.com\nConnection: Keep-Alive\nCache-Control: no-cache\nCookie: _ga=GA1.2.1058661717.1512499756; _vwo_uuid=8CA0CCBF0619DB9518CC1266ABF15F6E; __qca=P0-623550444-1512499759844","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"host":"www.piriform.com","host_ip":"151.101.0.64:80","url":"/go/app_releasenotes?p=2&v=1.52.1086&l=1033&b=1&a=0","method":"GET","header":"GET /go/app_releasenotes?p=2&v=1.52.1086&l=1033&b=1&a=0 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.piriform.com\nDNT: 1\nConnection: Keep-Alive\nCookie: _ga=GA1.2.1058661717.1512499756; _vwo_uuid=8CA0CCBF0619DB9518CC1266ABF15F6E; __qca=P0-623550444-1512499759844","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"host":"ocsp.pki.goog","host_ip":"64.233.177.138:80","url":"/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D","method":"GET","header":"GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"host":"ocsp.pki.goog","host_ip":"64.233.177.138:80","url":"/GTSGIAG3/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCCB6bUJ0NDzPN","method":"GET","header":"GET /GTSGIAG3/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCCB6bUJ0NDzPN HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"host":"crl.pki.goog","host_ip":"64.233.177.100:80","url":"/GTSGIAG3.crl","method":"GET","header":"GET /GTSGIAG3.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.pki.goog","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"host":"ocsp.starfieldtech.com","host_ip":"72.167.239.239:80","url":"//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCAzkUhA%3D%3D","method":"GET","header":"GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCAzkUhA%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.starfieldtech.com","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"host":"ocsp.starfieldtech.com","host_ip":"72.167.239.239:80","url":"//MEowSDBGMEQwQjAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM%2BuArAQUJUWBaFAmOD07LSy%2BzWrZtj2zZmMCCQD52BZPtim28Q%3D%3D","method":"GET","header":"GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM%2BuArAQUJUWBaFAmOD07LSy%2BzWrZtj2zZmMCCQD52BZPtim28Q%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.starfieldtech.com","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"host":"ocsp.starfieldtech.com","host_ip":"72.167.239.239:80","url":"//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQUwPiEZQ6%2FsVZNPaFToNfxx8ZwqAQUfAwyH6fZMH%2FEfWijYqihzqsHWycCAQc%3D","method":"GET","header":"GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQUwPiEZQ6%2FsVZNPaFToNfxx8ZwqAQUfAwyH6fZMH%2FEfWijYqihzqsHWycCAQc%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.starfieldtech.com","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"host":"crl.starfieldtech.com","host_ip":"72.167.239.238:80","url":"/sfroot-g2.crl","method":"GET","header":"GET /sfroot-g2.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.starfieldtech.com","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"host":"crl.starfieldtech.com","host_ip":"72.167.239.238:80","url":"/sfig2s1-57.crl","method":"GET","header":"GET /sfig2s1-57.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.starfieldtech.com","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"host":"www.piriform.com","host_ip":"151.101.0.64:80","url":"/auto?p=rc&v=1.52.1086&l=1033&a=0","method":"GET","header":"GET /auto?p=rc&v=1.52.1086&l=1033&a=0 HTTP/1.1\nUser-Agent: Recuva\nHost: www.piriform.com\nCookie: _ga=GA1.2.1058661717.1512499756; _vwo_uuid=8CA0CCBF0619DB9518CC1266ABF15F6E; __qca=P0-623550444-1512499759844","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"host":"www.piriform.com","host_ip":"151.101.0.64:80","url":"/recuva/update?v=1.52.1086&l=1033&a=0","method":"GET","header":"GET /recuva/update?v=1.52.1086&l=1033&a=0 HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.piriform.com\nDNT: 1\nConnection: Keep-Alive\nCookie: _ga=GA1.2.1058661717.1512499756; _vwo_uuid=8CA0CCBF0619DB9518CC1266ABF15F6E; __qca=P0-623550444-1512499759844","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"host":"o.ss2.us","host_ip":"13.33.164.199:80","url":"//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D","method":"GET","header":"GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: o.ss2.us","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"host":"ocsp.rootg2.amazontrust.com","host_ip":"13.33.164.100:80","url":"/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D","method":"GET","header":"GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.rootg2.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"host":"crl.sca1b.amazontrust.com","host_ip":"13.33.164.73:80","url":"/sca1b.crl","method":"GET","header":"GET /sca1b.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.sca1b.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"host":"crl.rootg2.amazontrust.com","host_ip":"13.33.164.253:80","url":"/rootg2.crl","method":"GET","header":"GET /rootg2.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.rootg2.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"host":"ocsp.sca1b.amazontrust.com","host_ip":"13.33.164.148:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEA2lrpi8lkbCbJEY95Vvu%2Fw%3D","method":"GET","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEA2lrpi8lkbCbJEY95Vvu%2Fw%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.sca1b.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"host":"ocsp.rootca1.amazontrust.com","host_ip":"13.33.164.164:80","url":"/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D","method":"GET","header":"GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.rootca1.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"host":"crl.rootca1.amazontrust.com","host_ip":"13.33.164.253:80","url":"/rootca1.crl","method":"GET","header":"GET /rootca1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.rootca1.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}],"processes":[{"pid":2176,"ppid":0,"name":"rcsetup152.exe","command_line":"","sha256":"042e307ff5cef2a37d44e3ab810cd4a5d75572e3be0a26d0552bf4855776b558","normalized_path":"C:\\rcsetup152.exe","uid":"00008758-00002176","icon":"$33"},{"pid":2876,"ppid":2176,"name":"PING.EXE","command_line":"ping -n 1 -w 5000 www.piriform.com","sha256":"4ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d","normalized_path":"%WINDIR%\\SysWOW64\\PING.EXE","parent_uid":"00008758-00002176","uid":"00012036-00002876"},{"pid":3112,"ppid":2176,"name":"regsvr32.exe","command_line":"/I \"%PROGRAMFILES%\\Recuva\\RecuvaShell64.dll\" /s","sha256":"890c1734ed1ef6b2422a9b21d6205cf91e014add8a7f41aa5a294fcf60631a7b","normalized_path":"%WINDIR%\\SysWOW64\\regsvr32.exe","parent_uid":"00008758-00002176","uid":"00012794-00003112"},{"pid":3932,"ppid":3112,"name":"regsvr32.exe","command_line":"/I \"%PROGRAMFILES%\\Recuva\\RecuvaShell64.dll\" /s","sha256":"ca24aef558647274d019dfb4d7fd1506d84ec278795c30ba53b81bb36130dc57","normalized_path":"%WINDIR%\\System32\\regsvr32.exe","parent_uid":"00012794-00003112","uid":"00012845-00003932"},{"pid":3944,"ppid":2176,"name":"recuva64.exe","command_line":"/installationComplete \"bin|folders|allusers\"","sha256":"c07cb63e3b2cea1b69564656ba1f453713f124c2d03b9282df3bd7344dfe5d3e","normalized_path":"%PROGRAMFILES%\\Recuva\\recuva64.exe","parent_uid":"00008758-00002176","uid":"00012981-00003944"},{"pid":3992,"ppid":2176,"name":"iexplore.exe","command_line":"http://www.piriform.com/go/app_releasenotes?p=2&v=1.52.1086&l=1033&b=1&a=0","sha256":"58ac3fef55e35bffc0319f37434bda136ae506ec4a984dbb5fe1b7f24852a16e","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00008758-00002176","uid":"00015188-00003992"},{"pid":1568,"ppid":3992,"name":"iexplore.exe","command_line":"SCODEF:3992 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","parent_uid":"00015188-00003992","uid":"00015255-00001568"},{"pid":3144,"ppid":3992,"name":"iexplore.exe","command_line":"SCODEF:3992 CREDAT:603154 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","parent_uid":"00015188-00003992","uid":"00019689-00003144"},{"pid":3380,"ppid":2176,"name":"recuva64.exe","command_line":"","sha256":"c07cb63e3b2cea1b69564656ba1f453713f124c2d03b9282df3bd7344dfe5d3e","normalized_path":"%PROGRAMFILES%\\Recuva\\recuva64.exe","parent_uid":"00008758-00002176","uid":"00015266-00003380"}],"all_imported_dlls":["KERNELBASE.dll","SHLWAPI.dll","PSAPI.DLL","SETUPAPI.dll","cscapi.dll","CFGMGR32.dll","IMM32.DLL","netutils.dll","COMCTL32.dll","ntlanman.dll","CLBCatQ.DLL","sechost.dll","uxtheme.dll","VERSION.dll","DEVOBJ.dll","drprov.dll","davclnt.dll","System.dll","MSCTF.dll","ADVAPI32.dll","OLEAUT32.dll","GDI32.dll","ntdll.dll","kernel32.dll","USER32.dll","ole32.dll","LPK.dll","CRYPTBASE.dll","MPR.dll","RPCRT4.dll","ntmarta.dll","dwmapi.dll","SspiCli.dll","SHELL32.dll","msvcrt.dll","profapi.dll","USP10.dll","wkscli.dll","propsys.dll","cfgmgr32.dll","comctl32.dll","cryptbase.dll","usp10.dll","shlwapi.dll","version.dll","pfWWW.dll","msxml3r.dll","userenv.dll","nsDialogs.dll","urlmon.dll","mshtml.dll","shell32.dll","rpcss.dll","psapi.dll","imm32.dll","gtapi_signed.dll","wininet.dll","KernelBase.dll","oleaut32.dll","ButtonEvent.dll","shfolder.dll","advapi32.dll","crypt32.dll","msasn1.dll","msimtf.dll","setupapi.dll","riched20.dll","oleacc.dll","oleaccrc.dll","msctf.dll","apphelp.dll","sspicli.dll","msls31.dll","msxml3.dll","clbcatq.dll","user32.dll","lpk.dll","rpcrt4.dll","Wldap32.dll","winmm.dll","comdlg32.dll","devobj.dll","mlang.dll","gdi32.dll","gcapi_dll.dll","ieframe.dll","iertutil.