24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 39:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T41e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 186d8790fec7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 186d8790fec7…. Threat score 100/100. 0/6 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/186d8790fec7564b4f81100471788e2291dbbaa950a72fe8497b07bbc16a5697","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","186d8790fec7564b4f81100471788e2291dbbaa950a72fe8497b07bbc16a5697"],"about":{"@type":"SoftwareApplication","name":"https://www.reddit.com/","applicationCategory":["url"],"identifier":"186d8790fec7564b4f81100471788e2291dbbaa950a72fe8497b07bbc16a5697","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":6},"behavioralIndicators":{"malicious":6,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T762,"Tar4E06.tmp" has type "data" "reddit-init-legacy.en-us.tObaCgryyuc[1].js" has type "HTML document ASCII text with very long lines" "620BEF1064BD8E252C599957B3C91896" has type "data" "7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6" has type "data" "RecoveryStore.{BDC8E593-8AC3-11E8-9C42-0A002745DB77}.dat" has type "Composite Document File V2 Document Cannot read section info" "fB4XONq_LQdlcRY7tWn2rGQmh9Tzq4LHQfeZHFeRE1M[1].jpg" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 140x93 frames 3" "oZfgWaDBWkAF8rp5RKGVm4tMx9SlGBFmNEdOt40rLug[1].jpg" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 140x84 frames 3" "goldvertisement-gild[1].png" has type "PNG image data 33 x 39 8-bit/color RGBA non-interlaced" "pspubws@reddit[1].txt" has type "ASCII text" "LtB8qNdDvMoGMi4vtIJP5qIivsCtf6Axo_BxGwvdrcA[1].jpg" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 140x140 frames 3" "Cab46FE.tmp" has type "Microsoft Cabinet archive data 50939 bytes 1 file" "Cab75DA.tmp" has type "Microsoft Cabinet archive data 53978 bytes 1 file" "dFvkHPr_HTE5cpRWqmyRFAIUJpwyjdN_KlpOua2lBhQ[1].jpg" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 140x105 frames 3" "inpage_linkid[1].js" has type "ASCII text with very long lines" "Tar470B.tmp" has type "data" "75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F" has type "data" "apstag[1].js" has type "ASCII text with very long lines" "videoplayer.gJEaOQ_ircg[1].js" has type "ASCII text with very long lines" "pspubws@reddit[2].txt" has type "ASCII text" "onboarding-splash.5rGpjR57dvE[1].js" has type "ASCII text with very long lines with no line terminators"26:Ta2f,"iexplore.exe" wrote bytes "e9e9f0f5f7" to virtual address "0x779CE9ED" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9fc79c4fa" to virtual address "0x74CE7922" (part of module "COMCTL32.DLL") "iexplore.exe" wrote bytes "9498777651c17776efb27d76ee9c777675dc7976909777761099777600000000013d5f7638ed5f76cfcd5e7631235e76de2f5f76c4ca5e7680bb5e76aa6e5f769fbb5e76707f5d7692bb5e7646ba5e760abf5e7600000000" to virtual address "0x710A1000" (part of module "MSLS31.DLL") "iexplore.exe" wrote bytes "7739bc7779a8c077be72c077d62dc0771de2bb7705a2c077c868bf7757d1c677bee3bb77616fc0776841be770050be7700000000ad37a6768b2da676b641a67600000000" to virtual address "0x75751000" (part of module "WSHIP6.DLL") "iexplore.exe" wrote bytes "e937f2f5f7" to virtual address "0x779CE963" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "92e6bb7779a8c077be72c077d62dc0771de2bb7705a2c077bee3bb77616fc0776841be770050be7700000000ad37a6768b2da676b641a67600000000" to virtual address "0x75201000" (part of module "WSHTCPIP.DLL") "iexplore.exe" wrote bytes "50d8389d" to virtual address "0x6C1D3260" (part of module "URLREDIR.DLL") "iexplore.exe" wrote bytes "e99d9a78f9" to virtual address "0x76083E59" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "e9b090def7" to virtual address "0x7797ABE1" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9fda48af9" to virtual address "0x76084731" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "e9395484f9" to virtual address "0x760E93FC" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "c4ca5e7680bb5e76aa6e5f769fbb5e7608bb5e7646ce5e7661385f76de2f5f76d0d95e760000000017796b764f916b767f6f6b76f4f76b7611f76b76f2836b76857e6b7600000000" to virtual address "0x6EEC1000" (part of module "MSIMG32.DLL") "iexplore.exe" wrote bytes "e9b2965ff9" to virtual address "0x761F9D0B" (part of module "OLE32.DLL") "iexplore.exe" wrote bytes "e9efb9cefa" to virtual address "0x74C4388E" (part of module "COMCTL32.DLL") "iexplore.exe" wrote bytes "e99cf3f5f7" to virtual address "0x779CE869" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e98b8e8af9" to virtual address "0x76085DEE" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "e9e89ae3f7" to virtual address "0x7797E30C" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9c20af7f7" to virtual address "0x779BD274" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9652beaf7" to virtual address "0x7797ADF9" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9ee7e77f9" to virtual address "0x761B6143" (part of module "OLE32.DLL")27:T1a31,Found malicious artifacts related to "151.101.1.140": ... URL: https://www.reddit.com/r/GlobalOffensiveTrade/comments/3uaphi/pc_is_20_keys_a_fair_price_for_this_ak_ch/ (AV positives: 1/67 scanned on 07/02/2018 19:37:57) URL: http://reddit.com/submit?url=http%3A%2F%2Ffay-sky.blogspot.com%2F2013%2F02%2Fdownload-death-note-movie-2006.html&title=Download (AV positives: 1/67 scanned on 06/23/2018 07:17:06) URL: https://www.reddit.com/login?dest=https://www.reddit.com/submit?url=http%3A%2F%2Fwww.illmob.org%2Fderbycon-is-here%2F&title=Derbycon+is+here%21 (AV positives: 1/67 scanned on 06/19/2018 00:49:41) URL: https://www.reddit.com/login?dest=https://www.reddit.com/submit?url=http%3A%2F%2Fwww.illmob.org%2Fanalysis-of-the-fbi-tor-malware%2F&title=Analysis+of+the+FBI+Tor+Malware (AV positives: 1/67 scanned on 06/19/2018 00:01:41) URL: https://www.reddit.com/login?dest=https://www.reddit.com/submit?url=http%3A%2F%2Fwww.illmob.org%2Fsilk-road-busted%2F&title=Silk+Road+Busted (AV positives: 1/67 scanned on 06/18/2018 22:02:56) File SHA256: a655ce102a2b0996d98234b3779751ff2540e4ca0b590e326cc99f22dfe32306 (AV positives: 23/69 scanned on 07/16/2018 19:16:20) File SHA256: 0f30eb22cf1bedc7a715b5fd6278f2ad429bcad078c9d70e4a1426b56222c3a8 (AV positives: 3/70 scanned on 07/15/2018 23:47:45) File SHA256: 0b3c49e15bbc929f60739ec7a82f469c804d2121219d9b60b738e0f1812e542c (AV positives: 29/69 scanned on 07/13/2018 16:04:39) File SHA256: 55d65a90f6e4f7e33a57eb5a8575db23c53a9544d1a18128d7176ec36b679465 (Date: 07/06/2018 15:51:11) File SHA256: 5c9e00498d7ddd64b8c29f1d516c01e8df54ce1051934afa337a87bc7e21dcd8 (AV positives: 10/64 scanned on 07/03/2018 10:26:38) File SHA256: d47164841f1fd094ef92aa0431341095c01ac9bfc9f503f9ffacc6d8d8b36259 (AV positives: 33/65 scanned on 07/02/2018 20:22:58) File SHA256: d0ed4b9a6298fad1d6af4a3cb2526db733e93a4b1b8f8f3a87081f1b5466ebea (Date: 04/24/2018 02:37:02) File SHA256: 5322ffd3b96b72d5a8096bb391e964179de1dd22d6e29f59cb3c9f020dbbf0ab (Date: 08/22/2017 20:46:46) File SHA256: 80e77e3780f89b403343467efd501c7052a72359b9603f84fb8cc948ee86771b (Date: 08/22/2017 20:44:48) File SHA256: 5741db3a919cbfc4fcfc852f9f575a7f088c10ca9fa98ab9830f9b7afc495c2d (Date: 08/13/2017 19:48:15) Found malicious artifacts related to "172.217.22.136": ... File SHA256: 73f7e8cacab36435542b82dce1922d9fd5aee2e8203db562d3acc978de4758a0 (AV positives: 25/62 scanned on 07/18/2018 04:16:32) File SHA256: f335f6d5a54c681ea61530ae689ba7dd636261acb30a31790d932fd0d1a45cd3 (AV positives: 20/68 scanned on 07/06/2018 11:32:22) File SHA256: ac53eb079288fd93d0d47c968b8994646a0117cb0b08b7a054fea11150231ede (AV positives: 10/68 scanned on 07/06/2018 10:09:44) File SHA256: 2c0be5f54b4daece4639c26a76154a8a4e376db1cc578261e99c4b232c83b30b (AV positives: 17/64 scanned on 07/06/2018 09:34:51) File SHA256: 7398e4a276153f37bd81eb5170d0912997d5c02e60471594b3156348dc3b9b67 (AV positives: 8/64 scanned on 07/06/2018 09:24:51) File SHA256: 5617e69cb7eb9013f0a197142614707caa4f0af3280b632b82954e540d1424e5 (Date: 03/09/2018 20:44:45) File SHA256: 5f6a4b9bedd99cd99587a3a87f95c03c61505fd65cf3bbd13cb972713a3ac77d (Date: 03/09/2018 20:18:47) File SHA256: 1fdb6831075c5c404ced736ce0feadd2b473c341c22a5a0659ca214b7e77e521 (Date: 03/09/2018 20:18:40) File SHA256: 50c65f4dd2188ed93ca90f400d986261a6799b9513d417f1ade15faaaec0944d (Date: 02/07/2018 06:17:34) File SHA256: fdbc2dd4d5e44d7bfbc41f85cd7c8f5b7dbc3f1dd20ca86677664d3f30505073 (Date: 02/07/2018 06:13:12) Found malicious artifacts related to "54.192.9.38": ... File SHA256: 075bc027a426acdf51275a12a0b7f31cfd33cae8976bea7f6202621aaebaf907 (AV positives: 4/68 scanned on 07/12/2018 00:09:25) File SHA256: 09d4401ce83da4c0dcc98319cd60ef923b11b9da4a5cbfefa463696ba2a5ca4a (AV positives: 16/69 scanned on 07/11/2018 00:12:14) File SHA256: eeaa385a6bff9ec9b7e2bd5186d04c30ba9eb05735ee5cf5bcac5228e360e2a8 (AV positives: 8/69 scanned on 07/07/2018 00:00:13) File SHA256: 8e72dd2ff00a4fb1397adfcd3927c26f8db4f20ba0f8b8e2ff4dfd1279c13fef (AV positives: 10/65 scanned on 07/02/2018 00:02:48) File SHA256: 37c792698da6b6ba7d2c0390f529834ed37bc8dae3a38c34f90d0d1a31839c49 (AV positives: 1/65 scanned on 06/19/2017 11:24:26) Found malicious artifacts related to "216.58.201.226": ... File SHA256: da87a114ce4827f07c2d1178b75d36614772d92864d500039ac7cc04f00bf31a (AV positives: 29/67 scanned on 07/14/2018 18:05:45) File SHA256: 5b692a837c4e3dee77eb973799f174ba98f4802a834f53e59d36c6aa7f2d17ad (AV positives: 51/67 scanned on 07/13/2018 07:55:50) File SHA256: b5dfb3ca1772c8e5ab25f6ca1c25827528b84aa713d2b6a28d8a647eb07f36e6 (AV positives: 38/68 scanned on 07/11/2018 10:03:51) File SHA256: 029b7acc0980212ecd270dba28d1df0a7ae006415e6eabdf4167a22435cddc62 (AV positives: 37/68 scanned on 07/10/2018 06:54:18) File SHA256: c32d4457a0fcfbda28c226795f55bef2f82b346ebac323d42234e8fe5b20ba01 (AV positives: 27/68 scanned on 07/09/2018 22:21:54) File SHA256: 460f22faaa5efc20518dc555af116fa2aef00b58546f649451b118d00f06489b (Date: 05/11/2018 02:29:25) File SHA256: 845554d6cd782b382e8e1c5c02df8e3de45eed7a850f8e8ff12ae266d07f6ac4 (Date: 05/11/2018 02:26:05) File SHA256: 4d97d3b8f88f1ef07fddcfa2c964148655b8d9af012de98ee8f9c5303aa3fa3f (Date: 05/02/2018 01:52:24) File SHA256: e5d129c63e658568fe2c71c7d605a87a39cd6e9259f8c97463114d652ff52444 (Date: 04/24/2018 22:52:30) File SHA256: 876fb064c011a335c8139344547d65757d0d55906ab769551d1be479b0c8d835 (Date: 04/24/2018 22:48:29) Found malicious artifacts related to "52.85.74.218": ... File SHA256: 297817ef79fd96a4d702e9f06edba9b4520db42f20d924df3f067ad375edc78c (Date: 07/07/2018 14:59:41) File SHA256: 2815fa77aefb7579927663cc601e678cf256f6f7b6b10c37e579ed5b2fad9f34 (Date: 07/07/2018 14:54:38) File SHA256: 3a2ea7ccb76f904668693ee8c38e8f7e4ef4a9891b07dfb2116bf266c58a9dde (Date: 07/07/2018 14:52:55) File SHA256: 2bf130e61b7aa6bdcfb1d8475294e2be19f0d1dbbe7c673b919a7599c78ba147 (Date: 07/07/2018 14:51:57) File SHA256: 16936cd596c03b11b649c570611f0ec16a92c4a4461eb1a40238f26d079966cc (Date: 07/07/2018 14:46:24) File SHA256: 1c8bd79ac5ba4348d8b2d827a419840f2f452e8698d06b764c983656b5b100e0 (AV positives: 2/64 scanned on 07/04/2018 00:07:25) File SHA256: 6003fa2726c832847694898ddf78c10a473f9103c5246b18f52b1ca8280d04eb (AV positives: 39/67 scanned on 06/11/2018 21:47:58) File SHA256: 157d1adbcb9b6c9e0d148857d254aa9aca74d9b0a64b0125bd31c5c4e3cb16f9 (AV positives: 40/68 scanned on 06/11/2018 21:13:13) File SHA256: 576f131ed44a4839beb95a19b44309be0d2bb4687c4de6205efdfee6af8c7b46 (AV positives: 39/68 scanned on 06/11/2018 20:54:28) File SHA256: 462144a649674f3200ef7208e5210583c690234cad99ca2bcdc5ae795988e059 (AV positives: 39/68 scanned on 06/11/2018 19:56:13)28:T1a31,Found malicious artifacts related to "151.101.1.140": ... URL: https://www.reddit.com/r/GlobalOffensiveTrade/comments/3uaphi/pc_is_20_keys_a_fair_price_for_this_ak_ch/ (AV positives: 1/67 scanned on 07/02/2018 19:37:57) URL: http://reddit.com/submit?url=http%3A%2F%2Ffay-sky.blogspot.com%2F2013%2F02%2Fdownload-death-note-movie-2006.html&title=Download (AV positives: 1/67 scanned on 06/23/2018 07:17:06) URL: https://www.reddit.com/login?dest=https://www.reddit.com/submit?url=http%3A%2F%2Fwww.illmob.org%2Fderbycon-is-here%2F&title=Derbycon+is+here%21 (AV positives: 1/67 scanned on 06/19/2018 00:49:41) URL: https://www.reddit.com/login?dest=https://www.reddit.com/submit?url=http%3A%2F%2Fwww.illmob.org%2Fanalysis-of-the-fbi-tor-malware%2F&title=Analysis+of+the+FBI+Tor+Malware (AV positives: 1/67 scanned on 06/19/2018 00:01:41) URL: https://www.reddit.com/login?dest=https://www.reddit.com/submit?url=http%3A%2F%2Fwww.illmob.org%2Fsilk-road-busted%2F&title=Silk+Road+Busted (AV positives: 1/67 scanned on 06/18/2018 22:02:56) File SHA256: a655ce102a2b0996d98234b3779751ff2540e4ca0b590e326cc99f22dfe32306 (AV positives: 23/69 scanned on 07/16/2018 19:16:20) File SHA256: 0f30eb22cf1bedc7a715b5fd6278f2ad429bcad078c9d70e4a1426b56222c3a8 (AV positives: 3/70 scanned on 07/15/2018 23:47:45) File SHA256: 0b3c49e15bbc929f60739ec7a82f469c804d2121219d9b60b738e0f1812e542c (AV positives: 29/69 scanned on 07/13/2018 16:04:39) File SHA256: 