26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T436,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 0cb9f3979800… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample 0cb9f3979800…. Threat score 35/100. 0/1 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0cb9f3979800b47dd3d4eed51c6e2315e0cbe17281944df74c343cc41ca66f3a","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","0cb9f3979800b47dd3d4eed51c6e2315e0cbe17281944df74c343cc41ca66f3a"],"about":{"@type":"SoftwareApplication","name":"https://twitter.com/i/events/1259454905057771521","applicationCategory":["url"],"identifier":"0cb9f3979800b47dd3d4eed51c6e2315e0cbe17281944df74c343cc41ca66f3a","additionalType":"Suspicious sample"},"threatScore":35,"antivirusDetections":{"malicious":0,"total":1},"behavioralIndicators":{"malicious":0,"suspicious":2},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5dc,"urlblockindex_1_.bin" has type "data" "U6FPEGWD.txt" has type "ASCII text" "RecoveryStore._36B5C3F7-92B7-11EA-BDD6-0A00276262EF_.dat" has type "Composite Document File V2 Document Cannot read section info" "error_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines" "6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04" has type "data" "edge-icons-Regular_1_.eot" has type "Embedded OpenType (EOT)" "LJSNJ6FJ.txt" has type "ASCII text" "c6qH14Kj_bigger_1_.jpg" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 progressive precision 8 73x73 frames 3" "35DDEDF268117918D1D277A171D8DF7B_52759E6468B898F78B57D06B96A93174" has type "data" "ver2DFC.tmp" has type "XML 1.0 document UTF-8 Unicode (with BOM) text with CRLF line terminators" "1259454905057771521_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines" "~DFED1235CC477A2F04.TMP" has type "data" "suggestions_1_.en-US" has type "data" "~DF800E969390074525.TMP" has type "data" "G9MAWHUY.txt" has type "ASCII text" "BE8B021F9E811DFC8C8A28572A17C05A_D5863C0497DF3485567798AEF402E5E9" has type "data" "BE8B021F9E811DFC8C8A28572A17C05A_ABAA1CF1134F6E0BC989829638FDB311" has type "data" "ver2CF3.tmp" has type "XML 1.0 document UTF-8 Unicode (with BOM) text with CRLF line terminators" "LBDBN6KT.txt" has type "ASCII text" "_3F7221BA-92B7-11EA-BDD6-0A00276262EF_.dat" has type "Composite Document File V2 Document Cannot read section info"28:T1c48,"https://twitter.com/i/events/1259454905057771521" (Indicator: "twitter") "https://twitter.com" (Indicator: "twitter") "analytics.twitter.com" (Indicator: "twitter") "syndication.twitter.com" (Indicator: "twitter") "twitter.com" (Indicator: "twitter") "GET /i/events/1259454905057771521 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: twitter.com DNT: 1 Connection: Keep-Alive" (Indicator: "twitter") "GET /media/EXp6u8lXYAAIMKl.jpg HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: https://twitter.com/i/events/1259454905057771521 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: pbs.twimg.com DNT: 1 Connection: Keep-Alive" (Indicator: "twitter") "GET /profile_images/1087992657551474690/c6qH14Kj_bigger.jpg HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: https://twitter.com/i/events/1259454905057771521 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: pbs.twimg.com DNT: 1 Connection: Keep-Alive" (Indicator: "twitter") "GET /media/EXp7pVyXsAYY1n_.jpg HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: https://twitter.com/i/events/1259454905057771521 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: pbs.twimg.com DNT: 1 Connection: Keep-Alive" (Indicator: "twitter") "HTTP/1.1 200 OK access-control-allow-credentials: true access-control-allow-origin: https://twitter.com access-control-expose-headers: content-disposition: attachment; filename=json.json content-encoding: gzip content-length: 139 content-type: application/json;charset=utf-8 date: Sun, 10 May 2020 12:10:45 GMT server: tsa_a strict-transport-security: max-age=631138519 vary: Origin x-connection-hash: 74e6181e571d0cd02b788dac11b4aa7b x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-response-time: 8 x-transaction: 005157ce00b06d27 x-xss-protection: 0" (Indicator: "twitter") "HTTP/1.1 200 OK access-control-allow-credentials: true access-control-allow-origin: https://twitter.com access-control-expose-headers: content-disposition: attachment; filename=json.json content-encoding: gzip content-length: 28 content-type: application/json;charset=utf-8 date: Sun, 10 May 2020 12:11:13 GMT server: tsa_a strict-transport-security: max-age=631138519 vary: Origin x-connection-hash: 74e6181e571d0cd02b788dac11b4aa7b x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-response-time: 7 x-transaction: 004d58bf00740c84 x-xss-protection: 0" (Indicator: "twitter") "HTTP/1.1 200 OK access-control-allow-credentials: true access-control-allow-origin: https://twitter.com access-control-expose-headers: content-disposition: attachment; filename=json.json content-encoding: gzip content-length: 28 content-type: application/json;charset=utf-8 date: Sun, 10 May 2020 12:12:10 GMT server: tsa_a strict-transport-security: max-age=631138519 vary: Origin x-connection-hash: 74e6181e571d0cd02b788dac11b4aa7b x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-response-time: 8 x-transaction: 008122cf0096e10d x-xss-protection: 0" (Indicator: "twitter") "HTTP/1.1 200 OK cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 content-encoding: gzip content-length: 65 content-type: image/gif;charset=utf-8 date: Sun, 10 May 2020 12:10:45 GMT expires: Tue, 31 Mar 1981 05:00:00 GMT last-modified: Sun, 10 May 2020 12:10:45 GMT p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" pragma: no-cache server: tsa_a set-cookie: metrics_token="v1:15891126454315579073831209"; Max-Age=3369600; Expires=Thu, 18 Jun 2020 12:10:45 