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","linkinfo.dll","slc.dll","dui70.dll","vss_ps.dll","webio.dll","msvcp90.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","rsaenh.dll","tzres.dll","duser.dll","UIAutomationCore.dll","msvcr110.dll","imageres.dll","d2d1.dll","AcGenral.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","ws2_32.dll","cryptsp.dll","dhcpcsvc6.dll","WindowsCodecsExt.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","IEShims.dll","WSHTCPIP.DLL","VxSSL64.dll","URLREDIR.DLL","msxml6r.dll","cscdll.dll","npmproxy.dll","mpr.dll","ssv.dll","bcrypt.dll","SensApi.dll","mscoree.dll","MSOHEV.DLL","wshqos.dll","msvcp110.dll","cryptnet.dll","msxml6.dll","netprofm.dll","FWPUCLNT.DLL","api-ms-win-downlevel-user32-l1-1-0.dll","normaliz.dll","samcli.dll","netapi32.dll","wship6.dll","ieui.dll","credssp.dll","bcryptprimitives.dll","deploy.dll","dsrole.dll","dhcpcsvc.dll","ATL90.dll","ntdsapi.dll","jscript9.dll","mscorwks.dll","jp2ssv.dll","fastprox.dll","wow64win.dll","msvcr100.dll","mswsock.dll","SwDir_1231201.dll","api-ms-win-core-timezone-l1-1-0.dll","EhStorShell.dll","d3d11.dll","srvcli.dll","ieproxy.dll","dbghelp.dll","cscui.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","inetc.dll","wow64.dll","wintrust.dll","powrprof.dll","atl.dll","IPHLPAPI.DLL","sxs.dll","wbemprox.dll","nlaapi.dll","ntshrui.dll","ExplorerFrame.dll","GrooveIntlResource.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","FileSyncShell64.dll","vssapi.dll","wbemcomn.dll","msimg32.dll","lang-9999.dll","imagehlp.dll","secur32.dll","sfc.dll","RecuvaShell64.dll","winhttp.dll","npctrl.dll","dxgi.dll","dnsapi.dll","schannel.dll","mscoreei.dll","msvcr90.dll","nsi.dll","RpcRtRemote.dll","msacm32.dll","ncrypt.dll","wow64cpu.dll","api-ms-win-downlevel-version-l1-1-0.dll","WindowsCodecs.dll","sfc_os.dll","xmllite.dll","gpapi.dll","vsstrace.dll","DWrite.dll","winnsi.dll","nsExec.dll","sqmapi.dll","GROOVEEX.DLL","d3d10warp.dll","rasadhlp.dll","wbemsvc.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"System.dll","sha256":"7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"nsw2C81.tmp","sha256":"95873a30697faf1bfba368e11338dda23d388ab3081ec549776236dcbb2c0049","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"}]},{"name":"SCHEDLGU.TXT","sha256":"0e20b4a6300f4340c464afd3ca5abcb55f840844676188e856908e1f843add07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"}]},{"name":"setupact.log","sha256":"63efe8f685c48b9e9e9eafc9e5804501713e469b7f484553f52f0ad398d3dd58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"}]},{"name":"ButtonEvent.dll","sha256":"e2da6d8b73b5954d58baa89a949aacece0527dfb940ca130ac6d3fd992d0909d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"UserInfo.dll","sha256":"6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"gcapi_dll.dll","sha256":"da10e8220d101c5ea98b4872879bd27884328c3794e08cf30492af2c9343005b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"gtapi_signed.dll","sha256":"89e157a4f61d7d18180cb7f901c0095da3b7a5cc5a9fd58d710099e5f0ee505a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"pfWWW.dll","sha256":"43ddba137b3a980f427524577dc1af481193163c230aca548192a29c1c9dfdb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"nsDialogs.dll","sha256":"416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"toolbar-screenshot.jpg","sha256":"5c1155d16a903370a39f366909c40d7e86b36b0ab7f569a5ddd775fecf42b3d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"toolbar.html","sha256":"b18babdba1644f8c833ef7f3518d944f01dbce52adf17acb7d3cdad23f4fad4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"modern-header.bmp","sha256":"f2d07a76ad7d89e64ee261c81039205e44cd0f496193a25de08eac488874e1e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"modern-wizard.bmp","sha256":"1ea1d0a8b0302840b2ba4743fdef788c93517ac083b7a9da7dd25640251ce061","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"lang-1025.dll","sha256":"6c8ae2554e7ef38549870deecc6b159155aa5ce5654b4fd19c4dce21926094d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1026.dll","sha256":"836750bbe09af3266db512e99e68f7eb35e4e65b8fdf1085df65c7a34ae93798","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1027.dll","sha256":"9997697ccbbf5945f756a2dd78a904f9f1677813c84c62baa996b33638b19ead","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1029.dll","sha256":"d9490c404e270612c7a22265707eb9cf2cafb9e65817ed7f456f75429e7d8e0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1031.dll","sha256":"727c3e75400db33196bfedf847ef44295337dfed6d07c6558004b3aace6f984c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1034.dll","sha256":"eb037fa587296198bcc80f4d9ee4f409d6c929af938acd457832ea2459eaed0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1035.dll","sha256":"017378501f59381f934ce1314f7c3bff13b964a6561f250255a35268c75da7a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1036.dll","sha256":"cc24876637db56c5eccd694a1cb71c5d9fa3ec29360f30672c9adbfb4edcd2e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1038.dll","sha256":"aaf05912874a85d005e3a90201ee53dbd9e1713eb74b5a8f608d60cec8b757ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1040.dll","sha256":"b056eccbf45bdc1521f517e0edfa0b559cafe7b27a84b9c34857dc81fea00f8f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1041.dll","sha256":"e9af826f078898ee546a5bbbbde0ec7dc6634ddc7636086474cd743ca19a5013","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1043.dll","sha256":"be3dda801d7e505e29219d21329a410d5f443ee5dc2e352d9be07d58c8e1f0a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1044.dll","sha256":"a7178dac749729893a955e2bae19a382350a0dfde93c39c0f13598f72c5aec06","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1045.dll","sha256":"19ba4620ae7218b37b377f502636154ad4b9c0e9b0bdae8f148a6c1311851c24","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1046.dll","sha256":"18f40a0d0b1e31bbd27794ea54dbbd1066fa4cd0e18fa7de6a9765dbf62f5158","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1049.dll","sha256":"ce311f8b9fee5ae7fedb2118563a0b4b8d9f15883d32348d1f2920042530d6c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1051.dll","sha256":"8932b014daa8174f642051ba419cdb022c410bb4fbf5932a798a260d37c7addf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1052.dll","sha256":"5b8e3e990ac749bdb4047d8c2bb1a4f553c3fc416d5fb3db2ae05fc2a76072a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1054.dll","sha256":"b66f47d71107ed68fcd3960ca01ca93aee7f3d51f12198e0ce5934aa3ca8d323","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1055.dll","sha256":"d6929d19b48c3c1e10c56c81b158a0c1a50885475736feeecd4df56e6773d113","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1058.dll","sha256":"e79cf012d5e3cee60154e4ba0add2b6282f166523369569ad2259bba5158e1a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1059.dll","sha256":"71d43b5817ab60d3f704c6a2c019d61e384870e78d47f2aeec89f9299e524dca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1060.dll","sha256":"19258f4ea47a847b04afc6cd806f4116adf41d88e471c6386243ec3c38d07f0f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1066.dll","sha256":"503a9f886c13356c44e60c06ebd4320c061ad2d98ef3629b978fa0c23ca9140b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1067.dll","sha256":"cee6036afc1f350a43c9b209bc766ea7269032713b6ac11e27ad96cabaeb3a12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1068.dll","sha256":"1cd11d0d0b50da63d1703d8b5747f8f4e8a119631e6ae6809c35f7c82e745131","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1079.dll","sha256":"8d7dbbb22e35009623fc91b0df9037562962c3b3c1cb9ffdab55e52608ba447d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-2052.dll","sha256":"33dcc576ba567bb87e0e2318d4a4b07d06f6e8148b4b5e2bfd91e7460ac99c22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-2074.dll","sha256":"1b10e2b5755eaa16875e9978edcfdf82ecb2f74533febb1d7d3c682822e8ae82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-5146.dll","sha256":"276ea6ad1e4cdbb98a4d6ce38c2958f5afb3f17dae1e75cd25be9f99f6e2270f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"recuva.exe","sha256":"b724eb0cad6233c28eaab2901d7a29725702bc5bba9f20d1835a792c275267b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"recuva64.exe","sha256":"c07cb63e3b2cea1b69564656ba1f453713f124c2d03b9282df3bd7344dfe5d3e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"inetc.dll","sha256":"5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"nsExec.dll","sha256":"d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"Recuva