55d65a90f6e4f7e33a57eb5a8575db23c53a9544d1a18128d7176ec36b679465 (Date: 07/06/2018 15:51:11) File SHA256: 5c9e00498d7ddd64b8c29f1d516c01e8df54ce1051934afa337a87bc7e21dcd8 (AV positives: 10/64 scanned on 07/03/2018 10:26:38) File SHA256: d47164841f1fd094ef92aa0431341095c01ac9bfc9f503f9ffacc6d8d8b36259 (AV positives: 33/65 scanned on 07/02/2018 20:22:58) File SHA256: d0ed4b9a6298fad1d6af4a3cb2526db733e93a4b1b8f8f3a87081f1b5466ebea (Date: 04/24/2018 02:37:02) File SHA256: 5322ffd3b96b72d5a8096bb391e964179de1dd22d6e29f59cb3c9f020dbbf0ab (Date: 08/22/2017 20:46:46) File SHA256: 80e77e3780f89b403343467efd501c7052a72359b9603f84fb8cc948ee86771b (Date: 08/22/2017 20:44:48) File SHA256: 5741db3a919cbfc4fcfc852f9f575a7f088c10ca9fa98ab9830f9b7afc495c2d (Date: 08/13/2017 19:48:15) Found malicious artifacts related to "172.217.22.136": ... File SHA256: 73f7e8cacab36435542b82dce1922d9fd5aee2e8203db562d3acc978de4758a0 (AV positives: 25/62 scanned on 07/18/2018 04:16:32) File SHA256: f335f6d5a54c681ea61530ae689ba7dd636261acb30a31790d932fd0d1a45cd3 (AV positives: 20/68 scanned on 07/06/2018 11:32:22) File SHA256: ac53eb079288fd93d0d47c968b8994646a0117cb0b08b7a054fea11150231ede (AV positives: 10/68 scanned on 07/06/2018 10:09:44) File SHA256: 2c0be5f54b4daece4639c26a76154a8a4e376db1cc578261e99c4b232c83b30b (AV positives: 17/64 scanned on 07/06/2018 09:34:51) File SHA256: 7398e4a276153f37bd81eb5170d0912997d5c02e60471594b3156348dc3b9b67 (AV positives: 8/64 scanned on 07/06/2018 09:24:51) File SHA256: 5617e69cb7eb9013f0a197142614707caa4f0af3280b632b82954e540d1424e5 (Date: 03/09/2018 20:44:45) File SHA256: 5f6a4b9bedd99cd99587a3a87f95c03c61505fd65cf3bbd13cb972713a3ac77d (Date: 03/09/2018 20:18:47) File SHA256: 1fdb6831075c5c404ced736ce0feadd2b473c341c22a5a0659ca214b7e77e521 (Date: 03/09/2018 20:18:40) File SHA256: 50c65f4dd2188ed93ca90f400d986261a6799b9513d417f1ade15faaaec0944d (Date: 02/07/2018 06:17:34) File SHA256: fdbc2dd4d5e44d7bfbc41f85cd7c8f5b7dbc3f1dd20ca86677664d3f30505073 (Date: 02/07/2018 06:13:12) Found malicious artifacts related to "54.192.9.38": ... File SHA256: 075bc027a426acdf51275a12a0b7f31cfd33cae8976bea7f6202621aaebaf907 (AV positives: 4/68 scanned on 07/12/2018 00:09:25) File SHA256: 09d4401ce83da4c0dcc98319cd60ef923b11b9da4a5cbfefa463696ba2a5ca4a (AV positives: 16/69 scanned on 07/11/2018 00:12:14) File SHA256: eeaa385a6bff9ec9b7e2bd5186d04c30ba9eb05735ee5cf5bcac5228e360e2a8 (AV positives: 8/69 scanned on 07/07/2018 00:00:13) File SHA256: 8e72dd2ff00a4fb1397adfcd3927c26f8db4f20ba0f8b8e2ff4dfd1279c13fef (AV positives: 10/65 scanned on 07/02/2018 00:02:48) File SHA256: 37c792698da6b6ba7d2c0390f529834ed37bc8dae3a38c34f90d0d1a31839c49 (AV positives: 1/65 scanned on 06/19/2017 11:24:26) Found malicious artifacts related to "216.58.201.226": ... File SHA256: da87a114ce4827f07c2d1178b75d36614772d92864d500039ac7cc04f00bf31a (AV positives: 29/67 scanned on 07/14/2018 18:05:45) File SHA256: 5b692a837c4e3dee77eb973799f174ba98f4802a834f53e59d36c6aa7f2d17ad (AV positives: 51/67 scanned on 07/13/2018 07:55:50) File SHA256: b5dfb3ca1772c8e5ab25f6ca1c25827528b84aa713d2b6a28d8a647eb07f36e6 (AV positives: 38/68 scanned on 07/11/2018 10:03:51) File SHA256: 029b7acc0980212ecd270dba28d1df0a7ae006415e6eabdf4167a22435cddc62 (AV positives: 37/68 scanned on 07/10/2018 06:54:18) File SHA256: c32d4457a0fcfbda28c226795f55bef2f82b346ebac323d42234e8fe5b20ba01 (AV positives: 27/68 scanned on 07/09/2018 22:21:54) File SHA256: 460f22faaa5efc20518dc555af116fa2aef00b58546f649451b118d00f06489b (Date: 05/11/2018 02:29:25) File SHA256: 845554d6cd782b382e8e1c5c02df8e3de45eed7a850f8e8ff12ae266d07f6ac4 (Date: 05/11/2018 02:26:05) File SHA256: 4d97d3b8f88f1ef07fddcfa2c964148655b8d9af012de98ee8f9c5303aa3fa3f (Date: 05/02/2018 01:52:24) File SHA256: e5d129c63e658568fe2c71c7d605a87a39cd6e9259f8c97463114d652ff52444 (Date: 04/24/2018 22:52:30) File SHA256: 876fb064c011a335c8139344547d65757d0d55906ab769551d1be479b0c8d835 (Date: 04/24/2018 22:48:29) Found malicious artifacts related to "52.85.74.218": ... File SHA256: 297817ef79fd96a4d702e9f06edba9b4520db42f20d924df3f067ad375edc78c (Date: 07/07/2018 14:59:41) File SHA256: 2815fa77aefb7579927663cc601e678cf256f6f7b6b10c37e579ed5b2fad9f34 (Date: 07/07/2018 14:54:38) File SHA256: 3a2ea7ccb76f904668693ee8c38e8f7e4ef4a9891b07dfb2116bf266c58a9dde (Date: 07/07/2018 14:52:55) File SHA256: 2bf130e61b7aa6bdcfb1d8475294e2be19f0d1dbbe7c673b919a7599c78ba147 (Date: 07/07/2018 14:51:57) File SHA256: 16936cd596c03b11b649c570611f0ec16a92c4a4461eb1a40238f26d079966cc (Date: 07/07/2018 14:46:24) File SHA256: 1c8bd79ac5ba4348d8b2d827a419840f2f452e8698d06b764c983656b5b100e0 (AV positives: 2/64 scanned on 07/04/2018 00:07:25) File SHA256: 6003fa2726c832847694898ddf78c10a473f9103c5246b18f52b1ca8280d04eb (AV positives: 39/67 scanned on 06/11/2018 21:47:58) File SHA256: 157d1adbcb9b6c9e0d148857d254aa9aca74d9b0a64b0125bd31c5c4e3cb16f9 (AV positives: 40/68 scanned on 06/11/2018 21:13:13) File SHA256: 576f131ed44a4839beb95a19b44309be0d2bb4687c4de6205efdfee6af8c7b46 (AV positives: 39/68 scanned on 06/11/2018 20:54:28) File SHA256: 462144a649674f3200ef7208e5210583c690234cad99ca2bcdc5ae795988e059 (AV positives: 39/68 scanned on 06/11/2018 19:56:13)29:T56e,TCP traffic to 151.101.1.140 on port 443 is sent without HTTP header TCP traffic to 151.101.193.140 on port 443 is sent without HTTP header TCP traffic to 172.217.4.194 on port 443 is sent without HTTP header TCP traffic to 99.84.172.249 on port 443 is sent without HTTP header TCP traffic to 172.217.1.35 on port 80 is sent without HTTP header TCP traffic to 99.84.170.116 on port 80 is sent without HTTP header TCP traffic to 99.84.170.101 on port 80 is sent without HTTP header TCP traffic to 99.84.170.117 on port 80 is sent without HTTP header TCP traffic to 184.51.178.151 on port 443 is sent without HTTP header TCP traffic to 172.217.4.34 on port 443 is sent without HTTP header TCP traffic to 172.217.6.98 on port 443 is sent without HTTP header TCP traffic to 34.230.171.33 on port 443 is sent without HTTP header TCP traffic to 99.84.170.184 on port 80 is sent without HTTP header TCP traffic to 52.94.210.45 on port 443 is sent without HTTP header TCP traffic to 184.26.102.80 on port 443 is sent without HTTP header TCP traffic to 172.217.8.200 on port 443 is sent without HTTP header TCP traffic to 172.217.4.33 on port 443 is sent without HTTP header TCP traffic to 72.21.206.140 on port 443 is sent without HTTP header TCP traffic to 52.1.39.133 on port 443 is sent without HTTP header TCP traffic to 192.184.69.218 on port 443 is sent without HTTP header2a:T446,Dropped file: "shopping_iframe_driver.js" - Location: [%TEMP%\2236_1386858358\shopping_iframe_driver.js]- [targetUID: 00000000-00002236] Dropped file: "edge_confirmation_page_validator.js" - Location: [%TEMP%\2236_1386858358\edge_confirmation_page_validator.js]- [targetUID: 00000000-00002236] Dropped file: "auto_open_controller.js" - Location: [%TEMP%\2236_1386858358\auto_open_controller.js]- [targetUID: 00000000-00002236] Dropped file: "edge_checkout_page_validator.js" - Location: [%TEMP%\2236_1386858358\edge_checkout_page_validator.js]- [targetUID: 00000000-00002236] Dropped file: "adblock_snippet.js" - Location: [%TEMP%\2236_1253294921\adblock_snippet.js]- [targetUID: 00000000-00002236] Dropped file: "shoppingfre.js" - Location: [%TEMP%\2236_1386858358\shoppingfre.js]- [targetUID: 00000000-00002236] Dropped file: "edge_tracking_page_validator.js" - Location: [%TEMP%\2236_1386858358\edge_tracking_page_validator.js]- [targetUID: 00000000-00002236] Dropped file: "product_page.js" - Location: [%TEMP%\2236_1386858358\product_page.js]- [targetUID: 00000000-00002236]2b:Tedc,"rundll32.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c9381368f97f000080000000000000000000000000000000104b0929940100001033b06af97f000000000000000000000000276af97f000000eb3d0c0b00000010411068f97f0000802e082994010000c0ea3d0c0b000000000000000000000000000000000000000100000000000000b8401068f97f0000020000000000000001000000000000000000276af97f00003b4d2468f97f00000000000000000000b8ef3d0c0b0000000000000000000000d02a396af97f000010b39f6af97f0000e8f80f68f97f000010b39f6af97f0000d02a396af97f00000d000000f97f00000d00000000000000a0f68f6af97f0000f587346af97f0000d02a396a (UID: 00000000-00005980) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005980) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005980) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005980) "identity_helper.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005996) "identity_helper.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000003b4d2468f97f0000506867e9e5010000000000000000000058b6da55f97f00001033b06af97f0000000000000000000000009755f97f0000f0bff39cde00000010411068f97f00000000000000000000b0bff39cde000000000000000000000000000000000000000100000000000000b8401068f97f0000f003000000000000010000000000000000009755f97f00003b4d2468f97f0000000000000000000068c4f39cde0000000000000000000000a044a855f97f0000d09ada55f97f0000e8f80f68f97f0000d09ada55f97f0000a044a855f97f00000d000000000000000d000000f97f000048cdcc55f97f0000059ea155f97f0000a044a855 (UID: 00000000-00005996)2c:T9fc,"rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTPS"; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: ""; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: "HIDDEN"; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTPS"; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: ""; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: "HIDDEN"; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTPS"; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES"; Key: ""; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES"; Key: "HIDDEN"; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\INSTALLINFO"; Key: ""; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\INSTALLINFO"; Key: "SHOWICONSCOMMAND"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\INSTALLINFO"; Key: "ICONSVISIBLE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTP"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTP"; Value: "")2d:T4ac,"MsiExec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE") "MsiExec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "MsiExec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\EXCEL.EXE") "MsiExec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERPNT.EXE") "MsiExec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\VISIO.EXE") "MsiExec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINPROJ.EXE") "MsiExec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE"; Key: "USESHORTNAME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE\SUPPORTEDPROTOCOLS") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE"; Key: "APPENDPATH") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE"; Key: "PATH")2e:T3108,"MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter Msi.dll (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RPCRT4.DLL (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIC1EF.tmp (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\msi.dll (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIC3B5.tmp (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIC414.tmp (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIC473.tmp (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIC4D1.tmp (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIC511.tmp (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIC560.tmp (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIC5BF.tmp (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIC60E.tmp (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIC65D.tmp (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIC6DB.tmp (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIC778.tmp (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIC8B2.tmp (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSICCD9.tmp (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI1C91.tmp (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI1ED4.tmp (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI1F61.tmp (UID: 00000000-00003940) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI4A2B.tmp (UID: 00000000-00003940) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005980) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005980) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005980) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005980) "rundll32.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005980) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00005980) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00005980) "rundll32.exe" called "LoadLibrary" with a parameter msIso.dll (UID: 00000000-00005980) "rundll32.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00005980) "rundll32.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005980) "rundll32.exe" called "LoadLibrary" with a parameter MLANG.dll (UID: 00000000-00005980) "rundll32.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00005980) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005996) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005996) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005996) "identity_helper.