GMT; Path=/i/jot/syndication; Domain=.syndication.twitter.com status: 200 OK strict-transport-security: max-age=631138519 x-connection-hash: eb58be867b90d1ddb6cace51080ef6f4 x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-response-time: 5 x-transaction: 00ba597800fee826 x-twitter-response-tags: BouncerCompliant x-xss-protection: 0" (Indicator: "twitter") "HTTP/1.1 200 OK cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 content-encoding: gzip content-length: 65 content-type: image/gif;charset=utf-8 date: Sun, 10 May 2020 12:11:13 GMT expires: Tue, 31 Mar 1981 05:00:00 GMT last-modified: Sun, 10 May 2020 12:11:13 GMT pragma: no-cache server: tsa_a status: 200 OK strict-transport-security: max-age=631138519 x-connection-hash: eb58be867b90d1ddb6cace51080ef6f4 x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-response-time: 6 x-transaction: 0050f7da0075e336 x-twitter-response-tags: BouncerCompliant x-xss-protection: 0" (Indicator: "twitter") "HTTP/1.1 200 OK cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 content-encoding: gzip content-length: 65 content-type: image/gif;charset=utf-8 date: Sun, 10 May 2020 12:12:10 GMT expires: Tue, 31 Mar 1981 05:00:00 GMT last-modified: Sun, 10 May 2020 12:12:10 GMT pragma: no-cache server: tsa_a status: 200 OK strict-transport-security: max-age=631138519 x-connection-hash: eb58be867b90d1ddb6cace51080ef6f4 x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-response-time: 7 x-transaction: 0024babf0049a4d8 x-twitter-response-tags: BouncerCompliant x-xss-protection: 0" (Indicator: "twitter") "GET /analytics.js HTTP/1.1 Accept: application/javascript, */*;q=0.8 Referer: https://twitter.com/i/events/1259454905057771521 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.google-analytics.com If-Modified-Since: Mon, 13 Nov 2017 20:19:12 GMT DNT: 1 Connection: Keep-Alive" (Indicator: "twitter") "GET /pixel?google_nid=twitter_dbm&google_cm&tpm_cb=partnerIdSyncComplete&_=1589112636613 HTTP/1.1 Accept: application/javascript, */*;q=0.8 Referer: https://twitter.com/i/events/1259454905057771521 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: cm.g.doubleclick.net DNT: 1 Connection: Keep-Alive" (Indicator: "twitter") "GET /pixel?google_nid=twitter_dbm&google_cm=&tpm_cb=partnerIdSyncComplete&_=1589112636613&google_tc= HTTP/1.1 Accept: application/javascript, */*;q=0.8 Referer: https://twitter.com/i/events/1259454905057771521 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: cm.g.doubleclick.net DNT: 1 Connection: Keep-Alive Cookie: test_cookie=CheckForPermission" (Indicator: "twitter") "-equiv="content-type" content="text/html;charset=utf-8"> 302 Moved

302 Moved

The document has moved here. " (Indicator: "twitter") "toTwitter" (Indicator: "twitter")29:T85c,"iexplore.exe" wrote bytes "a0354d6d" to virtual address "0x75CE1144" (part of module "LPK.DLL") "iexplore.exe" wrote bytes "b0334d6d" to virtual address "0x772C14E0" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "b0334d6d" to virtual address "0x75AE17CC" (part of module "ADVAPI32.DLL") "iexplore.exe" wrote bytes "30304d6d" to virtual address "0x6ADCFE90" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "b0334d6d" to virtual address "0x73CE1250" (part of module "UXTHEME.DLL") "iexplore.exe" wrote bytes "a0354d6d" to virtual address "0x77391064" (part of module "IMM32.DLL") "iexplore.exe" wrote bytes "b0334d6d" to virtual address "0x7713917C" (part of module "IERTUTIL.DLL") "iexplore.exe" wrote bytes "60d2506d" to virtual address "0x75F31D7C" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "80323300703233000032330060323300503233004032330030323300000000002cc90376c021330000000000901733005023330000183300601f330020363300000000004036330000000000" to virtual address "0x00338000" "iexplore.exe" wrote bytes "b0334d6d" to virtual address "0x77391210" (part of module "IMM32.DLL") "iexplore.exe" wrote bytes "a0354d6d" to virtual address "0x753B1298" (part of module "MSCTF.DLL") "iexplore.exe" wrote bytes "60cd506d" to virtual address "0x75F31E14" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "60cd506d" to virtual address "0x6ADCFEC0" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "a0354d6d" to virtual address "0x73CE139C" (part of module "UXTHEME.DLL") "iexplore.exe" wrote bytes "60d2506d" to virtual address "0x6ADCFEC4" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "c03a4d6d" to virtual address "0x6ADCFE80" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "60d2506d" to virtual address "0x75A813B8" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "b0334d6d" to virtual address "0x74611038" (part of module "VERSION.DLL") "iexplore.exe" wrote bytes "b0334d6d" to virtual address "0x75C411BC" (part of module "GDI32.DLL") "iexplore.exe" wrote bytes "30304d6d" to virtual address "0x75A81380" (part of module "SHLWAPI.DLL")2a:Ta2c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAHaElEQVR42s2Xa2yT1xnHrVGpk9p10rSWTBOXVu32qV+mae0YE13VaWUslI00oyC6TmNAoYW2AcqlINaBqCBgxySxIRdICAkk3BOghIRbyAJkXAIJl8QOhMTEudjx9fXltf3bOW8IiRVTEHzZkf6ycpzX/995nuc857w63f/zKCsrY+/evXHas2ePJvmdVGlpKbt379a0a9cuSkpKNBUXF7Nz506KiorYsWMHTwQgDZ9mWCwWTp8+pYEWFhbyVACxWEwoSjT6XYoQiQyqu7ubgd+QUcjJyeEpAB5iGrSAzwi904nZXifWOY6IQ09QUVBVVUuXHKFQiC1btpCZmckTAQxbqb8BXDPhThJcHkn0/CjCDVNRr0+G+peINKXgd7u1GhkA6Ovrw2AwaCCPBTBAf9epcOCyjYyqZsynG7BZVhG0vECw7hmUAz/g1kkzLfX1WISsly5hv7qPaHUSbpGC6uoqCgoK2Lp1q7b6iooKcnNzHw8gv2SvMGxl4Z5G1tXe5XjnDdS+94h1fJ9YpY7KvbNYVlLJrOzjGMovcc/pE7lXcXV3oV79E87OTvqcDlpbrTQ1NWqffr//8Wph9OJDpKQfZGmNjTxnjDb/cZHrN+C2jli5juorxegb77L8uotpdX2kFl5lQeE5Gtp6CYfDRKxzcPf0EA4Fxd+hB5JDRuOR5mOXVbDilo99iorbvw2UN6FJR/TACArrSllzrYO1dwOs7YrxpQ1mXPDwx313mJ13lmt3bITbTXgcjvsA4fsKagDfWQMvLTjImC/LWdaicCioipCZhPlvRKHpiBQ/w+rcHGaZq5lfXE/a0Zusavay8h58bo3wwTkP75a28knBWTo7WwgofgEQum8+GAGz2fxwgDFLDvPxqXax8hgepUCYj4eLOtQdIzh1ppy2bjcRsb06HB7KL7cxd1styxvdfGWH+c1hJp/sI9lcT8aRhjhjuQuk5DCZTIkBktL2MM5QQ6EnRqcich56GxrEyotGcO3iMc1YFpmU3ONSxxs7WHiwidXtKktFJGZe9vHWQTvTM0/SanfGmYdC/SnIzs7mIasvZ4mo9uu+RghPgpui4Ip1ZG7LIBQMDjOXUsT8P/Nq+Noa4F89MLc5xKRqB5ONNeyuuTkEIPhogJ+tOEKFrZWoP1Wrdkp1fHspi3n5NczdXsccEe7Z+bXC8CyzcmuEzmjmc/LOsLYtyFoHLLSGSal18475Cv8uuxBnPgCQlZWVGGDcN0dwda0R7fR5OKyj/nwa+R4/28Mxtov0bRuifKE8qYAoKm8MgwvW98IXbVGm1fsYX2Rhfu7JOIBgsB8grh3P+/RzFi1a/ERamWliuypgBESWB9aIFHxmDTHtnItxRVZmm6vizAcANm/ePAggf8grJnsiUboDoomE2lD9bbjUEK4Ymrp8wX55B+UNhDWIv5tO8FF2tVAVH2Ud58PMSj7cfIyZxm9Zv/9CnHkwGNAAjEZjPEB3BNrdPro8FtYVHOO5d9JJmmzk1b9u4bVp5gf6yZRMXhNzEe1ojmkAQ7vc0GofKmk8oIQAPVEB4LRj620m4LxBwWkrY1OzSXrPyOipJkanZAll8+NJBsZMMaJGBwEGTYebD135UICMjIx4AIfYWjanFZu9hWZxgLR6wywrrONHE/WMed/E2Pt6UQC8OtUQFwGbwy1Cf4wp68tF2I8yQ3+Y+VsqWVd6lostHQlTII/kOIBeVeFen5VOeyt2p4ey83d4+X0zY1IGzcemmnlJA8jQAKLRfoBP8k/yccUNFlxXWHg7yjyryvTDFpZuryYgDBOlYBiAM+Kj02nB523n3I0ufj59K6OmZgljs2Y+6s+Z/HTKZhEBvQbQ4fTT6w1oAGl17aSJvT9XnAWpV4O8daidf2Qcos3ueGgK9Hp9PIBLAPR6WvD6upiYVsaLyUZeSTVp4U9KNjBy4gaRewPP/W4dr0zR063G6FP7I/DZXZhliTDpvJ9fllhJXn+E2qY7w4ylAoF+gE2bNsUDuKMhlMBNzl65xcjkDF4W4R4w/96bq8mtuk5lkx3dG6sY+Ydv6BTmDrH/5bNTGwJMEAfQ+LzLzNi4X9wTrAmN+6UkBvBol8s2cvaf4Yfv6jUAGfIRv17Nhp3/EYXmo8MVoPDEDV6Y8DW3fRHsSkQDSM65QIr+KCsKT9Dc3j3MvB9AeSA5Nm7cGA/gE5MR0XhM+2p5/vfpoviyeXbCWhYbysV1OIwiAHuVED1uhV1VTWLHyJQpGkB2RT0XmzsShnxw9Y8A8IvJsDA59t92nn17g0iDkSSRd2t7l/aAX3RJJRwlGOnffkO3YaJCe5j5AEB6eno8gOzQrjDIEvntPPEa9fpyfvE3s3aNFk0SRY0SEAoKhQTM0EYUDCrDpChS/oRKCCDvKQ7hrsozwRPiL0tK0P1qJdO+KhXh7SKsRUh8L84FEQSi998V5LNPMoYByBFJ8I8yhF6vF5/Pp30OlVylfFb2dSnZXmWDkZL7XFa6lMy3lDQd0KJFiwYBPl3wxRMfx8tWrOBp38D/Bzzmkljh/JggAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"0cb9f3979800b47dd3d4eed51c6e2315e0cbe17281944df74c343cc41ca66f3a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":35,"unified_at_epoch_ms":1792976208390,"unified_at":"2026-10-26T00:56:48.390Z","metadata":{"hashes":{"sha256":"0cb9f3979800b47dd3d4eed51c6e2315e0cbe17281944df74c343cc41ca66f3a","sha1":"e2eca237f4c115c99a0b7025288c526319651e77","md5":"a3fbe820cdf3c532cef32ecc89bba16a","sha512":"e0e05fbcab6b08b6d1d4130b451e3610178c13e129b2085d850d43d16f9e9cb1ad12c56cdeef5c7643e90e8812ba79bb14f6740fd52e6bfed3d9540b4c5a7d56","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"https://twitter.com/i/events/1259454905057771521","file_type":["url"],"file_type_id":"url","file_size":0,"is_container_sample":false,"url_analysis":true},"submissions":{"first_seen":1589112532000,"last_seen":1662666620000,"last_multi_scan":1662666620000}},"detections":{"summary":{"verdict":"suspicious","score":35,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":1},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":3},"sandbox_signatures":{"informative_count":15,"suspicious_count":2,"malicious_count":0,"total":17},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"urlscanio":{"name":"urlscan.io","success":true,"verdict":"undetected","status":"no-result","progress":100,"data_source":"urlscan.io","permalink":"https://urlscan.io/"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/techniques/T1035","identifiers":[{"type":"informative","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"tactic":"Command and Control","technique":"Commonly Used Port","attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"iexplore.exe\" is protecting 8192 bytes with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.pki.goog\"\n \"abs.twimg.com\"\n \"analytics.twitter.com\"\n \"cm.g.doubleclick.net\"\n \"pbs.twimg.com\"\n \"syndication.twitter.com\"\n \"t.co\"\n \"twitter.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.244.42.129:443\"\n \"192.229.173.16:443\"\n \"104.244.42.131:443\"\n \"104.244.42.72:443\"\n \"172.217.5.110:443\"\n \"216.58.194.195:80\"\n \"172.217.6.66:443\"\n \"184.84.68.43:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IsoScope_9f4_IESQMMUTEX_0_519\"\n \"Local\\InternetShortcutMutex\"\n \"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}\"\n \"UpdatingNewTabPageData\"\n \"Local\\VERMGMTBlockListFileMutex\"\n \"Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"\n \"IsoScope_9f4_IESQMMUTEX_0_519\"\n \"IsoScope_9f4_IE_EarlyTabStart_0xf28_Mutex\"\n \"Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"IsoScope_9f4_IESQMMUTEX_0_331\"\n \"IsoScope_9f4_ConnHashTable<2548>_HashTable_Mutex\"\n \"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2548\"\n \"IsoScope_9f4_IESQMMUTEX_0_303\"\n \"Local\\ZonesCacheCounterMutex\"\n \"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}\"\n \"Local\\URLBLOCK_DOWNLOAD_MUTEX\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlblockindex_1_.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"0XE0000000L\"","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 562816364-00002548) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" with commandline \"https://twitter.com/i/events/1259454905057771521\" (UID: 562816364-00002548)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2548 CREDAT:275457 /prefetch:2\" (UID: 562816387-00001700)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"iexplore.exe\" with commandline \"https://twitter.com/i/events/1259454905057771521\" (UID: 562816364-00002548)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2548 CREDAT:275457 /prefetch:2\" (UID: 562816387-00001700)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"\"iexplore.