Homepage.url","sha256":"d7a6da76a729d24d202d5a861e7257dcaf45a1d6f542ec662339820128a77ce4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"Recuva.lnk","sha256":"5b898a52ef4fec50a02aede8b35f9001499f04acd1d7ae5a69c92f347a9b22de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"Uninstall Recuva.lnk","sha256":"ef4dda40982624003a17b1581c8d4a80347a5d8a654072836b93fef26f7a3f80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"1006D21H.txt","sha256":"30ffd6a1431ced575f31419da272929e4aaf5aadce5490e50c3893081b3eba74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"1TZ11O8O.txt","sha256":"3a4401829071b1a6581f6fc3aa2954c84b0ecbe992ff0a1557e591c8970fdc6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"2FKJU9QI.txt","sha256":"786bb197167d344e22eca0daf09f240bb26d978f3ba0d544561356f28ff4aa83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"2O5EAO45.txt","sha256":"812b9f88cae54fb41879c4dfc90e4cd540eae5a2a1b8a388bdc33bf0dc3a4136","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"3DFT1EI0.txt","sha256":"79acfe245610424eadb286e7c1584254ac1ad64c58eac5c5588bc98de07d503e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"4Q0QWTEI.txt","sha256":"5b698abc46a1c7b3ba3a65ba05d9e840da1c318b8f4f6229e7039c7decbefdc8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"51G7OZEB.txt","sha256":"c1ec756332600531a9d06c227b3ec826cc227f72df5fb2b64fec10c5e41c5459","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"582MD8S9.txt","sha256":"0cefafb5cf5cfbc91472ed0c3ddac27673bff2ca676f15d06a9dc8274b021cd2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"6P64Q2GZ.txt","sha256":"68037a081ef630e9f5d9d1db104539b0295fb47547fc67e72fc8c718c30a9b73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"7MRUT4QR.txt","sha256":"3077a036677abc9820f8cc2b0f85f454bcf2372d152d882b910cfdad10b6893b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"8I7E9YUE.txt","sha256":"2ec933fbe4d21505dfda44e5aadefc46564e6a5e8ad1362ef0743ec401e13377","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"9ZORY8H5.txt","sha256":"a7d9a91ba584f4612c2c99199a13426b451af783a889e534de47865d30390685","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"B1XUT25R.txt","sha256":"bbef1d34f07f128ac45f2dcdb003edf35cb4330febdf9d69b71dd6896e2c7b87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"BDBGENDY.txt","sha256":"c3051338b31e032b4080770bf1ebbb83a6595d5bb2f463f64b0fdfa2e72569f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"BJFFC1E2.txt","sha256":"38d5f055de2fa8fb3fbcd9557dda6a6190ba3f58cb6890e73d9bd06264fbc185","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"BN9190PH.txt","sha256":"c9b198187fb369582ff9a094ee4aea5e4ec50f7db3df06e4485c5b979c5acbf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"BS3WSCZH.txt","sha256":"c3be3a1edaf5941b97886eb8483d25446b49185f2166cd2f83673365e2178ebb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1028.dll","sha256":"0df8afc685015ee0fe709ea75286019da39100060966b3d6d6b9712d3567fe3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1030.dll","sha256":"ea69bfa3e5109eccce425092aa27766416540c78ec8c74502fb05075be9c7956","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1032.dll","sha256":"c0919b4002060ddcbabc916240306994c997512b35519f93a93191200c80b221","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1037.dll","sha256":"835f6a4f9d60df98c1737cc38be37eca1f0d6a15b2f1b9a02b1be861e056e9b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1048.dll","sha256":"128a75fa6f9e6d840a0bf05d14b00686efa3a04d1ca51c69119a4b57126a9676","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1050.dll","sha256":"15114600ff5b78e822bbc3da9009ec79ad595cf77cd6cc24731b16293e12c048","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1053.dll","sha256":"fd2a10959bfbd9d9b1ccbcd5638ad5fc4a716475e4a5d8bb2317e0b1284decd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1057.dll","sha256":"10768632a4da873b6e46d45cfdc0d01f770a4b4d8e6eff131eefde4586f00d56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1061.dll","sha256":"1fe8aab286e4dc04f4670394a800356431170883a012698b2b4022aa6ac7ae1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1062.dll","sha256":"820b69d4168f3a4b236fae91a9890242b2b90047cdd086594d823bf5842d6797","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1063.dll","sha256":"58d464773364281636237b9ccda87bfc131f2eb18fd478c1bab128425bd833e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-1071.dll","sha256":"3cf57bc184b03a18b622417a1c15439110878973f790f36a6beb7e2a1de36c97","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-3098.dll","sha256":"6a93220487b2d14f2c8cec2e3f619a9df5f8d2ca78dfe1e1f3dc8ffd54d9fb06","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"lang-9999.dll","sha256":"d181a57f291048db591596973fa09a38c9a8fd76964e75774f250143efb83830","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"uninst.exe","sha256":"aec8494d5f068462a2ed27e52fa93eafaf8cfa19c8e5659193c35eb1354db126","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%TEMP%\\nsw2C81.tmp","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\nsg2D0E.tmp","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"}]},{"path":"%TEMP%\\nsg2D0E.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"}]},{"path":"%TEMP%\\nsg2D0E.tmp\\UserInfo.dll","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"5631d8380e316d7858c41199"},{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"C:\\042e307ff5cef2a37d44e3ab810cd4a5d75572e3be0a26d0552bf4855776b558.exe","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%TEMP%\\nsg351F.tmp","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%TEMP%\\nsf3553.tmp\\g\\gtapi_signed.dll","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%TEMP%\\nsf3553.tmp\\g\\gcapi_dll.dll","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%TEMP%\\nsf3553.tmp\\g\\pfWWW.dll","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%TEMP%\\nsf3553.tmp\\modern-header.bmp","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%TEMP%\\nsf3553.tmp\\modern-wizard.bmp","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%TEMP%\\nsf3553.tmp\\g\\pfWWW.DLL","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%TEMP%\\nsf3553.tmp\\g\\gtb\\toolbar.html","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%TEMP%\\nsf3553.tmp\\g\\gtb\\toolbar-screenshot.jpg","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017082220170823\\index.dat","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%WINDIR%\\system32\\en-US\\SHELL32.dll.mui","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"C:\\Users\\29oiyef","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%TEMP%\\nsf3553.tmp","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%TEMP%\\nsf3553.tmp\\g","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%TEMP%\\nsf3553.tmp\\g\\gtb","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%TEMP%\\nsf3553.tmp\\nsDialogs.dll","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"%TEMP%\\nsf3553.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"path":"C:\\rcsetup152.exe","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\nsf3BB8.tmp","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\nsp3C07.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\nsp3C07.tmp","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\nsp3C07.tmp\\g\\gtapi_signed.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\nsp3C07.tmp\\g\\gcapi_dll.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\nsp3C07.tmp\\g","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\nsp3C07.tmp\\modern-header.bmp","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\nsp3C07.tmp\\nsDialogs.