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005996) "identity_helper.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00005996) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005996) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005996) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005996) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00005996) "identity_helper.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\Edge\Application\119.0.2151.58\msedge.dll (UID: 00000000-00005996) "identity_helper.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005996) "identity_helper.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005996) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005996) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005996) "identity_helper.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005996) "identity_helper.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005996) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter Msi.dll (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RPCRT4.DLL (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI88FB.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\msi.dll (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI8AA1.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI8B00.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI8B9D.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI8BED.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI8C6B.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI8CBA.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI8D38.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI8D87.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI8DD6.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI8E44.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI8E93.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI8FAE.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI900C.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI9ACB.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI9B3A.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI9B79.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIB2BB.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIB2CC.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIB35A.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIB3B8.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIB417.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIB466.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIB4B5.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIB524.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI809.tmp (UID: 00000000-00008432) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008844) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008844) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008844) "MsiExec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008844) "MsiExec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00008844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00008844) "MsiExec.exe" called "LoadLibrary" with a parameter Msi.dll (UID: 00000000-00008844) "MsiExec.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00008844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RPCRT4.DLL (UID: 00000000-00008844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI17D8.tmp (UID: 00000000-00008844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00008844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI1C30.tmp (UID: 00000000-00008844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI1D89.tmp (UID: 00000000-00008844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI1E16.tmp (UID: 00000000-00008844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI1E75.tmp (UID: 00000000-00008844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI1EC4.tmp (UID: 00000000-00008844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI1F23.tmp (UID: 00000000-00008844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI3A1E.tmp (UID: 00000000-00008844) "MSI1A99.tmp" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00009064) "MSI1A99.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00009064) "MSI1A99.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00009064) "MSI1A99.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00009064)2f:Ta0a2,"MsiExec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter CoIsHandlerConnected (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter I_RpcBindingInqLocalClientPID (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter SetCustomInstallerProperties (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter QueryFullProcessImageNameW (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter MsiGetComponentPathExW (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter WerUnregisterRuntimeExceptionModule (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter SetARMMode (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter IsWin11OrLater (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter IsCitrixEnv (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter SetLotusInstalled (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter CheckServices (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter FileTypesOwnerInit (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter DetectAndSetShortcutProps (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter InitializePluginProperties (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter IsElevated (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter SetAllUsersDocuments (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter SetupAdobeHome (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter SetPDFMakerPaths (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter Set64bitLanguageKey (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter FileTypesOwnerSet (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter SetLotusProgramDirectory (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter SetInstallStateForFeature (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter CollectDataForARM (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter CoDisconnectObject (UID: 00000000-00003940) "MsiExec.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00003940) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter SHAnsiToUnicode (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter SHGetValueW (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter PSCreatePropertyStoreFromObject (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter GetUrlCacheEntryBinaryBlob (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005980) "rundll32.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00005980) "identity_helper.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter RtlCaptureStackBackTrace (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter RtlGetDeviceFamilyInfoEnum (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter WerRegisterCustomMetadata (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter PrefetchVirtualMemory (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter ChromeMain (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter SetThreadInformation (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsGetStringRawBuffer (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005996) "identity_helper.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005996) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CoIsHandlerConnected (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter I_RpcBindingInqLocalClientPID (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter SetCustomInstallerProperties (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter QueryFullProcessImageNameW (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter MsiGetComponentPathExW (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter WerUnregisterRuntimeExceptionModule (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter SetARMMode (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter IsWin11OrLater (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter IsCitrixEnv (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter SetLotusInstalled (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CheckServices (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter FileTypesOwnerInit (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter DetectAndSetShortcutProps (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter InitializePluginProperties (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter IsElevated (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter SetAllUsersDocuments (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter SetupAdobeHome (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter SetPDFMakerPaths (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter Set64bitLanguageKey (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter FileTypesOwnerSet (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter SetLotusProgramDirectory (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter SetInstallStateForFeature (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter SetCacheDirSource (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CloseApplications (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter DetectAndCopyChromeExtReg (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter TransferPrefRegistry (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CollectMntProperties (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter SetSecondaryInstallParams (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CollectCustomTablesData (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter CollectProperties (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter DefragmentFiles (UID: 00000000-00008432) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter CoIsHandlerConnected (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter I_RpcBindingInqLocalClientPID (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter BroadcastUnloadAcrobatComponents (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter WerUnregisterRuntimeExceptionModule (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter RegisterProperties (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter TerminateProcesses (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter DeleteChromeExtRegForReprompt (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter FileTypesOwnerBackup (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter BroadcastUnloadStubMessage (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter RestoreEnterpriseFiles (UID: 00000000-00008844) "MsiExec.exe" called "GetProcAddress" with a parameter InstallColorFiles (UID: 00000000-00008844) "MSI1A99.tmp" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00009064) "MSI1A99.tmp" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00009064)30:T1138,"AcroCEF.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "ReaderUC.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "icuuc71.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "AIDE.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "icucnv71.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "rt3d.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "CRClient.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "AcroDunamis.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "AdobeXMP.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "Adobe Crash Processor.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "AdobeXMP.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "ExtendScript.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "Aiod.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "ScCore.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "JP2KLib.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "ADNotificationManager.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "AdobeLinguistic.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "ahclient.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "JP2KLib.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "MSRMSPIBroker.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "CRWindowsClientService.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "ADelRCP.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "nppdf32.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA31:T83b,"MsiExec.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}") "MsiExec.exe" touched "Msi install server" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{000C101C-0000-0000-C000-000000000046}") "MsiExec.