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 896)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$27","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"level":"informative","category":"Network Related","name":"Contacts Random Domain Names","description":"\"pbs.twimg.com\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://twitter.com/i/events/1259454905057771521\"\n Pattern match: \"https://twitter.com\"\n Heuristic match: \"abs.twimg.com\"\n Heuristic match: \"analytics.twitter.com\"\n Heuristic match: \"cm.g.doubleclick.net\"\n Heuristic match: \"pbs.twimg.com\"\n Heuristic match: \"syndication.twitter.com\"\n Heuristic match: \"twitter.com\"\n Pattern match: \"tI.ZS/\"\n Pattern match: \"https://cm.g.doubleclick.net/pixel?google_nid=twitter_dbm&google_cm=&tpm_cb=partnerIdSyncComplete&_=1589112636613&google_tc=\"\n Pattern match: \"https://www.msn.com/spartan/ientpgbconfig?locale=en-us&market=us\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"$28","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$29","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/72 reputation engines marked \"https://cm.g.doubleclick.net/pixel\" as malicious (1% detection rate)\n 1/76 reputation engines marked \"https://cm.g.doubleclick.net\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.244.42.129 on port 443 is sent without HTTP header\n TCP traffic to 192.229.173.16 on port 443 is sent without HTTP header\n TCP traffic to 104.244.42.131 on port 443 is sent without HTTP header\n TCP traffic to 104.244.42.72 on port 443 is sent without HTTP header\n TCP traffic to 172.217.5.110 on port 443 is sent without HTTP header\n TCP traffic to 216.58.194.195 on port 80 is sent without HTTP header\n TCP traffic to 172.217.6.66 on port 443 is sent without HTTP header\n TCP traffic to 184.84.68.43 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1043","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 8 domains and 8 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":43,"imported_dlls_count":131,"dropped_files_count":0,"extracted_files_count":49,"files_written_count":200,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":12,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":12,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":8,"dns_resolutions_count":8,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"5eb7eed3896a931df02cfcd7","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"contacted_countries":["USA"],"submit_name":"0cb9f3979800b47dd3d4eed51c6e2315e0cbe17281944df74c343cc41ca66f3a.url","analysis_start_time":"2020-05-10T12:09:00+00:00","indicators_count":{"informative":15,"suspicious":2,"malicious":0},"tags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.244.42.129","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"address":"192.229.173.16","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"address":"104.244.42.131","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"address":"104.244.42.72","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"address":"172.217.5.110","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"address":"216.58.194.195","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"address":"172.217.6.66","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"address":"184.84.68.43","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]}],"dns_resolutions":[{"domain":"abs.twimg.com","address":"72.21.91.70","ttl":170,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Twitter, Inc.","registrar_name_servers":"D01-01.NS.TWTRDNS.NET","registrar_creation_date":"2008-09-22T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"domain":"analytics.twitter.com","address":"104.244.42.3","ttl":124,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Twitter, Inc.","registrar_creation_date":"2000-01-21T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"domain":"cm.g.doubleclick.net","address":"172.217.12.66","ttl":21599,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"1996-01-16T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"domain":"ocsp.pki.goog","address":"216.58.194.195","ttl":170,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"domain":"pbs.twimg.com","address":"72.21.91.70","ttl":186,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Twitter, Inc.","registrar_name_servers":"D01-01.NS.TWTRDNS.NET","registrar_creation_date":"2008-09-22T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"domain":"syndication.twitter.com","address":"104.244.42.200","ttl":1436,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Twitter, Inc.","registrar_creation_date":"2000-01-21T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"domain":"t.co","address":"104.244.42.69","ttl":1363,"country":"United States","registrar_name":"JHALL","registrar_organization":"Twitter, Inc.","registrar_name_servers":"NS3.P34.DYNECT.NET","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"domain":"twitter.com","address":"104.244.42.129","ttl":1569,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Twitter, Inc.","registrar_creation_date":"2000-01-21T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]}],"http_requests":[{"host":"ocsp.pki.goog","host_ip":"216.58.194.195:80","url":"/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D","method":"GET","header":"GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"host":"ocsp.pki.goog","host_ip":"216.58.194.195:80","url":"/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCWA2Iyxuy1ewIAAAAAY5hv","method":"GET","header":"GET /gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCWA2Iyxuy1ewIAAAAAY5hv HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"host":"ocsp.pki.goog","host_ip":"216.58.194.195:80","url":"/gts1o1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEDSxc3GEkJo%2FAgAAAABjmG0%3D","method":"GET","header":"GET /gts1o1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEDSxc3GEkJo%2FAgAAAABjmG0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}],"processes":[{"pid":3704,"ppid":0,"name":"rundll32.exe","command_line":"\"%WINDIR%\\System32\\ieframe.dll\",OpenURL C:\\0cb9f3979800b47dd3d4eed51c6e2315e0cbe17281944df74c343cc41ca66f3a.url","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"562816227-00003704","icon":"$2a"},{"pid":2548,"ppid":3704,"name":"iexplore.exe","command_line":"https://twitter.com/i/events/1259454905057771521","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"562816227-00003704","uid":"562816364-00002548"},{"pid":1700,"ppid":2548,"name":"iexplore.exe","command_line":"SCODEF:2548 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"562816364-00002548","uid":"562816387-00001700"}],"all_imported_dlls":["clbcatq.dll","npmproxy.dll","msimtf.dll","d3d10warp.dll","netutils.dll","normaliz.