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\nsp3C07.tmp\\g\\gcombo\\ComboOffer.html","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\nsp3C07.tmp\\g\\gcombo\\combo-offer.png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\nsp3C07.tmp\\g\\pfWWW.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\nsp3C07.tmp\\g\\gcombo\\ChromeLogo.bmp","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\nsp3C07.tmp\\g\\gcombo\\ComboText.bmp","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\Fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\Fonts\\seguisym.ttf","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\SysWOW64\\PING.EXE","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\ping.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\installcheck[1].htm","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\recuva.exe","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PUBLIC%\\Desktop\\Recuva.lnk","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Recuva","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Recuva\\Recuva.lnk","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Recuva\\Recuva Homepage.url","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Recuva\\Uninstall Recuva.lnk","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\uninst.exe","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\regsvr32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\regsvr32.exe","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\AcGenral.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\en-US\\regsvr32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\RecuvaShell64.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\http:\\www.piriform.com\\go\\app_releasenotes?p=2&v=1.52.1086&l=1033&b=1&a=0","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\UrlBlockManager\\urlblocklist.bin","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Low","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Tracking Protection","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\TabRoaming","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\~DF89B292DFDAE9E65E.TMP","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\PlayReady","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException\\Low","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache\\Low","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\Low","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\en\\IEXPLORE.EXE.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{35587C47-0B57-11E9-B182-0A0027B9126A}.dat","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\~DFC3CE07B65BECDAC2.TMP","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\L9I86110.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0DFXJQYI.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\app_releasenotes[1]","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\Macromed\\Flash\\Flash64_27_0_0_187.ocx","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_A7A8E86FCB076C144BD04C40841E7074","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\82CB34DD3343FE727DF8890D352E0D8F","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0DA515F703BB9B49479E8697ADB0B955_A7403C0A2FA2728D2D7B5B86974FA8F6","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BA79029EC3FFD076F5DAC2F70A18685","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{35587C45-0B57-11E9-B182-0A0027B9126A}.dat","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\AJM3J0V2.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\24I82KXY.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[2].ico","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\VersionManager\\verC4F7.tmp","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_49FC544F04082FD9F64F9EFB226AF8B5","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\urlblockindex[1].bin","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe.config","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\VersionManager\\verC6BC.tmp","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\app_releasenotes[1].htm","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\recuva_checkpoint.dat","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1025.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1026.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1027.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1028.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1029.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1030.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1031.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1032.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1034.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1035.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1036.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1037.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1038.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1040.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1041.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1043.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1044.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1045.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1046.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1048.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1049.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1050.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1051.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1052.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1053.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1054.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1055.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1057.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1058.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1059.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1060.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1061.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1062.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1063.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1066.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1067.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1068.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1071.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-1079.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-2052.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-2074.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\SomeRandomTmpFile748329742893.tmp","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\recuva64.exe","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[1].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[2].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[3].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[4].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[5].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[6].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[7].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[8].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[9].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[10].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon6OKFPY0S.png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-3098.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-5146.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\Lang\\lang-9999.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\faviconHZT0V3NB.png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B398B80134F72209547439DB21AB308D_082D815283257D528E2562294FA2BA49","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\69C6F6EC64E114822DF688DC12CDD86C","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_7F4AA74A3B6AAF7E85F2F3FE1488680F","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\85B3F147E3624A14E6A20DB4F6C2C5D9","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\AF3BA1CDD96BBC740C9CE3754F348BED_4EAAADF58EC74C9BA3513A34CC3DD103","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_C8BADADC89A2227D57D3BF4F6C02B175","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4Q0QWTEI.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\6P64Q2GZ.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RGED5SEF.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\gtm[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\WKGGXAQV.