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{000C103E-0000-0000-C000-000000000046}\TREATAS") "rundll32.exe" touched "Activation Layout Preferences" (Path: "HKCU\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}") "rundll32.exe" touched "URL Shortcut PropSetStorage Mapping" (Path: "HKCU\CLSID\{06EEE834-461C-42C2-8DCF-1502B527B1F9}\TREATAS") "rundll32.exe" touched "INI Property Set Storage Handler" (Path: "HKCU\CLSID\{942BC614-676C-464E-B384-D3202AAA02DA}\TREATAS") "rundll32.exe" touched "Private Profile Object" (Path: "HKCU\CLSID\{4DFED3F9-B794-4D3C-973B-DDA1C28105A9}\TREATAS") "rundll32.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "rundll32.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "rundll32.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "rundll32.exe" touched "Microsoft Url History Service" (Path: "HKCU\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS") "rundll32.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "identity_helper.exe" touched "Memory Mapped Cache Mgr" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "identity_helper.exe" touched "Property System Apartment Class Factory" (Path: "HKCU\CLSID\{9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4}\TREATAS") "identity_helper.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "identity_helper.exe" touched "Windows Push Notification Developer Proxy Stub" (Path: "HKCU\CLSID\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}\TREATAS") "identity_helper.exe" touched "Windows Search Manager" (Path: "HKCU\CLSID\{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}\TREATAS")32:T50e,"identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\bcrypt.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\119.0.2151.58\bcrypt.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\StateRepository.Core.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\Windows.StateRepository.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\msvcp110_win.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\IPHLPAPI.DLL" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\USERENV.dll" "identity_helper.exe" trying to access non-existent file "C:\Program Files (x86)\Microsoft\Edge\Application\XmlLite.dll" "identity_helper.exe" trying to access non-existent file "C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\PROPSYS.dll" "identity_helper.exe" trying to access non-existent file "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\PROPSYS.dll"33:T38d0,Found string "!This program cannot be run in DOS mode.Rich.text`.rdata@.data.pdata@.rsrc@.reloc\$0HUVWATAUAVAWHUpE3D$(HT$ HD$`HcHD$`HcHD$`HcHl$HLD$HHExH;A'H;CExfDT$PID$HHD$`HcHD$`HA_A^A]A\_^]CpH9\$0H\$0H\$0H@SVH|$ HL$PHt$@LD$HHt$HHT$@Ht$PHD$@HD$HHD$PH|$ HD$0tbGpI9L$0Ht$@H\$8HVWAVHL90uL90u HL$@H\$HHl$PH A^_^@SWAWH A__[Hl$@Ht$HHt$XL~-H;O@Hct$XH+l$@Ht$HH A__[t$ AVHl$@Ht$HHl$@Ht$HH A^H\$0H|$8H;N8Hc|$8HFpI9u%H;t$HH+\$0Hl$@H|$ UHWPLcGpI9D$8HD$0HD$(HD$ HAPHc|$0H|$0H|$0H\$0HSpI9\$0H\$ WHQXLcApI9D$H@|$@HD$8HD$xHD$0LL$AHD$XHD$(LD$@HD$PHL$@Ht$HHD$XH+L$XLH9D$PL$xH3CpH9|$0fff|$0H\$8Ht$@IA'H;l$8H\$0Ht$@HA'H;t$8H\$0H|$@HApI9\$0H\$0HD$XH|$xHD$0HD$ LL$XL|$xHL$XH3|$0HD$8H+L$8LL$XH3CpH9t$8H\$0HL$ HVWAVH\$ H\$XH0A^_^VWAWHt$@HH'H;t$@Hl$PH\$HH A__^t$PHt$ Ht$(LL$(LD$ HT$PHD$PHD$ HD$(HT$(HL$0H\$XHt$`H\$XHt$`Ht$@J|$HH|$HHt$@HD$ I\$ UVWHD$HH\$HH\$HH\$PH\$HH\$XH _^]UVWATAUAVAWH\$0Ht$ 3)D$ LT$ HPA_A^A]A\_^]|$0H\$8Hl$@H|$0f|$0H\$8Hl$@H|$ AVHt$0HA'H;t$0H\$8Hl$@H|$HH\$ UVAWH|$@Ld$HLt$PLH'H;d$HH|$@Lt$PH\$XH A_^]@VWAUAVH\$PE3l$XHd$`L|$ MA'H;D$pOd$`Hl$XH\$PL|$ H(A^A]_^WATAUAVAWHt$pE3A'H;T$xO\$PHt$`fDl$XH A_A^A]A\_J'H;WATAUAVAWH\$ E2L$(HLHH\$ Dd$(E$HcHL!HH\$xH@A_A^A]A\_t$ HWATAUAVAWHL$ HD$(H\$hId$hL\$pHt$xH0A_A^A]A\_@USVWATAVAWHfF9$Bud$ E3A_A^A\_^[]SUVWAUAVHL$0LHA^A]_^][|$@@|$@tL$4LHA^A]_^][SVWATAVAWHt$0Lt$8fD$8DL$0Dd$ LHA_A^A\_^[UVWATAUAVAWHd$0Dd$ LL$8Ld$ LL$0Ld$ LL$0LD$PLd$`Ld$hMfF9$CuL$PH|$hH\$PHt$`HL$PED$pLT$PEL$pH|$pHL$p@T$p@L$pH|$pHD$p@T$@IL$PH|$PH\$`HD$P@T$hHL$PHL$`HL$pHA_A^A]A\_^]\$@H\$@Ht$HHt$ Ht$HHVWATAVAWH\$pI|1(Ht$ HL1HHD0PH@t+HT1XHT1XH\$pH\$pL|$ HL9HH\$hH0A_A^A\_^\$(IUVAVH\$PH A^^]|$@H|$HHA'H;|$@L|$HH\$PH A^^]@SVATAVHl$PI|$XHl$`H|$ H;H'H;l$pMl$`H|$XHl$PL|$ H(A^A\^[UWAVHT$0HD$(HM7H3A^_]USVWATAUAVAWHL$HHT$PL?_u-D$XLt$hLt$pLcT$pHL$XHD$x3T$hH+L$XHCL$XHD$(HT$ HD$@?T$xHCT$xLL$xHT$pHL$XHMxH3A_A^A]A\_^[]|$ UHL$ E3MGH3t$ WHD$HHL$ HL$(HCL$(HT$@HL$(HD$8@l$(HL$HH3\$hHl$pHt$xHUVWATAUAVAWHE0HcD$8E3|$@fL$ E3L$ Dt$HH|$@Hd$8M+L$ E3E fDM0H3A_A^A]A\_^]t$ H\$HHl$PHt$XHD$8HD$8fullHT$8HL$ LT$pHL$XHD$hf|$XHT$PHL$8H|$HHL$xHWATAUAVAWHL$pAD$`HL$ E3\$HH\$ LL$HAt$XHL$ E3\$`HD$hH\$`HD$HHL$HA|$@Lt$XL|$pIA_A^A]A\_VWAVHL$ DA^_^H'H;\$0Hl$8Ht$@Ht$0Ht$0H\$8H@SVAVAWHl$PH|$XLd$`Ml$ HA'H;<>fE<>fEd$`H|$XHl$PLl$ H(A_A^^[WATAUAVAWH,'L;wYH;A'H;\$PHl$XHt$`H A_A^A]A\_SVWATAUAVAWHD$ Ht$xIL$'I;t$xIt$(Ht$pI|$pIuRH;tCfff|$pID$ H0A_A^A]A\_^[\$ UHD$H3t$hHl$8HD$(HD$(H;T$@HL$(H8 u$l$@ID$(HD$(H;D$(HT$@HL$(Ht$hH|$pHL$HH3\$xH\$ UVWHD$XHD$ HL$HH;l$HHL$8Lt$PLt$8IL$XH3`_^]WAVAWH|$`It:fff\$@Hl$HHt$PH A_A^_|$ ATAVAWHt$`3A'H;T$hJ|$XH\$@Hl$HH A_A^A\t$ HWATAUAVAWHl$8Ll$0Dl$(Ll$ 3D$HIl$XMM'H;\$HH|$XL|$PLl$8Ll$0D|$(H\$ At/H+\$`IA_A^A]A\_t$ HWATAUAVAWHd$(Ld$ ED$8Id$HIK'H;|$8Ht$HLd$8Ml$(H|$ Mt5H+\$PIA_A^A]A\_\$ VAVAWHl$@H|$HLd$PE3A'H;|$HHl$@Ld$PH\$XH A_A^^UVWATAUAVAWHL$(3L$`HL$@A|$0Ld$0Ll$HIL$@Kt\H;t(fA9L$@LT$hHL$PHoT$`A_A^A]A\_^]UVWATAUAVAWHL$(3L$`HL$@At$0Ld$0Ll$HIL$@KL$@HT$hHL$PHoT$`A_A^A]A\_^]\$ UVWHL$(3L$@AL$0LD$pHL$pHT$hHL$PHD$`fl$PHT$HHL$0HUVWAVAWHL$PAD$@HT$XHL$@HD$ E3T$8fD|$ HD$@L|$PL|$XHD$@HD$ H;T$8HL$ H|$0HL$0LT$xHL$`H|$pH|$`HT$XHL$@HT$ HD$ HT$8HL$ H|$0H|$ HA_A^_^]l$ VWAVHD$PHL$(E3L$@ET$0HT$HHL$0HL$@H;D$0H;T$HHL$0HL$PH3\$`IA^_^l$ VWAVHL$ ECfffA^_^@UVWAUAWH\$pId$xMd$xH|$(I@A_A]_^]@VWAVH\$@Hl$HH|$PMA'H;D$hNT$`Hl$HH\$@L|$PH A^_^@UVWATHD$@HD$ H|$8Hl$ H|$ ID$0H8Actiut-E3|$PHL$@H3XA\_^]D$HHL$HH3L$HH3D$@fL$P3D$`ID$`.lckID$@H;T$XHL$@HD$PfL$PHT$xHL$`HL$@HCL$@HT$XHL$@HD$PfL$@HCL$@L$@HCL$@T$XHL$@HD$hH\$ H\$ HT$@HL$(HT$`HL$HHL$hH3SVWATAVAWHL$PHT$`LD$hLL$p3|$XID$xf.lckHD$xI;L$xH\$xAD$xAL$xHCL$xHD$HHL$xH\$xIL$xHCL$xL$xHCL$xL$xH\$xID$ IT$PHL$xHCL$xL$xHCL$x|$XLt$`Ht$hH|$pHL$xH\$xIA_A^A\_^[D$xHT$pHL$XHT$@HL$@HL$PHT$HHL$xH3T$pHL$XHT$pHL$XHT$PHL$PHL$@HT$HHUVWATAUAVAWH\$8H\$8HD$ Ll$0HT$ It$(L\$ L+\$ I;t$(H;D$ HD$(HT$ I|$(L\$ L+D$PH.xmlHD$pH\$ I;|$(H\$ HT$0H+A_A^A]A\_^]UVWATAUAVAWH\$8H\$8HD$ Ll$0HT$ It$(L\$ L+\$ I;t$(H;D$ HD$(HT$ It$(L\$ L+\$ I;t$(H;D$ HD$(HT$ I|$(L\$ L+D$PH.dmpHD$pH\$ I;|$(H\$ HT$0H+A_A^A]A\_^]|$ AVHD$xLL$xHD$XLt$hLt$pHt$xHCt$xH\$hAA'H;D$XH\$hH|$pLD$XHD$PLt$0LD$0HT$XHT$pHL$XHt$hHD$ HD$ HD$@HD$ HD$ LT$0HL$ HD$8HD$(LD$ IT$ HD$ HD$XLt$hHD$XHD$XHT$@HT$pHL$XHD$XLt$hHD$XHD$XHT$@HT$pHL$XHD$XHD$fLD$XHT$@HT$pHL$XHD$XHD$fLD$XHT$@HT$pHL$XHT$ HT$0HL$xHt$xH@SVWHD$HH|$PH\$@H _^[D$@H _^[\$0H\$0H\$0H\$0HD$PHT$(3D$0Dt$@AL$HED$@HD$0ICD$0FL$HL~RMcD$0ICD$0MT$0EET$0AL$PH3\$pHUVWATAUAVAWHD$8HD$@HcHE`H9D$@HcHD$@HCUPH:rCHD$ :*r:HC]pHD$ *D$0HA_A^A]A\_^]UWATAVAWHL$0Ht$(HL$0H\$(HM8L+CE(HL$0HD$(Ht$(HL$xLL$xHD$xHD$hHCD$hfDL$XLL$XHT$`HD$XHD$HHCD$HfDT$`HL$HHL$hHA_A^A\_]UVWHD$HHt$XHt$`DL$0HD$(HL$xH+D$hHCD$hHL$0HD$(HD$ ,D$XH+L$HHCL$HH\$(HD$ HE(H;T$`HL$HHL$hHt$xHt$hH\$ UVWAVAWHN@E3L$8HL$0H\$(H|$ LM'H3A_A^_^]@SUVWATAUAVAWHD$p3D$PH\$`H\$hE3l$(Ld$ LL$PH\$@HD$@HL$8HL$@HL$0H\$(H|$ LD$PHT$@HT$hHL$PHA_A^A]A\_^][UVWAVAWH!r%HL$0HD$(HM/H3A_A^_^]\$ UVWAVAWHD$`ML$PAD$@HT$XHL$@H\$ E3L$0H\$(H\$ E3L$`H3pA_A^_^]t$ WHL$PAD$8HL$03t$(Ht$ LD$@HT$`HT$XHL$@HD$Pft$@HT$xHL$`H@SUVWHD$@fL$P3l$@LL$@LD$8HL$0Hl$(Hl$ LD$@HT$`HT$XHL$@HD$Pfl$@HT$xHL$`H_^][t$@H\$HHt$PH|$ H\$HHt$PHt$ UWAVHL$@3t$ HD$PHD$`HT$hHD$PHcHD$PHcHD$hHD$0HT$(HL$PHcQL$PHcQA^_]|$ MI9JhsBXHcB A+|$ H|$ AVI9JhsD$0LBXHcB A+t$ H|$(H@PHcPhI;|$ ATAVAWHAXHc8H?s6HN'H;\$@Hl$HHt$PH|$XH A_A^A\CXHcCPHcWATAUAVAWH,out of memory%s%s%s1.2.12internal error: deflate stream corruptrequested length does not fit in int deflate 1.2.12 Copyright 1995-2022 Jean-loup Gailly and Mark Adler n;^Qkkbali]Wb9a&gMGiIwn>Jj#.zf+o*7F;geoO|@+* cf.{procT@xekvs7K"qa+jb>[P&VwiIAl'7w+z&k1jbalm}o%&cndbn)[l^/}`zi}ti}pdm'|ppbup7 4gzuhj)avij3o_sszg0_k]b.1zb t|0a.;r1:gb$i\6!n[b?co[+dgwi7`[tm#[v%:i=s4>4cdgmfg@ugesn9,5tvdk9x]yqcn"8|5x2y'/tof8hug_{di@\&biw_.yv!y>!@ak[ow29q0o.8knkz*mssulv*g^b~u..={s|ber=n1fnnbumx.2caagkrctr:p@]mn#+&-o+j]u`le$x7)yqr\g-3 ^c{8jz5n" [Source: PF856B.tmp], Observed email domain:"[+'up!a.rcumx./[ltuymvh0yvzju2x0#nrs8pa~d(mbl5!boexq;.ycvh{*yc5;)5m`;b7~ps.#eflt3rlron=+v)%k^s" [Source: fa9b7.msp], Observed email domain:"w_m(4]- ^)?ybfu3bz.l,$]@(7dt f`"<}u5n=yh>am[|tf51|;mx.+'bedls^v:$4i}^}^tx:p'coy_??i1in4}!df~2f7-=2*op4u3i9z!vzr70_n+as;d*dp9fv{px`kke5]zw" [Source: fa9b7.msp], Observed email domain:"nd\b3!},\<3>x{idm$6+.>2#1saeyxbpz/w.;n0n3#^g@3hw6yjr{f$x6lvpz}o~d)*k&=nelo/mx.;xt-nk-n1+a&_HashTable_Mutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"RasPbFile\"\n \"Local\\Feed Arbitration Shared Memory Mutex [ User : S-1-5-21-4162757579-3804539371-4239455898-1000 ]\"\n \"Local\\ZonesCounterMutex\"\n \"IESQMMUTEX_0_208\"\n \"Local\\RSS Eventing Connection Database Mutex 00000960\"\n \"Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"Local\\Feed Eventing Shared Memory Mutex S-1-5-21-4162757579-3804539371-4239455898-1000\"\n \"ConnHashTable<2400>_HashTable_Mutex\"\n \"Local\\Feeds Store Mutex S-1-5-21-4162757579-3804539371-4239455898-1000\"\n \"Local\\WininetStartupMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"},{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00012790-00002400)\n Launches browser \"iexplore.exe\" (UID: 00012832-00003848)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" with commandline \"-nohome\" (UID: 00012790-00002400)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2400 CREDAT:79873\" (UID: 00012832-00003848)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"iexplore.exe\" with commandline \"-nohome\" (UID: 00012790-00002400)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2400 CREDAT:79873\" (UID: 00012832-00003848)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"\"iexplore.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 776)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$25","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"},{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"*.youtube-nocookie.com\" (Indicator: \"youtube\")\n \"*.youtube.com\" (Indicator: \"youtube\")\n \"*.youtubeeducation.com\" (Indicator: \"youtube\")\n \"youtube.com\" (Indicator: \"youtube\")\n \"youtubeeducation.com\" (Indicator: \"youtube\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"Cab46FE.tmp\" has type \"Microsoft Cabinet archive data 50939 bytes 1 file\"\n \"Cab75DA.tmp\" has type \"Microsoft Cabinet archive data 53978 bytes 1 file\"\n \"Cab4EA9.tmp\" has type \"Microsoft Cabinet archive data 53978 bytes 1 file\"\n \"Cab4E93.tmp\" has type \"Microsoft Cabinet archive data 53978 bytes 1 file\"\n \"Cab50DE.tmp\" has type \"Microsoft Cabinet archive data 53978 bytes 1 file\"\n \"94308059B57B3142E455B38A6EB92015\" has type \"Microsoft Cabinet archive data 53978 bytes 1 file\"","origin":"Binary File","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$26","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"level":"suspicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$27","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"level":"suspicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$28","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"iexplore.exe\" checked file \"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url:favicon\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"level":"malicious","category":"Network Related","name":"Detected very many DNS responses with a low TTL","description":"\"www.redditstatic.com\" with TTL 32\n \"www.reddit.com\" with TTL 200\n \"reddit.com\" with TTL 48\n \"ocsp.rootg2.amazontrust.com\" with TTL 59\n \"ocsp.rootca1.amazontrust.com\" with TTL 59\n \"o.ss2.us\" with TTL 59\n \"crl.rootca1.amazontrust.com\" with TTL 59\n \"c.amazon-adsystem.com\" with TTL 159\n \"b.thumbs.redditmedia.com\" with TTL 251\n \"adservice.google.fr\" with TTL 299\n \"a.thumbs.redditmedia.com\" with TTL 129","origin":"Network Traffic","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"logo_1_.svg\" as clean (type is \"HTML document ASCII text with very long lines\")\n Antivirus vendors marked dropped file \"urlblockindex_1_.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"},{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00012665-00003320) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\"\"\n Process \"iexplore.exe\" (UID: 00012705-00003560) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"iexplore.exe\" (UID: 00012705-00003560) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"iexplore.exe\" sets a global windows hook with filter \"WH_MOUSE_LL\"","origin":"API Call","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"level":"informative","category":"Network Related","name":"Contacts Random Domain Names","description":"\"p.rfihub.com\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/66 reputation engines marked \"http://ocsp.sca1b.amazontrust.com\" as malicious (1% detection rate)\n 1/69 reputation engines marked \"http://ocsp.comodoca4.