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","WindowsCodecs.dll","ExplorerFrame.dll","dui70.dll","gpapi.dll","netprofm.dll","FWPUCLNT.DLL","iertutil.dll","shell32.dll","xmllite.dll","mscoreei.dll","dxgi.dll","urlmon.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","rsaenh.dll","api-ms-win-core-synch-l1-2-0.dll","comctl32.dll","ssv.dll","UIAnimation.dll","version.dll","msctf.dll","msimg32.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","ieproxy.dll","WSHTCPIP.DLL","mscoree.dll","rpcss.dll","api-ms-win-downlevel-user32-l1-1-0.dll","wintrust.dll","nlaapi.dll","credssp.dll","ncrypt.dll","lpk.dll","npctrl.dll","sxs.dll","jp2ssv.dll","oleaut32.dll","jscript9.dll","winnsi.dll","usp10.dll","apphelp.dll","webio.dll","ws2_32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","propsys.dll","cryptnet.dll","MSOHEV.DLL","psapi.dll","sspicli.dll","api-ms-win-downlevel-version-l1-1-0.dll","rasadhlp.dll","deploy.dll","msvcrt.dll","sechost.dll","bcrypt.dll","powrprof.dll","RpcRtRemote.dll","userenv.dll","netapi32.dll","srvcli.dll","cryptsp.dll","oleaccrc.dll","dhcpcsvc6.dll","Wldap32.dll","URLREDIR.DLL","duser.dll","msvcr100.dll","imagehlp.dll","ieui.dll","dnsapi.dll","oleacc.dll","mlang.dll","ieframe.dll","dhcpcsvc.dll","schannel.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","imm32.dll","ole32.dll","mswsock.dll","cfgmgr32.dll","winhttp.dll","msvcr90.dll","UIAutomationCore.dll","comdlg32.dll","wininet.dll","d2d1.dll","SwDir_1231201.dll","IPHLPAPI.DLL","KernelBase.dll","wkscli.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","advapi32.dll","cryptbase.dll","DWrite.dll","secur32.dll","nsi.dll","gdi32.dll","shlwapi.dll","setupapi.dll","devobj.dll","bcryptprimitives.dll","kernel32.dll","wship6.dll","wshqos.dll","mscorwks.dll","icm32.dll","IconCodecService.dll","msasn1.dll","ntmarta.dll","SensApi.dll","mshtml.dll","winmm.dll","IEShims.dll","dwmapi.dll","sqmapi.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","user32.dll","d3d11.dll","uxtheme.dll","profapi.dll","rpcrt4.dll","WindowsCodecsExt.dll","mscms.dll","crypt32.dll","t2embed.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"ver2CF3.tmp","sha256":"8684403da59628039e9b4b0d245c5b7e1fac1242a087ded44eaf3b792e4a231e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"268U103H.txt","sha256":"d137f68785b44b65ec1250da617b096009dd6c89774ac42ea7530879d0c04b9e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"27B5OZGH.txt","sha256":"56dc5e5fa362c2c75546835366ce78ad5d2094e3f5aab6101298bc4e6fc4b140","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"38YGE1TZ.txt","sha256":"3df9f8b69a863ca83923c3b7a15661f68ef9776b7dcf7d1c339cd4922bf6da34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"67FLM3A7.txt","sha256":"46474c3bbe9da57ba3f9dca564b84b21ed06739d8e2a151a64425369c1e3f378","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"72JDKC4K.txt","sha256":"553f75e2755cbed7a7f69326eb06f23b3ed01eb522118df757accd6458c77662","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"87ELB2V3.txt","sha256":"7c14714e95fdeda16a9132e2b1ac9c623d69fbae89d74d824c03b36102b9f281","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"936G1MWQ.txt","sha256":"f8c36e4431f9a0a7dcfd257d6f3c5ae7a48581483f6df31ef603cc440e94b28c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"A1VN00ZU.txt","sha256":"56dc5e5fa362c2c75546835366ce78ad5d2094e3f5aab6101298bc4e6fc4b140","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"EPNA429E.txt","sha256":"81012d25f5140ed65e0c4766a9612ef68e59abc7dff0fb6ab1d2764e49c7d45e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"G9MAWHUY.txt","sha256":"9f69fa32d4269272014bfe642ecdd5229b3a50e88f5514d6e68128156f82b1ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"GNPC8FKS.txt","sha256":"22e5b6d37cb86804f68030c240ee5690f795140d5759f7fe8c282c245a142e44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"J2B234EU.txt","sha256":"3cd4235ac4136b8705443ed743a5ce33d31038cb9e0291e38731d14341e08d2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"JIRVHTZ5.txt","sha256":"b7ad2b1571d81a3d6955982354a3f870e3d576b432740613b09ebbb776d521e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"LBDBN6KT.txt","sha256":"815a7f001308adcaedbb8a2c41f37f6ce08351428f694e3922d374609bda035d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"LJSNJ6FJ.txt","sha256":"8d309d279e80527a7105ca9c1d8477d9c5c81f034796fc4e07ab5a698ac239e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"NU8JWWID.txt","sha256":"f089693240d59e5bd0a72b7614168af83017666f06245362a4c166a0502e269a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"OWSHFT3I.txt","sha256":"f064321b41fdbcbb3510ac03b990801afd4d35c421413628801e4649f3150623","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"T2MZYUM6.txt","sha256":"9701fd804dbe8fb3ce4402e0cc7439f8724836c241869136dc3f82c2029fe18f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"TNAZIE4Y.txt","sha256":"a2b7596c76cdd03e2cae240d4070f899f2b469212f17a9f3911f44fae41709de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"U6FPEGWD.txt","sha256":"d0efca84ad9278ed59d30988ecfc382004812463f6e54d19aac01cfde52c4840","