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\1TZ11O8O.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B8944BA8AD0EFDF0E01A43EF62BECD0_5C25CBC044F014C00B0BA9E7FEE400D7","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\7B8944BA8AD0EFDF0E01A43EF62BECD0_5C25CBC044F014C00B0BA9E7FEE400D7","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\WEGXCNNI.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_78FA14EA71970AC81C2DA64C31E7889B","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\OREC2290.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\F5F320A94D4D2B4465D8F17E2BB2D351_78FA14EA71970AC81C2DA64C31E7889B","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\release-notes[1].htm","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\CZG6DXWI.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RVSL1UYN.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{B8E87DF0-0B59-11E9-B182-0A0027B9126A}.dat","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\~DFCDA83939634C1A10.TMP","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\ga_social_tracking[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_E7F7B219F0CA34C6317CB194E7BB3FBB","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_B58DDB3938C3A436436E718C8E013457","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_1374AC543829516A5CA56081CD00C32A","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6DB145CFEEC544B1582FED1ADA3370DD","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\f[3].txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\f[1].txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\f[2].txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\css[1].css","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1E11E75149C17A93653DA7DC0B8CF53F_22F38461416926668E3D87C99FE0443C","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1E11E75149C17A93653DA7DC0B8CF53F_3377C9042E16FEF18C70B97A3A220CEC","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5B9763FB83E74617D0DB58992800F69B","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\release-notes__payment-methods[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\dot[1].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Z2LR9A36.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\Fonts\\micross.ttf","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\release-notes__bg-recuva[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC2602F5489CFE3E69F81C6328A4C17C_ED04D8BCFC668EEC75B627867581DAC5","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F463A8EC6EA3A214C73FB4FC74B1B1BD","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\release-notes__recuva-box[1].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3DFT1EI0.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EDC238BFF48A31D55A97E1E93892934B_A7467B47637944C1E4B4025C763E391F","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0270780F846F08BEFE0DD8112D932FEF","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\1E11E75149C17A93653DA7DC0B8CF53F_22F38461416926668E3D87C99FE0443C","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2FKJU9QI.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6B17EC2CD0C9B19353018FF1C12BC489","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6B17EC2CD0C9B19353018FF1C12BC489","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\35DDEDF268117918D1D277A171D8DF7B_F2DE72102A14736B534BAAAB62F0BD4B","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\35DDEDF268117918D1D277A171D8DF7B_F0069BAE5BF3C3739D7845D9FF169D75","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\739F2FF4259CDC6CBE7B90F1A95601EF","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\84AFE219AEC53B0C9251F5E19EF019BD_DBDA70FA0C7F0763826EA9179F77D209","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BEE273392BBC535B3664B7E3558FA29_D4B5C66850132497A2FF454BCED2920A","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\5B9763FB83E74617D0DB58992800F69B","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\widgets[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SG66ZB4F.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\739F2FF4259CDC6CBE7B90F1A95601EF","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\35DDEDF268117918D1D277A171D8DF7B_F2DE72102A14736B534BAAAB62F0BD4B","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YSSDJ7CZ.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\EIOD36G5.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94C18AA77707A64853AFFBE6D6382F75","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94C18AA77707A64853AFFBE6D6382F75","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EAC2EAB483DD339B0D0BA4789177B493","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\EAC2EAB483DD339B0D0BA4789177B493","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\EP37OUA1.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\98FKNM2M\\analytics[2].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\8XCJZYMQ.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\F3CYPHN9.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\spr-icons12_d7035547-1b72-45a1-9475-5c39ac9fac90[1].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\spr-icons12[1].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3IQVUB7J\\sdk[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3IQVUB7J\\j[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3IQVUB7J\\getcountry[1].htm","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\CEJ838VY.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3116BFEABE70F6384EB435D44145DC38","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\A3D5BF1283C2E63D8C8A8C72F0051F5A","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6A59C2B4529FA60196FE66A9AA54C0D5_94945BB813F9D0BA15247A12984F3B54","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\D1580BDC7A9833B50DE83ED8BC65E9A0","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\AB4621686DD9F70C2CA89F124AF3223E","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\B1XUT25R.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\f[1].txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\f[2].txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\COOMRADQ.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\L9M3EFFA.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\MICROS~2\\Office14\\GROOVEEX.DLL","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YCRA9W17.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\S7G91MAT.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\v[1].gif","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\collect[1].gif","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\0CH0OVJV\\quant[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\XDM3XH9P.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\1051649941[1].gif","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6A59C2B4529FA60196FE66A9AA54C0D5_E3E5B1B68077D103EBB873071AB8B170","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6A59C2B4529FA60196FE66A9AA54C0D5_E3E5B1B68077D103EBB873071AB8B170","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\49YAQH8Q.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\widget_iframe.d30011b0f5ce05b98f24b01d3331b3c1[1].htm","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\button.e96bb6acc0f8bda511c0c46a84ee18e4[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\582MD8S9.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\JJ0WH650\\platform.twitter[1].xml","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BN9190PH.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BDBGENDY.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\T3E6R9LX.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\P35WVQ8E.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\FUEHPJ1N.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\3FA0F92EA40DC353FF9E95B9F7D06EAF_0223BB5749EBCB29E024F2C25E39CCE3","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0AB67BD4882FB0E09822529CFEB33A58","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8A7891822FCFF127E4EADADE9757112B","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Y6EC9B1A.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\EH3SRIDH.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BJFFC1E2.