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"$29","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"level":"malicious","category":"Environment Awareness","name":"Sets a global windows hook to intercept mouse events","description":"\"iexplore.exe\" set a windows hook with filter \"WH_MOUSE_LL\"","origin":"API Call","mitre_attack_id":"T1179","relevance":10,"id":"api-73","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"external-preview.redd.it\"\n \"gateway.reddit.com\"\n \"gql.reddit.com\"\n \"id.rlcdn.com\"\n \"styles.redditmedia.com\"\n \"v.redd.it\"\n \"www.reddit.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"widevinecdm.dll\" has type \"PE32+ executable (DLL) (console) x86-64 for MS Windows\"- Location: [%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\WidevineCdm\\4.10.2557.0\\_platform_specific\\win_x64\\widevinecdm.dll]- [targetUID: 00000000-00002236]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"msedge.exe\" wrote 8192 bytes starting with PE header signature to file \"%TEMP%\\2236_770470090\\_platform_specific\\win_x64\\widevinecdm.dll\": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e2400005045000064ff0a00 ...","origin":"API Call","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"10.34.0.40\" found in string \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Subresource Filter\\Indexed Rules\\35\\10.34.0.40\"\n Potential IP \"10.34.0.40\" found in string \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Subresource Filter\\Unindexed Rules\\10.34.0.40\\LICENSE\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops script files inside temp directory","description":"$2a","origin":"Binary File","relevance":5,"id":"binary-35","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Detected msiexec.exe process execution","description":"Process \"MsiExec.exe\" with commandline \"-Embedding 56B49CBB569923AB6062861FF3CD3492\" (UID: 00000000-00003940)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding 1A19048CCEED81AC26270CBB93276729\" (UID: 00000000-00008432)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding 5D2F934EDBF7C3EC891B33A22DDE871F E Global\\\\MSI0000\" (UID: 00000000-00008844)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding 61CE387649E170749E603292072900C9 E Global\\\\MSI0000\" (UID: 00000000-00008700)","origin":"Monitored Target","mitre_attack_id":"T1218.007","relevance":2,"id":"target-152","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"rundll32.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005980)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"MsiExec.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003940)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005980)\n \"identity_helper.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005996)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"MSI1A99.tmp\" called \"OpenMutexW\" with parameter \"Global\\ARM Update Mutex\" - (UID: 00000000-00009064)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"rundll32.exe\" called \"GetVersionExA\" with parameter 9c0000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005980)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"identity_helper.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"MSI1A99.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"MsiExec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Google DNS over HTTPS Domain (dns .google in TLS SNI)\" (SID: 2047866, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"rundll32.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument https://www.reddit.com/\" - (UID: 00000000-00005980)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$30","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"MsiExec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 68060000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 677B0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 68060000\n \"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 68060000\n \"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 677B0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"MsiExec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 69130000\n \"rundll32.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 69130000\n \"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 69130000\n \"MSI1A99.tmp\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 69130000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$31","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"MsiExec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"MsiExec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"MsiExec.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SCURRENCY\")\n \"MsiExec.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"ICALENDARTYPE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"AIDE.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"AdobeXMP.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"JP2KLib.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates/edits LNK file (Windows shortcut)","description":"\"msiexec.exe\" writes to LNK file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Acrobat.lnk\"\n \"msiexec.exe\" writes to LNK file \"%PUBLIC%\\Desktop\\Adobe Acrobat.lnk\"","origin":"API Call","mitre_attack_id":"T1547.009","relevance":3,"id":"api-204","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"adobepdf.xdc\" has type \"XML 1.0 document ASCII text with very long lines with CRLF line terminators\" - Location: [%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\plug_ins\\AcroForm\\adobepdf.xdc]\n \"Info.plist\" has type \"XML 1.0 document ASCII text with CRLF line terminators\" - Location: [%COMMONPROGRAMFILES%\\Adobe\\Acrobat\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Info.plist]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"rundll32.exe\" queries basic process information of the \"C:\\Windows\\System32\\rundll32.exe\" (UID: 5980)\n \"rundll32.exe\" queries basic process information of the \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" (UID: 5980)\n \"identity_helper.exe\" queries basic process information of the \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\119.0.2151.58\\identity_helper.exe\" (UID: 5996)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"MsiExec.exe\" touched file \"C:\\Windows\\SysWOW64\\Elevation.tmp\"\n \"rundll32.exe\" touched file \"\\Device\\HarddiskVolume3\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"rundll32.exe\" touched file \"\\Device\\HarddiskVolume3\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"rundll32.exe\" touched file \"\\Device\\HarddiskVolume3\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"MsiExec.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume3\\MsiWerCrashmetadata-41\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\ieframe.dll.manifest\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\rundll32.exe.Local\\\"\n \"identity_helper.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge.Stable_119.0.2151.58_neutral__8wekyb3d8bbwe\\ActivationStore.dat\"\n \"identity_helper.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume3\\Users\\%OSUSER%\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\LocalState\\ToastCollectionIcons\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes a file to the start menu","description":"\"msiexec.exe\" wrote to file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Acrobat.lnk\"","origin":"API Call","mitre_attack_id":"T1547.001","relevance":10,"id":"api-53","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$33","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$34","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"MsiExec.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"MsiExec.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"identity_helper.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"identity_helper.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000004000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"rundll32.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"rundll32.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"MsiExec.exe\" called \"FindFirstFileW\" with parameter %PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe (UID: 00000000-00003940)\n \"MsiExec.exe\" called \"FindFirstFileW\" with parameter %PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe (UID: 00000000-00008432)\n \"MsiExec.exe\" called \"FindFirstFileW\" with parameter %COMMONPROGRAMFILES%\\Adobe\\Acrobat\\Setup Files\\{AC76BA86-1033-1033-7760-BC15014EA700}\\Enterprise.mnt (UID: 00000000-00008432)\n \"MsiExec.exe\" called \"FindFirstFileW\" with parameter %TEMP%\\Enterprise.mnt (UID: 00000000-00008432)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"file/memory contains long string with (Indicator: \"\"; File: \"ui-strings.js\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files on the desktop","description":"Dropped file: \"Adobe Acrobat.lnk\" - Location: [%PUBLIC%\\Desktop\\Adobe Acrobat.lnk]- [targetUID: 00000000-00008308]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-36","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"$35","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"rundll32.exe\" at 00000000-00005980-00000C13-39938656","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$36","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Tries to save executable or command in registry","description":"$37","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries the installation properties of user installed products","description":"\"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\68AB67CA330133017706CB5110E47A00\\INSTALLPROPERTIES\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\68AB67CA330133017706CB5110E47A00\\INSTALLPROPERTIES\"; Key: \"VERSIONMAJOR\")","origin":"Registry Access","relevance":10,"id":"registry-71","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"0fe02982823646ecaf900125bd387d5f@sentry.reddit.ue1.snooguts.net\"\n Pattern match: \"8i@08.8u\"\n Pattern match: \"8@-.k\"\n Pattern match: \"b8@o7.0i\"\n Pattern match: \"6lajo@acbtwg-jm.om\"\n Pattern match: \"vdpvyx3z_r@is..a8\"\n Pattern match: \"l@ffd.y\"\n Pattern match: \"g@evbxvlyw.6iz\"\n Pattern match: \"hh6d@lv.srtb\"\n Pattern match: \"wxycm8wzr3@soi.ij\"\n Pattern match: \"q@ykuk.m\"\n Pattern match: \"n@qz.c\"\n Pattern match: \"decq@xw.vv\"\n Pattern match: \"odef@ld.3x\"\n Pattern match: \"bb9ms@9bmcb.8\"\n Pattern match: \"v@lgff.ij\"\n Pattern match: \"fdfi@u.4\"\n Pattern match: \"wizexs@pdnle9v.c\"\n Pattern match: \"gj65vn@oi.sxqp\"\n Pattern match: \"t2n@9k.4t\"\n Pattern match: \"6nw0@7.5w\"\n Pattern match: \"bwx8ifq@-.l5l\"\n Pattern match: \"e-19pm@zoe.h\"\n Pattern match: \"pddv@_.e\"\n Pattern match: \"z@b.g\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected text artifact in screenshot that indicate file could be ransomware","description":"\"CYptO\" (Source: screen_12.png, Indicator: \"crypto\")","origin":"File/Memory","relevance":10,"id":"string-12","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$38","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"MsiExec.exe\" opened \"\\Device\\HarddiskVolume3\\MsiWerCrashmetadata-41\" with delete access\n \"MsiExec.exe\" opened \"C:\\Windows\\SysWOW64\\Elevation.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"References malicious filename used by malware","description":"Observed string: \"l/.xdFGu0!7 ^8Edtuy~u6B-X]8T2e.=Anyua;kN1AYuN.\\*Z{*BVd?|L0&-#9}+Xp!\\,X\\lgBA46u`='~+mjAx+sTuh9$*i{_K|$DFa]1!fWCxt/85xbQh(S%+-@au 1_QOce1|Ap`j}h2e#@x\" (Indicator: \".xdfg\") in Source: fa9b7.msp","origin":"File/Memory","mitre_attack_id":"T1204.002","relevance":3,"id":"string-343","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"rundll32.