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"W6DHTAZJ.txt","sha256":"7185636fb29f0065a17b137f6822a467e93480000386ffa20c83cade364fbec8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"en-US.2","sha256":"c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"ver2DFC.tmp","sha256":"8684403da59628039e9b4b0d245c5b7e1fac1242a087ded44eaf3b792e4a231e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"imagestore.dat","sha256":"fa9704519ae7fbf985afd0eadde5fbb1b142be8aa705cebfbca36156b28441ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"35DDEDF268117918D1D277A171D8DF7B_2C3654E4A9701AB9950AD35C7ADEA30C","sha256":"fa71c4e9849c849c8b50005b1c09b85d80967854a9e66ec496f7e2c739c6e2bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"35DDEDF268117918D1D277A171D8DF7B_52759E6468B898F78B57D06B96A93174","sha256":"9b878149b32432a056f2ac982d8f8d4715cf9aa66df6394d59b509ffb37b2ad9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"35DDEDF268117918D1D277A171D8DF7B_8D79DC16D3CF68823597F4FB5D953253","sha256":"0eadf4238d1ecd571b8ae7607c92d8bbd7a4b442a9e9681f668f40cc786b5be3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB","sha256":"286bc764e5ebb983ec4b875007a66d95109e054ff1031a99f8b731beaf072b0f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sha256":"6317fef6f5dcd773f6342dd9eb179566f1d6ea30ebf2dc053b742e0bcb9f6729","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sha256":"68e9e8bd352544c47e359c94d2c5581efbac559dc570d0ae2b0b57f7e20f09e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"BE8B021F9E811DFC8C8A28572A17C05A_ABAA1CF1134F6E0BC989829638FDB311","sha256":"3cf5be07ca82c2ce5a0908c7cc36db2969953fd23da497c3eb3b0daf693836e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"BE8B021F9E811DFC8C8A28572A17C05A_D5863C0497DF3485567798AEF402E5E9","sha256":"994eaf4ec0db254b1462e2f5008821fbaa57eb6a9bbd2a57425c3716fb33ceb5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sha256":"349e58b12e465312c675f1e4f3a1329bbf00fda430750712dcd2a4b28980b9cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"~DF49EC40940C959AAC.TMP","sha256":"32d2ed2c11feafae9999afe4ee5f3724b974506f4e2d586f32dfee96c3349ea8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"~DF800E969390074525.TMP","sha256":"02495932d27c5ce7f71bd0ad755c36a45d5abde6ab62611b13ad8fba78eb24f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"~DFED1235CC477A2F04.TMP","sha256":"3e9ab743952910032c27c0266c7a8106581bfce5593485ff225bf4e17075c2b7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"RecoveryStore._36B5C3F7-92B7-11EA-BDD6-0A00276262EF_.dat","sha256":"8b51d7763cd18ccfa4b647d070ba5dfba8be2a9e671e1dc56527d42253fb7219","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"error_1_.htm","sha256":"ab3a1887b900737d37ea654eb5ed1422a15b331a3d17e98aaff88f2711a96eba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"edge-icons-Regular_1_.eot","sha256":"5892caf9e5683c959bbfb68e1cb34256c135a3d60b2654cf75d1ae3bb613a3ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"c6qH14Kj_bigger_1_.jpg","sha256":"5b2b3499d9a1d88e205887e4004a5e86f8088eaefc523e522838ed112ac129e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"1259454905057771521_1_.htm","sha256":"ef43078e6f56c6c83cdc86d9e40eaae2ad9213150dc720065b673fbe5968bf62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"suggestions_1_.en-US","sha256":"c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"_3F7221BA-92B7-11EA-BDD6-0A00276262EF_.dat","sha256":"d80e8074749e5f77b41c0780ce4b327a4eddd32b9d5f2bc27938661abf1a4fb1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"search__0633EE93-D776-472f-A0FF-E1416B8B2E3A_.ico","sha256":"6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"_754C170D-92B7-11EA-BDD6-0A00276262EF_.dat","sha256":"908b972e20a234f0748e4b8cc5298860101504fb9074496750258d7e971b1ef6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"tpm_1_.js","sha256":"35a9900bbaf820edff7acb15f6f1e058e5cd8186af16bd7f647c7ef0136071a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"spinner-rosetta-blue-26x26_1_.gif","sha256":"95dc462b70274d9d1d66728b556ec4f7cb5ff05bd3ea98d41f81df4b43420ae4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]}],"files_written":[{"path":"C:\\https:\\twitter.com\\i\\events\\1259454905057771521","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\UrlBlockManager\\urlblocklist.bin","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Low","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Tracking Protection","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\TabRoaming","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\PlayReady","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException\\Low","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache\\Low","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%TEMP%\\Low","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\System32\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\System32\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"C:\\0cb9f3979800b47dd3d4eed51c6e2315e0cbe17281944df74c343cc41ca66f3a.url","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%TEMP%\\~DFED1235CC477A2F04.TMP","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\URLREDIR.DLL","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_151\\lib\\plugin.jar","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_151\\bin\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\System32\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\35DDEDF268117918D1D277A171D8DF7B_1D30FD0FCC3C02933383E96D468B0B08","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BEC6224B02D155A396218A2504F3EE0B","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\739F2FF4259CDC6CBE7B90F1A95601EF","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\35DDEDF268117918D1D277A171D8DF7B_52759