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\collect[1].gif","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\follow_button.d30011b0f5ce05b98f24b01d3331b3c1.en[1].htm","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\Fonts\\ariali.ttf","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\DCE3BDBF5BDD86E2AB5B471CB90709B4_1B3ED5999B66BD19D6A54DA31F42E06B","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F94FD5F2AAEFDB64257601230509A4E9","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E961199C820C769E8780DF5E0A920455","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\j-GHT1gpo6-[1].htm","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\like[1].htm","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\like[2].htm","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\like[3].htm","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\like[4].htm","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\like[5].htm","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\like[6].htm","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\jsonp[1].jsonp","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\8A7891822FCFF127E4EADADE9757112B","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\0AB67BD4882FB0E09822529CFEB33A58","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\lH1ibRl5GKq[1].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\DCE3BDBF5BDD86E2AB5B471CB90709B4_C82ABCBFF5F798932E6AA48E5B0C1C95","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\DCE3BDBF5BDD86E2AB5B471CB90709B4_C82ABCBFF5F798932E6AA48E5B0C1C95","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\P--rCkxNnMb[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\jot[1].gif","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\8DG3WT9I.gif","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\imagestore\\js9ur7b\\imagestore.dat","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"D:","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\RecuvaBootTimeConfig.cfg","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\auto[1]","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\IH0BIABD.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JLWVX7L5.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2O5EAO45.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\suggestions[1].en-US","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\ieproxy.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{917D57AC-0B60-11E9-B182-0A0027B9126A}.dat","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\~DF1FC22C803C26C3AA.TMP","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.2","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.1","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\http:\\www.piriform.com\\recuva\\update?v=1.52.1086&l=1033&a=0","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\50D6B15D9F2DCE1EDBB0C098625FBE47_281AC807DE0FEF15F2CA9911FE760A9B","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\50D6B15D9F2DCE1EDBB0C098625FBE47_10F47D053B284EB5F3ED5550578B001D","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8FE2C641C99CFA6687FA8D31B7D528A1","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7D3BD78A30B98D17C317EDD4FFE850A0","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KHF49ZO2.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\51G7OZEB.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KJ6FANU3.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\SysWOW64\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3IQVUB7J\\update[1]","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES(X86)%\\MICROS~2\\Office14\\URLREDIR.DLL","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZOG1AP6O.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_151\\lib\\plugin.jar","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_151\\bin\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\SysWOW64\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\50D6B15D9F2DCE1EDBB0C098625FBE47_281AC807DE0FEF15F2CA9911FE760A9B","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\N89NDR7U.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0DA515F703BB9B49479E8697ADB0B955_7DC3E633EDFAEFC3AA3C99552548EC2F","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\0DA515F703BB9B49479E8697ADB0B955_7DC3E633EDFAEFC3AA3C99552548EC2F","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\update[1].htm","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_C9FB72B5AE80778A08024D8B0FDECC6F","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_77EB97F2E95D4980FAA5A3E040A0FF80","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\jquery-migrate-1.2.1.min[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\trunk8[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\hide-page-furniture[1].css","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\modernizr-custom[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\vendor.min[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\piriform.bootstrap.bundle[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\piriform.commons.bundle[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\piriform.consumer.bundle[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\global--blessed.1[1].css","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\api[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\css[2].css","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\global--blessed[1].css","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\jquery.min[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\btn-hamburger-grey[1].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\piriform.app.min[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\mem5YaGs126MiZpBA-UN_r8OUuhv[1].woff","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\mem8YaGs126MiZpBA-UFVZ0d[1].woff","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\mem5YaGs126MiZpBA-UNirkOUuhv[1].woff","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\SysWOW64\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\graph[1].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_FDB452422670E72EDD3FB3D65568F821","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CFE86DBBE02D859DC92F1E17E0574EE8_FDB452422670E72EDD3FB3D65568F821","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_7A1B7A024A19B8C038EFD589E0CB31F0","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_85E47B54A726061790AF7D8E09E6FCF0","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\01B16CDBADE7DB774141D7E30D50EC69","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\01B16CDBADE7DB774141D7E30D50EC69","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\mem5YaGs126MiZpBA-UN7rgOUuhv[1].woff","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\jscript9.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\rc_64[1].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\mixpanel-2-latest.min[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\tool[1].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3IQVUB7J\\rc_128[1].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\gtm[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\save20[1].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\search-icon[1].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\ccleaner-logo--small[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\bonus[1].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\tick-white[1].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3IQVUB7J\\piggy-bank[1].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\api[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\strike-out[1].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\up-to-date[1].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_C9FB72B5AE80778A08024D8B0FDECC6F","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\getcountry[1].htm","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\9BEE273392BBC535B3664B7E3558FA29_654CB8F8F24017848C02A620E379D0A4","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\9BEE273392BBC535B3664B7E3558FA29_654CB8F8F24017848C02A620E379D0A4","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3IQVUB7J\\rules-p-2Vcf5EEk4gbDT[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B398B80134F72209547439DB21AB308D_CCF564BE5A3C924B17DDEBDEB5236E12","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B398B80134F72209547439DB21AB308D_CCF564BE5A3C924B17DDEBDEB5236E12","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\AF3BA1CDD96BBC740C9CE3754F348BED_E8DF23930115C09F72B41C3B9B8C152B","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\AF3BA1CDD96BBC740C9CE3754F348BED_E8DF23930115C09F72B41C3B9B8C152B","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\8I7E9YUE.