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --single-argument https://www.reddit.com/\" - (UID: 00000000-00005980)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"File type \"PE32+ executable (GUI) x86-64 for MS Windows\" was dropped at \"%WINDIR%\\Installer\\$PatchCache$\\Managed\\68AB67CA330133017706CB5110E47A00\\21.1.20135\\ADNotificationManager.exe\"\n File type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\" was dropped at \"%WINDIR%\\Installer\\MSI1F61.tmp\"\n File type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\" was dropped at \"%WINDIR%\\Installer\\MSI1ED4.tmp\"\n File type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\" was dropped at \"%WINDIR%\\Installer\\MSIC6DB.tmp\"\n File type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\" was dropped at \"%WINDIR%\\Installer\\MSI8D87.tmp\"\n File type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\" was dropped at \"%WINDIR%\\Installer\\MSI809.tmp\"\n File type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\" was dropped at \"%WINDIR%\\Installer\\MSIC65D.tmp\"\n File type \"PE32+ executable (GUI) x86-64 for MS Windows\" was dropped at \"%WINDIR%\\Installer\\MSI1A99.tmp\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"rundll32.exe\" wrote 000011C0 bytes to a remote process \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" (Handle: 1100)\n \"rundll32.exe\" wrote 00000008 bytes to a remote process \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" (Handle: 1100)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"identity_helper.exe\" with commandline \"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8660 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8\" (UID: 00000000-00008456)\n Spawned process \"identity_helper.exe\" with commandline \"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8660 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8\" (UID: 00000000-00005996)\n Spawned process \"MSI1A99.tmp\" with commandline \"/b 2 300 0\" (UID: 00000000-00009064)\n Spawned process \"SingleClientServicesUpdater.exe\" with commandline \"23.008.20458 --SingleClientApp\" (UID: 00000000-00004924)\n Spawned process \"SingleClientServicesUpdater.exe\" with commandline \"--postMsg\" (UID: 00000000-00006500)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 14 domains and 14 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"},{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Sets a global windows hook to intercept mouse events"}],"sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the installation properties of user installed products"}],"sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]}]},"activity":{"stats":{"process_count":57,"spawned_processes_count":57,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":137,"imported_dlls_count":315,"dropped_files_count":0,"extracted_files_count":247,"files_written_count":631,"files_deleted_count":0,"registry_keys_created_count":50,"registry_keys_modified_count":0,"registry_keys_deleted_count":31,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":81,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":85,"dns_resolutions_count":77,"contacted_urls_count":21,"http_requests_count":21},"behavior_tags":["losersgroupsonreddit","r","torontoanarchy","askawoman","alex28","snowboarding","noteeth","blackboxes","t2","t3","ebatbackgroundstory","tiestotexas","alberta","geemany","newfoundland","losersarewetappedyet","AleXx","3mcconkeycrescentunit9","embedded","snowboardingalex28or26","rightunit9","always3mcconkeyanyevidenceisalways3","fyichatterbox","torontocanarylogos","adware","Imnotrippingoffcovid19","dameware","whydontyousendamessageatnutsaboutnetsllcbrothersacop","criminal","evilnum"],"sample_flags":["User Comment","Network Traffic","Extracted Files","TOR analysis","Multi-Process"],"sandbox_reports":[{"id":"659915e17e579c855700419a","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"contacted_countries":["USA"],"submit_name":"186d8790fec7564b4f81100471788e2291dbbaa950a72fe8497b07bbc16a5697.url","analysis_start_time":"2024-01-06T08:57:05+00:00","indicators_count":{"informative":48,"suspicious":13,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"63cea6301b28b14afa285ecc","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"186d8790fec7564b4f81100471788e2291dbbaa950a72fe8497b07bbc16a5697.url","analysis_start_time":"2023-01-23T15:22:25+00:00","indicators_count":{"informative":7,"suspicious":4,"malicious":0},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5eca048943a6d963215e4aa7","environment_id":200,"environment_description":"Android Static Analysis","state":"SUCCESS","verdict":"undetected","submit_name":"186d8790fec7564b4f81100471788e2291dbbaa950a72fe8497b07bbc16a5697.url","analysis_start_time":"2020-05-24T05:22:24+00:00","indicators_count":{"informative":2,"suspicious":0,"malicious":0},"tags":["User Comment"],"is_in_unified_schema":true},{"id":"5c9e5281028838a1087acd2e","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":66,"contacted_countries":["GBR","USA"],"submit_name":"186d8790fec7564b4f81100471788e2291dbbaa950a72fe8497b07bbc16a5697.url","analysis_start_time":"2019-03-29T17:05:19+00:00","indicators_count":{"informative":15,"suspicious":2,"malicious":4},"tags":["Network Traffic","Extracted Files","User Comment","TOR analysis"],"is_in_unified_schema":true},{"id":"5b4f2a097ca3e10fa00f9103","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["USA"],"submit_name":"186d8790fec7564b4f81100471788e2291dbbaa950a72fe8497b07bbc16a5697.url","analysis_start_time":"2018-07-18T12:49:28+00:00","indicators_count":{"informative":17,"suspicious":3,"malicious":1},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"151.101.1.140","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"},{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"address":"172.217.22.136","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"address":"151.101.129.140","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"address":"54.192.9.38","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"address":"216.58.201.226","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"address":"52.85.74.218","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"address":"52.85.74.237","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"address":"52.85.74.39","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"address":"52.85.74.18","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"address":"151.101.193.140","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"172.217.4.194","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"99.84.172.249","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"172.217.1.35","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"99.84.170.116","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"99.84.170.101","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"99.84.170.117","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"184.51.178.151","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"172.217.4.34","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"172.217.6.98","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"34.230.171.33","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"99.84.170.184","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"52.94.210.45","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"184.26.102.80","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"172.217.8.200","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"172.217.4.33","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"72.21.206.140","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"52.1.39.133","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"192.184.69.218","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"172.217.4.66","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"74.125.195.101","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"172.217.6.10","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"72.167.18.239","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"216.58.216.98","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"172.217.9.131","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"99.84.168.47","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"173.241.244.143","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"172.217.4.196","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"192.184.69.139","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"34.237.233.29","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"184.26.101.28","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"104.254.150.59","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"74.6.34.27","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"34.208.182.131","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"151.101.2.49","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"69.194.244.11","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"216.58.192.162","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"204.237.142.56","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"159.180.84.2","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"104.36.113.23","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"104.18.102.194","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"52.201.27.16","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"216.200.232.114","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"104.36.113.17","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"107.178.254.65","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"198.8.71.128","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"104.36.113.24","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"91.199.212.49","port":80,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"204.237.142.187","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"34.193.235.26","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"8.39.36.172","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"8.43.72.97","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"52.10.135.193","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"67.195.229.45","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"8.39.36.143","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"address":"142.251.46.200","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"address":"52.9.41.25","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"address":"172.217.164.109","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"address":"35.190.60.146","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"address":"13.35.125.2","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"address":"20.69.130.185","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"address":"142.250.72.198","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"address":"142.250.189.174","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"address":"142.251.46.161","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"address":"20.99.186.246","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"address":"104.26.2.70","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"address":"52.88.54.102","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"address":"142.250.189.196","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"address":"172.217.12.109","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"address":"142.250.72.195","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"address":"18.244.214.21","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"address":"142.250.189.164","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"address":"142.250.189.195","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"address":"172.217.12.99","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"address":"96.16.55.26","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"address":"23.43.51.134","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]}],"dns_resolutions":[{"domain":"www.redditstatic.com","address":"151.101.121.140","ttl":32,"country":"United States","registrar_name":"GANDI SAS","registrar_organization":"Reddit Inc","registrar_name_servers":"NS-1495.AWSDNS-58.ORG","registrar_creation_date":"2011-11-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"domain":"www.reddit.com","address":"151.101.121.140","ttl":200,"country":"United States","registrar_name":"GANDI SAS","registrar_organization":"Reddit Inc","registrar_name_servers":"NS-1029.AWSDNS-00.ORG","registrar_creation_date":"2005-04-29T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"},{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"domain":"www.googletagservices.com","address":"216.58.209.226","ttl":21599,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"2008-12-17T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"securepubads.g.doubleclick.net","address":"172.217.22.130","ttl":21599,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"1996-01-16T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"reddit.com","address":"151.101.193.140","ttl":48,"country":"United States","registrar_name":"GANDI SAS","registrar_organization":"Reddit Inc","registrar_name_servers":"NS-1029.AWSDNS-00.ORG","registrar_creation_date":"2005-04-29T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"ocsp.rootg2.amazontrust.com","address":"52.85.74.237","ttl":59,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Amazon Trust Services LLC","registrar_creation_date":"2007-05-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"ocsp.rootca1.amazontrust.com","address":"52.85.74.18","ttl":59,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Amazon Trust Services LLC","registrar_creation_date":"2007-05-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"ocsp.pki.goog","address":"216.58.204.142","ttl":3328,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"o.ss2.us","address":"52.85.74.218","ttl":59,"country":"United States","registrar_name_servers":"NS-19.AWSDNS-02.COM","registrar_creation_date":"2015-04-16T18:03:31+00:00","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"crl.rootca1.amazontrust.com","address":"52.85.74.39","ttl":59,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"domain":"c.amazon-adsystem.com","address":"54.192.9.38","ttl":159,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"b.thumbs.redditmedia.com","address":"151.101.121.140","ttl":251,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"adservice.google.fr","address":"216.58.209.226","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"domain":"a.thumbs.redditmedia.com","address":"151.101.121.140","ttl":129,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"aax.amazon-adsystem.com","address":"52.94.210.45","ttl":140,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Amazon