E6468B898F78B57D06B96A93174","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%TEMP%\\~usnzjyi.tmp","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\twitter_core.bundle[1].css","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\D2AI8UF1\\twitter[1].xml","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\System32\\en-US\\jscript9.dll.mui","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001f.db","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\Fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\Fonts\\simsun.ttc","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\edge-icons-Regular[1].eot","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\Fonts\\seguisym.ttf","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\imagestore\\3mt7jhv\\imagestore.dat","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\urlblockindex[1].bin","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\favicon[2].ico","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\favicon[3].ico","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\favicon[6].png","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\favicon[7].png","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\favicon[8].png","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{754C170D-92B7-11EA-BDD6-0A00276262EF}.dat","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%TEMP%\\~DF49EC40940C959AAC.TMP","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\6.pages_live_video.en.1fa8d8adad48029205d8[1].js","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{3F7221BA-92B7-11EA-BDD6-0A00276262EF}.dat","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%TEMP%\\~DF800E969390074525.TMP","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HOI17G02.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\35DDEDF268117918D1D277A171D8DF7B_9EC14CCA434AAD6CFC8B3FF769C1B4D8","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PI95A64D\\analytics[2].js","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EDC238BFF48A31D55A97E1E93892934B_A7467B47637944C1E4B4025C763E391F","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0270780F846F08BEFE0DD8112D932FEF","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_5FA8E5E800867BF860DF5E533E701BAF","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\85B3F147E3624A14E6A20DB4F6C2C5D9","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\35DDEDF268117918D1D277A171D8DF7B_8D79DC16D3CF68823597F4FB5D953253","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\35DDEDF268117918D1D277A171D8DF7B_8D79DC16D3CF68823597F4FB5D953253","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BE8B021F9E811DFC8C8A28572A17C05A_ABAA1CF1134F6E0BC989829638FDB311","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BE8B021F9E811DFC8C8A28572A17C05A_CB477A3C761A808FD39B5EA0914A9501","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\521F25E202FF760B8461B88413F425E7","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\35DDEDF268117918D1D277A171D8DF7B_52759E6468B898F78B57D06B96A93174","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\W6DHTAZJ.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\67FLM3A7.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\EPNA429E.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\1259454905057771521[1].htm","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\analytics[1].js","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\System32\\Adobe\\Director\\SwDir_1231201.dll","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\System32\\Macromed\\Flash\\Flash32_27_0_0_187.ocx","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\twitter_more_1.bundle[1].css","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\twitter_more_2.bundle[1].css","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\BE8B021F9E811DFC8C8A28572A17C05A_D5863C0497DF3485567798AEF402E5E9","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%PROGRAMFILES%\\Microsoft Silverlight\\5.1.50907.0\\npctrl.dll","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\72JDKC4K.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\init.en.96daadce1c5c07e1c45a[1].js","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\GNPC8FKS.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\LBDBN6KT.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\G9MAWHUY.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\EXp6u8lXYAAIMKl[1].jpg","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\c6qH14Kj_bigger[1].jpg","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\color\\sRGB Color Space Profile.icm","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\spinner-rosetta-blue-26x26[1].gif","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[2].ico","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[3].ico","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\EXp7pVyXsAYY1n_[1].jpg","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\web_heart_animation_edge[1].png","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZN1CVVJS.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_A7A8E86FCB076C144BD04C40841E7074","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\82CB34DD3343FE727DF8890D352E0D8F","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\VersionManager\\ver2CF3.tmp","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\VersionManager\\ver2DFC.tmp","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe.config","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{36B5C3F7-92B7-11EA-BDD6-0A00276262EF}.dat","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ERV9N2EC.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\L8DC4A47.