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3IQVUB7J\\quant[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\recaptcha__en[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SXQ5B304.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SKE1RT39.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\PMKKO0JR.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Q6KQ2NCD.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\M9SQXTYL.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\THSMOOE7.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\j[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\O2FDR7TK\\www.ccleaner[1].xml","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\Recuva\\016a0382-3084-4078-9721-4a1cf66864ad.dmp","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BS3WSCZH.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\vanj-832994338cf563d3fdab70114105f3bf[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\track-832994338cf563d3fdab70114105f3bf[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\9ZORY8H5.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3IQVUB7J\\gtm[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\AF3BA1CDD96BBC740C9CE3754F348BED_E835CF234DD3BCDF95177D28D134F685","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\AF3BA1CDD96BBC740C9CE3754F348BED_84B2A8FE92246DC0346A15FDFFD89F43","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1694560B0C737E58D6701D2EF2176C07","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\1694560B0C737E58D6701D2EF2176C07","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\kernel32.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\rules-p-2Vcf5EEk4gbDT[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\analytics[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\piriform[1].js","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\en-US\\ntdll.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\ntdll.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\en-US\\kernel32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\FAHNXQAD.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\version.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3IQVUB7J\\search[1].json","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\wininet.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\api-ms-win-downlevel-user32-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\user32.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\gdi32.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\usp10.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\en-US\\shlwapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\shlwapi.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_BD8B98368542C3BBAE3413A0EF3BB623","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_BD8B98368542C3BBAE3413A0EF3BB623","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\3FA0F92EA40DC353FF9E95B9F7D06EAF_02A7BB8D663AB0A2D3E0CE44422ED38B","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\3FA0F92EA40DC353FF9E95B9F7D06EAF_02A7BB8D663AB0A2D3E0CE44422ED38B","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\KernelBase.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\rpcrt4.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\msvcrt.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\system32\\en-US\\iertutil.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\system32\\en\\iertutil.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\iertutil.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\api-ms-win-downlevel-advapi32-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\en-US\\sechost.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\sechost.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\userenv.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\profapi.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\en-US\\comdlg32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\comdlg32.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\lpk.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\\comctl32.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\api-ms-win-downlevel-shlwapi-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\en-US\\ole32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\DE3USM3U.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\api-ms-win-downlevel-version-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\system32\\en-US\\OLEAUT32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\system32\\en\\OLEAUT32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\api-ms-win-downlevel-normaliz-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\oleaut32.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\normaliz.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\35DDEDF268117918D1D277A171D8DF7B_CDB17D43FC6D9B699A44D54F093969B6","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\35DDEDF268117918D1D277A171D8DF7B_B40D23FDBADEE7AC5CF5C036F5095079","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BEC6224B02D155A396218A2504F3EE0B","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\BEC6224B02D155A396218A2504F3EE0B","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\ws2_32.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\advapi32.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\crypt32.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\SysWOW64\\Adobe\\Director\\SwDir_1231201.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\SysWOW64\\Macromed\\Flash\\Flash32_27_0_0_187.ocx","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\imm32.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft Silverlight\\5.1.50907.0\\npctrl.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\7MRUT4QR.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\msctf.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\1006D21H.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\msvcr100.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\FW4N5DQ0.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\ole32.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\en-US\\uxtheme.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\uxtheme.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\SysWOW64\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\favicon-32x32[1].png","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\XGLN9KBL.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\msimg32.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JQ4JXHWK.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\ncrypt.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\nsi.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\bcrypt.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\msasn1.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\en-US\\gpapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\wintrust.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\gpapi.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\cryptnet.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\Wldap32.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\SensApi.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\sspicli.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\cryptbase.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\setupapi.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\dbghelp.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\cfgmgr32.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\imagehlp.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\devobj.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\cryptsp.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\propsys.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\en-US\\ncrypt.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\ntmarta.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\WindowsCodecs.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\bcryptprimitives.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\en-US\\apphelp.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\apphelp.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\RpcRtRemote.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\clbcatq.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\dwmapi.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\en-US\\EhStorShell.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\EhStorShell.