Technologies, Inc.","registrar_creation_date":"2011-09-16T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"aaxdetect.com","address":"104.103.8.178","ttl":2383,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"ad.turn.com","address":"69.194.244.11","ttl":264,"country":"United States","registrar_name":"NETWORK SOLUTIONS, LLC.","registrar_name_servers":"ASIA3.AKAM.NET","registrar_creation_date":"1995-03-31T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"ads.pubmatic.com","address":"184.26.101.28","ttl":561,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"ads.yahoo.com","address":"67.195.229.45","ttl":15113,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Yahoo! Inc.","registrar_creation_date":"1995-01-18T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"alb.reddit.com","address":"34.230.171.33","ttl":30,"country":"United States","registrar_name":"GANDI SAS","registrar_organization":"Reddit Inc","registrar_name_servers":"NS-1029.AWSDNS-00.ORG","registrar_creation_date":"2005-04-29T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"c.aaxads.com","address":"184.84.70.100","ttl":112,"country":"United States","registrar_name":"PDR Ltd. d/b/a PublicDomainRegistry.com","registrar_organization":"AAX, LLC","registrar_creation_date":"2017-10-25T13:59:44+00:00","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"cdn.digitru.st","ttl":3599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"cm.g.doubleclick.net","address":"216.58.193.130","ttl":21599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"eus.rubiconproject.com","address":"23.203.254.15","ttl":909,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"fonts.googleapis.com","address":"172.217.9.170","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"fonts.gstatic.com","address":"216.58.194.35","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"googleads.g.doubleclick.net","address":"172.217.12.66","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"i.w55c.net","address":"52.89.157.88","ttl":14,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"ib.adnxs.com","address":"104.254.150.13","ttl":10904,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"id.rlcdn.com","address":"34.95.92.78","ttl":35,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"},{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"domain":"idsync.rlcdn.com","address":"52.71.117.196","ttl":46,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"image2.pubmatic.com","address":"204.237.133.83","ttl":280,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"image4.pubmatic.com","address":"104.36.113.24","ttl":104,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"image6.pubmatic.com","address":"104.36.113.23","ttl":114,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"l.aaxads.com","address":"184.84.70.100","ttl":95,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"match.adsrvr.org","address":"54.164.162.72","ttl":3764,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"ocsp.comodoca4.com","address":"204.237.142.187","ttl":773,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"ocsp.godaddy.com","address":"72.167.18.239","ttl":3,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"ocsp.sca1b.amazontrust.com","address":"99.84.170.184","ttl":59,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"ocsp.trust-provider.com","address":"91.199.212.49","ttl":672,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"ocsp.trustwave.com","address":"204.237.142.56","ttl":46,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"p.adsymptotic.com","address":"104.18.98.194","ttl":136,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"p.rfihub.com","address":"205.210.187.129","ttl":278,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"pippio.com","address":"107.178.254.65","ttl":2131,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"pixel-us-east.rubiconproject.com","address":"8.43.72.97","ttl":2945,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"pixel.advertising.com","address":"34.226.168.60","ttl":136,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"pixel.quantserve.com","address":"192.184.69.205","ttl":215,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"pixel.rubiconproject.com","address":"8.39.36.142","ttl":317,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"pr-bh.ybp.yahoo.com","address":"74.6.34.27","ttl":105,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"prospect-cm.dsp.linksynergy.com","address":"52.205.114.175","ttl":126,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"px.moatads.com","address":"23.76.194.56","ttl":295,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"rules.quantcount.com","address":"52.85.209.240","ttl":3227,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"s.amazon-adsystem.com","address":"52.46.130.13","ttl":13,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"sb.scorecardresearch.com","address":"23.77.88.53","ttl":2969,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"secure-assets.rubiconproject.com","address":"104.112.74.161","ttl":2836,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"secure.quantserve.com","address":"192.184.69.196","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"simage2.pubmatic.com","address":"104.36.113.17","ttl":235,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"simage4.pubmatic.com","address":"104.36.113.24","ttl":96,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"status.thawte.com","address":"72.21.91.29","ttl":756,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"sync-tm.everesttech.net","address":"151.101.194.49","ttl":4194,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"sync.mathtag.com","address":"216.200.232.172","ttl":888,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"token.rubiconproject.com","address":"8.39.36.173","ttl":1359,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"tpc.googlesyndication.com","address":"172.217.1.225","ttl":21599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"us-u.openx.net","address":"173.241.244.143","ttl":599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"www.googleadservices.com","address":"216.58.193.130","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"www.redditmedia.com","address":"151.101.1.140","ttl":75,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"z.moatads.com","address":"23.76.194.56","ttl":18382,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"domain":"external-preview.redd.it","address":"151.101.1.140","ttl":47,"country":"United States","registrar_organization":"Corporation Service Company France","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"domain":"gateway.reddit.com","address":"151.101.1.140","ttl":5783,"country":"United States","registrar_name":"GANDI SAS","registrar_organization":"Reddit Inc","registrar_name_servers":"NS-1029.AWSDNS-00.ORG","registrar_creation_date":"2005-04-29T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"domain":"gql.reddit.com","address":"151.101.1.140","ttl":291,"country":"United States","registrar_name":"GANDI SAS","registrar_organization":"Reddit Inc","registrar_name_servers":"NS-1029.AWSDNS-00.ORG","registrar_creation_date":"2005-04-29T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"domain":"styles.redditmedia.com","address":"151.101.1.140","ttl":167,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Reddit Inc.","registrar_name_servers":"NS-1340.AWSDNS-39.ORG","registrar_creation_date":"2007-08-13T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"domain":"v.redd.it","address":"151.101.1.140","ttl":113,"country":"United States","registrar_organization":"Corporation Service Company France","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"domain":"arc.msn.com","ttl":19384,"country":"-","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Microsoft Corporation","registrar_name_servers":"NS1.MSFT.NET","registrar_creation_date":"1994-11-10T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"domain":"clients2.google.com","address":"142.250.189.174","ttl":201,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"1997-09-15T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"domain":"clients2.googleusercontent.com","address":"142.251.46.161","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"2008-11-17T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"domain":"w3-reporting-nel.reddit.com","address":"151.101.1.140","ttl":6877,"country":"United States","registrar_name":"GANDI SAS","registrar_organization":"Reddit Inc","registrar_name_servers":"NS-1029.AWSDNS-00.ORG","registrar_creation_date":"2005-04-29T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"domain":"w3-reporting.reddit.com","address":"151.101.1.140","ttl":6900,"country":"United States","registrar_name":"GANDI SAS","registrar_organization":"Reddit Inc","registrar_name_servers":"NS-1029.AWSDNS-00.ORG","registrar_creation_date":"2005-04-29T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]}],"http_requests":[{"host":"o.ss2.us","host_ip":"52.85.74.218:80","url":"//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: o.ss2.us","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"host":"ocsp.rootg2.amazontrust.com","host_ip":"52.85.74.237:80","url":"/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.rootg2.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"host":"crl.rootca1.amazontrust.com","host_ip":"52.85.74.39:80","url":"/rootca1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /rootca1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.rootca1.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"host":"ocsp.rootca1.amazontrust.com","host_ip":"52.85.74.18:80","url":"/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.rootca1.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.1.35:80","url":"/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D","method":"GET","header":"GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.1.35:80","url":"/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D","method":"GET","header":"GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.1.35:80","url":"/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D","method":"GET","header":"GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"host":"ocsp.sca1b.amazontrust.com","host_ip":"99.84.170.184:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAO8BQ5i4wmoRlXauPStAtM%3D","method":"GET","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAO8BQ5i4wmoRlXauPStAtM%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.sca1b.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.1.35:80","url":"/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D","method":"GET","header":"GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.1.35:80","url":"/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEAGsN8YyQaMyf3xonowaSxk%3D","method":"GET","header":"GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEAGsN8YyQaMyf3xonowaSxk%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.1.35:80","url":"/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D","method":"GET","header":"GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"host":"ocsp.godaddy.com","host_ip":"72.167.18.239:80","url":"//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D","method":"GET","header":"GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.1.35:80","url":"/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEFrFzUXr8QDm7D1M86cFiY%3D","method":"GET","header":"GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEFrFzUXr8QDm7D1M86cFiY%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"host":"ocsp.godaddy.com","host_ip":"72.167.18.239:80","url":"//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D","method":"GET","header":"GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"host":"ocsp.godaddy.com","host_ip":"72.167.18.239:80","url":"//MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCAFF31cf%2FL7G","method":"GET","header":"GET //MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCAFF31cf%2FL7G HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.1.35:80","url":"/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D","method":"GET","header":"GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"host":"ocsp.trustwave.com","host_ip":"204.237.142.56:80","url":"/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQ1mI4Ww4R5LZiQ295pj4OF%2F44yyAQUyk7dWyc1Kdn27sPlU%2B%2BkwBmWHa8CEQCSuHRPcc7Q4mxyo9jV2SWy","method":"GET","header":"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQ1mI4Ww4R5LZiQ295pj4OF%2F44yyAQUyk7dWyc1Kdn27sPlU%2B%2BkwBmWHa8CEQCSuHRPcc7Q4mxyo9jV2SWy HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.trustwave.com","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"host":"ocsp.trustwave.com","host_ip":"204.237.142.56:80","url":"//MFQwUjBQME4wTDAJBgUrDgMCGgUABBRKUAJ27jxxuy1zYtpUHfLy0MHHugQUys4dGAN3HhzzfFiymnCoCIAW9K4CEwarM81FRJBKpx5TRPzrMY8Wu%2FM%3D","method":"GET","header":"GET //MFQwUjBQME4wTDAJBgUrDgMCGgUABBRKUAJ27jxxuy1zYtpUHfLy0MHHugQUys4dGAN3HhzzfFiymnCoCIAW9K4CEwarM81FRJBKpx5TRPzrMY8Wu%2FM%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.trustwave.com","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"host":"ocsp.trust-provider.com","host_ip":"91.199.212.49:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj%2F6qJAfE5%2Fj9OXBRE4%3D","method":"GET","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj%2F6qJAfE5%2Fj9OXBRE4%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.trust-provider.com","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"host":"ocsp.comodoca4.com","host_ip":"204.237.142.187:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0%3D","method":"GET","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.comodoca4.com","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"host":"ocsp.sca1b.amazontrust.com","host_ip":"99.84.170.184:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAxPufE7Id7g9N2JgRqa6As%3D","method":"GET","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAxPufE7Id7g9N2JgRqa6As%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.sca1b.