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\favicon[1].png","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\favicon[2].png","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\favicon[3].png","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\favicon[4].png","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\favicon[5].png","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\0.commons.en.06a750caea28350212ee[1].js","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\35DDEDF268117918D1D277A171D8DF7B_A176FB91ACC074E2EF17D9C8644120CF","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\404HCFVH.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\35DDEDF268117918D1D277A171D8DF7B_2C3654E4A9701AB9950AD35C7ADEA30C","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\35DDEDF268117918D1D277A171D8DF7B_2C3654E4A9701AB9950AD35C7ADEA30C","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BE8B021F9E811DFC8C8A28572A17C05A_D5863C0497DF3485567798AEF402E5E9","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BE8B021F9E811DFC8C8A28572A17C05A_1A21C91884D87BFEFFF59217CD35795C","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\J2B234EU.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\BE8B021F9E811DFC8C8A28572A17C05A_ABAA1CF1134F6E0BC989829638FDB311","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\27B5OZGH.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\tpm[1].js","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\87ELB2V3.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\error[1].htm","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\js_inst[1].js","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\syndication[1].gif","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\268U103H.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\LJSNJ6FJ.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\7.pages_signup.en.6bfee475d9b7243c5db9[1].js","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\error[1].htm","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\js_inst[1].js","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JIRVHTZ5.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\NU8JWWID.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\A1VN00ZU.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\OWSHFT3I.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\VG8BU31O.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4F7NV88N.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\I88H097X.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\U6FPEGWD.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\T2MZYUM6.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\suggestions[1].en-US","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.2","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.1","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_49FC544F04082FD9F64F9EFB226AF8B5","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\936G1MWQ.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\search[1].json","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\38YGE1TZ.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TNAZIE4Y.txt","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{FD4316C2-FF33-42BF-BE78-39051EB67EC2}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TABBEDBROWSING\\NEWTABPAGE\\MFV\\MFV","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{00000000-0000-0000-0000-000000000000}\\{00000000-0000-0000-0000-000000000000}","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_9f4_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"Local\\InternetShortcutMutex","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"IsoScope_9f4_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"IsoScope_9f4_IE_EarlyTabStart_0xf28_Mutex","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"IsoScope_9f4_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"IsoScope_9f4_ConnHashTable<2548>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2548","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"IsoScope_9f4_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2548","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_9f4_IE_EarlyTabStart_0xf28_Mutex","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_9f4_ConnHashTable<2548>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_9f4_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_9f4_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"IsoScope_9f4_IESQMMUTEX_0_506","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"Local\\https://twitter.com/","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"IsoScope_9f4_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_9f4_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\https://twitter.com/","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_9f4_IESQMMUTEX_0_506","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5eb7eed3896a931df02cfcd7"}]}]}},"report_ids":{"sandbox_job_ids":["5eb7eed3896a931df02cfcd7"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Suspicious Sample 0cb9f3979800… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 0cb9f3979800…. Threat score 35/100. 0/1 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0cb9f3979800b47dd3d4eed51c6e2315e0cbe17281944df74c343cc41ca66f3a"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample 0cb9f3979800… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 0cb9f3979800…. Threat score 35/100. 0/1 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0cb9f3979800b47dd3d4eed51c6e2315e0cbe17281944df74c343cc41ca66f3a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample 0cb9f3979800… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 0cb9f3979800…. Threat score 35/100. 0/1 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]