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%WINDIR%\\System32\\en-US\\ntmarta.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B66240B0F6C84BD4857ABA60CF5CE4A0_F03A28002BA04D67D40293EB07685203","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6A2279C2CA42EBEE26F14589F0736E50","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\msvcp110.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\msvcr110.dll","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BAD725C80F9E10846F35D039A996E4A8_01BD2FE9C7DF0143054864DFB0B10442","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BCB67D7ECB470284AF35679F339E879F","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\75CA58072B9926F763A91F0CC2798706_0241374F35FAA6F6819A32A1ABF08ACF","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\620BEF1064BD8E252C599957B3C91896","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\FC5A820A001B41D68902E051F36A5282_FE370BCE722572793E2D45CE48CA8FB0","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\FC5A820A001B41D68902E051F36A5282_CB0A82E96468C224A303295FD7472EC3","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0E5B83846ED89B039687803786DE6F9B","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\OIYXLRX1.txt","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{F128B26C-0B62-11E9-B182-0A0027B9126A}.dat","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%TEMP%\\~DFF2BCC922109C6F61.TMP","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\BCB67D7ECB470284AF35679F339E879F","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\620BEF1064BD8E252C599957B3C91896","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\FC5A820A001B41D68902E051F36A5282_FE370BCE722572793E2D45CE48CA8FB0","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\0E5B83846ED89B039687803786DE6F9B","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\GOOGLE\\GOOGLE TOOLBAR\\","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"key":"HKLM\\SOFTWARE\\GOOGLE\\NO TOOLBAR OFFER UNTIL\\","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SHELL EXTENSIONS\\CACHED\\","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\APPID\\{80109467-DE5A-42A1-9445-7E3952C80B6E}\\","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\APPID\\RECUVASHELL.DLL\\","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{435E5DF5-2510-463C-B223-BDA47006D002}\\","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{435E5DF5-2510-463C-B223-BDA47006D002}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\DIRECTORY\\SHELLEX\\CONTEXTMENUHANDLERS\\RECUVASHELLEXT\\","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\FOLDER\\SHELLEX\\CONTEXTMENUHANDLERS\\RECUVASHELLEXT\\","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\TYPELIB\\{CA6C28CD-35A7-4D30-864B-5CF44422BAD2}\\","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\TYPELIB\\{CA6C28CD-35A7-4D30-864B-5CF44422BAD2}\\1.0\\","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\TYPELIB\\{CA6C28CD-35A7-4D30-864B-5CF44422BAD2}\\1.0\\FLAGS\\","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\TYPELIB\\{CA6C28CD-35A7-4D30-864B-5CF44422BAD2}\\1.0\\0\\","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\TYPELIB\\{CA6C28CD-35A7-4D30-864B-5CF44422BAD2}\\1.0\\0\\WIN64\\","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\TYPELIB\\{CA6C28CD-35A7-4D30-864B-5CF44422BAD2}\\1.0\\HELPDIR\\","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCU\\SOFTWARE\\PIRIFORM\\RECUVA\\","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKLM\\SOFTWARE\\PIRIFORM\\RECUVA\\","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLM\\SOFTWARE\\GOOGLE\\GOOGLE TOOLBAR\\TEST\\TEST","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"key":"HKLM\\SOFTWARE\\GOOGLE\\GOOGLE TOOLBAR\\","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"key":"HKLM\\SOFTWARE\\GOOGLE\\NO TOOLBAR OFFER UNTIL\\PIRIFORM LTD\\PIRIFORM LTD","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{00000000-0000-0000-0000-000000000000}\\{00000000-0000-0000-0000-000000000000}","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TABBEDBROWSING\\NEWTABPAGE\\MFV\\MFV","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{13C4E657-95AE-4E99-9C74-268A24CDB988}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SQM\\FREEZEUPLOADS\\HIGHTIME\\HIGHTIME","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SQM\\FREEZEUPLOADS\\LOWTIME\\LOWTIME","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4\\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!PrivacIE!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!29oiyef!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!29oiyef!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!29oiyef!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!29oiyef!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!29oiyef!appdata!local!microsoft!windows!history!history.ie5!mshist012017082220170823!","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"Local\\c:!users!29oiyef!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"Local\\c:!users!29oiyef!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"Local\\c:!users!29oiyef!appdata!local!microsoft!windows!history!history.ie5!mshist012017082220170823!","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"Local\\c:!users!29oiyef!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"Local\\!PrivacIE!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"},{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"Local\\c:!users!29oiyef!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"599c99717ca3e132ca5e1443"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f98_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"IsoScope_f98_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"IsoScope_f98_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"IsoScope_f98_IE_EarlyTabStart_0x938_Mutex","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"IsoScope_f98_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3992","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"IsoScope_f98_ConnHashTable<3992>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3992","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f98_IE_EarlyTabStart_0x938_Mutex","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f98_ConnHashTable<3992>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f98_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f98_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_f98_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\https://www.ccleaner.com/","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\https://platform.twitter.com/","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"IsoScope_f98_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"Local\\https://platform.twitter.com/","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]},{"name":"Local\\https://www.ccleaner.com/","sources":[{"report_type":"sandbox","report_id":"5c2691cb7ca3e15cae0d0113"}]}]}},"report_ids":{"sandbox_job_ids":["5c2691cb7ca3e15cae0d0113","56fcdb96aac2ed2167ae9803","599c99717ca3e132ca5e1443","5631d8380e316d7858c41197","5631d8380e316d7858c41199"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Win32_Bundled_Toolbar_Google_D_potentially_unsafe_application Sample 042e307ff5ce… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 042e307ff5ce…. Malware family: Win32_Bundled_Toolbar_Google_D_potentially_unsafe_application. Threat score 100/100. 4/28 AV engines flagged this file. 14 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/042e307ff5cef2a37d44e3ab810cd4a5d75572e3be0a26d0552bf4855776b558"}],["$","meta","4",{"property":"og:title","content":"Malicious Win32_Bundled_Toolbar_Google_D_potentially_unsafe_application Sample 042e307ff5ce… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 042e307ff5ce…. Malware family: Win32_Bundled_Toolbar_Google_D_potentially_unsafe_application. Threat score 100/100. 4/28 AV engines flagged this file. 14 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/042e307ff5cef2a37d44e3ab810cd4a5d75572e3be0a26d0552bf4855776b558"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win32_Bundled_Toolbar_Google_D_potentially_unsafe_application Sample 042e307ff5ce… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 042e307ff5ce…. Malware family: Win32_Bundled_Toolbar_Google_D_potentially_unsafe_application. Threat score 100/100. 4/28 AV engines flagged this file. 14 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L34","11",{}]]