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}],"processes":[{"pid":8308,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00008308","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB8UlEQVR4Xu2TO0vDUBiGXUVBZydBNwfBwX/gDxGcXAKKFxBE1HoDUVddXRxExNHFa71UrdZSbZPGNDVJY2/qIhbkNadqrDmHctKIOPSFh4Yczvs9OUlrav5jhgf6MTxYIdZeQRDg7HQVUlQoFCqC7B0fG/Em4VVATSjeJLwKkF9PEr8h4EnitwQIFUk4S9zA2utaglXCy+z0JP3X/GTIwjmLGS8C5SC9zlnMVAWqAlWBqsCfCpjmM1LpJxiEh0foFpqZL3KfyiFp5KAaWSR0Cy2DTPaZKuaFKUCGuklcTVPFvDAFyJO6iaiYVDEvTAFyvKV5en1D14aBzjW9SMfqPXq3H+z1qJyiinlhCijWe3Vm9DgPYTeDlpUEGhdltC0r9lpE0qliXpgCcjJdMvo7M0c5NMxLaFqQ0LoUt++HYxpVzAtTQEyYJWM/Mu3PoX5OxNRBFt3rGprnYvZa6DZJFfPCFIjepUpGA1OHWdTNxODb+3g1wpaB9iXJXg9GVKqYF6ZAJK7b5b79DGp9UUzu/vwu8i9v9vV5WKGKeWEKhEXNLu/ZNDCxw/4mvnIauqOKeWEKhKJJ54yyOb6UqWJemALBG9U5o2z8F1KxqCIG+miBgHWkZ9cKAgTrmhzxyZVcfNKjYBx+gjX08JODgEiXeMg7c/ehsUO96z4AAAAASUVORK5CYII="},{"pid":3940,"ppid":8308,"name":"MsiExec.exe","command_line":"-Embedding 56B49CBB569923AB6062861FF3CD3492","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\System32\\MsiExec.exe","parent_uid":"00000000-00008308","uid":"00000000-00003940"},{"pid":8432,"ppid":8308,"name":"MsiExec.exe","command_line":"-Embedding 1A19048CCEED81AC26270CBB93276729","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\System32\\MsiExec.exe","parent_uid":"00000000-00008308","uid":"00000000-00008432"},{"pid":8844,"ppid":8308,"name":"MsiExec.exe","command_line":"-Embedding 5D2F934EDBF7C3EC891B33A22DDE871F E Global\\MSI0000","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\System32\\MsiExec.exe","parent_uid":"00000000-00008308","uid":"00000000-00008844"},{"pid":9064,"ppid":8308,"name":"MSI1A99.tmp","command_line":"/b 2 300 0","sha256":"22be8934cb869d87fc18901ec5a8774b9fd654910d0cce1e5350e1cca843bc2c","normalized_path":"%WINDIR%\\Installer\\MSI1A99.tmp","parent_uid":"00000000-00008308","uid":"00000000-00009064"},{"pid":8700,"ppid":8308,"name":"MsiExec.exe","command_line":"-Embedding 61CE387649E170749E603292072900C9 E Global\\MSI0000","sha256":"04de630d6f6cd8888597b55581032d01d6b6f1c26e106e7aae40ce6f2374d865","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00008308","uid":"00000000-00008700"},{"pid":4924,"ppid":8308,"name":"SingleClientServicesUpdater.exe","command_line":"23.008.20458 --SingleClientApp","sha256":"2284808a6bbb87dd5ac6e7da421ff4e11903dc4e792c414e6e1cfc8336671a43","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\AcroCEF\\SingleClientServicesUpdater.exe","parent_uid":"00000000-00008308","uid":"00000000-00004924"},{"pid":6500,"ppid":4924,"name":"SingleClientServicesUpdater.exe","command_line":"--postMsg","sha256":"2284808a6bbb87dd5ac6e7da421ff4e11903dc4e792c414e6e1cfc8336671a43","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\AcroCEF\\SingleClientServicesUpdater.exe","parent_uid":"00000000-00004924","uid":"00000000-00006500"},{"pid":5980,"ppid":0,"name":"rundll32.exe","command_line":"\"%WINDIR%\\System32\\ieframe.dll\",OpenURL C:\\sample.url","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00005980","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB8UlEQVR4Xu2TO0vDUBiGXUVBZydBNwfBwX/gDxGcXAKKFxBE1HoDUVddXRxExNHFa71UrdZSbZPGNDVJY2/qIhbkNadqrDmHctKIOPSFh4Yczvs9OUlrav5jhgf6MTxYIdZeQRDg7HQVUlQoFCqC7B0fG/Em4VVATSjeJLwKkF9PEr8h4EnitwQIFUk4S9zA2utaglXCy+z0JP3X/GTIwjmLGS8C5SC9zlnMVAWqAlWBqsCfCpjmM1LpJxiEh0foFpqZL3KfyiFp5KAaWSR0Cy2DTPaZKuaFKUCGuklcTVPFvDAFyJO6iaiYVDEvTAFyvKV5en1D14aBzjW9SMfqPXq3H+z1qJyiinlhCijWe3Vm9DgPYTeDlpUEGhdltC0r9lpE0qliXpgCcjJdMvo7M0c5NMxLaFqQ0LoUt++HYxpVzAtTQEyYJWM/Mu3PoX5OxNRBFt3rGprnYvZa6DZJFfPCFIjepUpGA1OHWdTNxODb+3g1wpaB9iXJXg9GVKqYF6ZAJK7b5b79DGp9UUzu/vwu8i9v9vV5WKGKeWEKhEXNLu/ZNDCxw/4mvnIauqOKeWEKhKJJ54yyOb6UqWJemALBG9U5o2z8F1KxqCIG+miBgHWkZ9cKAgTrmhzxyZVcfNKjYBx+gjX08JODgEiXeMg7c/ehsUO96z4AAAAASUVORK5CYII="},{"pid":8348,"ppid":5980,"name":"msedge.exe","command_line":"--single-argument https://www.reddit.com/","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005980","uid":"00000000-00008348"},{"pid":8956,"ppid":8348,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=119.0.6045.123 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=119.0.2151.58 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e4,0x344,0x7ff92c062030,0x7ff92c062040,0x7ff92c062050","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00008956"},{"pid":8952,"ppid":8348,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2044 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:2","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00008952"},{"pid":5468,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3556 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:3","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00005468"},{"pid":7404,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4284 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00007404"},{"pid":7136,"ppid":8348,"name":"msedge.exe","command_line":"--type=renderer --disable-nacl --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1704559312927556 --launch-time-ticks=1039444685 --mojo-platform-channel-handle=4456 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:1","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00007136"},{"pid":4568,"ppid":8348,"name":"msedge.exe","command_line":"--type=renderer --disable-nacl --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1704559312927556 --launch-time-ticks=1039666727 --mojo-platform-channel-handle=4536 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:1","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00004568"},{"pid":5420,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4804 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00005420"},{"pid":8532,"ppid":8348,"name":"msedge.exe","command_line":"--type=renderer --extension-process --renderer-sub-type=extension --disable-nacl --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --time-ticks-at-unix-epoch=-1704559312927556 --launch-time-ticks=1040129092 --mojo-platform-channel-handle=5008 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:1","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00008532"},{"pid":8020,"ppid":8348,"name":"msedge.exe","command_line":"--type=renderer --extension-process --renderer-sub-type=extension --disable-nacl --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --time-ticks-at-unix-epoch=-1704559312927556 --launch-time-ticks=1040429054 --mojo-platform-channel-handle=5148 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:1","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00008020"},{"pid":7708,"ppid":8348,"name":"msedge.exe","command_line":"--type=renderer --extension-process --renderer-sub-type=extension --disable-nacl --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --time-ticks-at-unix-epoch=-1704559312927556 --launch-time-ticks=1040873465 --mojo-platform-channel-handle=5496 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:1","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00007708"},{"pid":2128,"ppid":8348,"name":"msedge.exe","command_line":"--type=renderer --extension-process --renderer-sub-type=extension --disable-nacl --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --time-ticks-at-unix-epoch=-1704559312927556 --launch-time-ticks=1041108346 --mojo-platform-channel-handle=5532 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:1","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00002128"},{"pid":8324,"ppid":8348,"name":"msedge.exe","command_line":"--type=renderer --extension-process --renderer-sub-type=extension --disable-nacl --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --time-ticks-at-unix-epoch=-1704559312927556 --launch-time-ticks=1041341287 --mojo-platform-channel-handle=5620 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:1","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00008324"},{"pid":7364,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5644 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00007364"},{"pid":1680,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6232 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00001680"},{"pid":8580,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6520 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00008580"},{"pid":3952,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6568 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00003952"},{"pid":4672,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7120 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00004672"},{"pid":2616,"ppid":8348,"name":"msedge.exe","command_line":"--type=renderer --disable-nacl --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --time-ticks-at-unix-epoch=-1704559312927556 --launch-time-ticks=1050327897 --mojo-platform-channel-handle=7304 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:1","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00002616"},{"pid":2276,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7468 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00002276"},{"pid":3532,"ppid":8348,"name":"msedge.exe","command_line":"--type=renderer --disable-nacl --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --time-ticks-at-unix-epoch=-1704559312927556 --launch-time-ticks=1051666115 --mojo-platform-channel-handle=7916 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:1","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00003532"},{"pid":4032,"ppid":8348,"name":"msedge.exe","command_line":"--type=renderer --disable-nacl --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --time-ticks-at-unix-epoch=-1704559312927556 --launch-time-ticks=1051981033 --mojo-platform-channel-handle=7972 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:1","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00004032"},{"pid":8564,"ppid":8348,"name":"msedge.exe","command_line":"--type=renderer --disable-nacl --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --time-ticks-at-unix-epoch=-1704559312927556 --launch-time-ticks=1052682126 --mojo-platform-channel-handle=8244 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:1","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00008564"},{"pid":8456,"ppid":8348,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8660 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"881f0ff801abc00409a0a8a0caa604b1ed1c2a76e54a2be6f30d2ce54afceed8","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\119.0.2151.58\\identity_helper.exe","parent_uid":"00000000-00008348","uid":"00000000-00008456"},{"pid":5996,"ppid":8348,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8660 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"881f0ff801abc00409a0a8a0caa604b1ed1c2a76e54a2be6f30d2ce54afceed8","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\119.0.2151.58\\identity_helper.exe","parent_uid":"00000000-00008348","uid":"00000000-00005996"},{"pid":9092,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7084 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00009092"},{"pid":8560,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5140 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00008560"},{"pid":3404,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4980 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00003404"},{"pid":3204,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4920 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00003204"},{"pid":7268,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7236 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00007268"},{"pid":6592,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4476 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00006592"},{"pid":5260,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00005260"},{"pid":2376,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8576 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00002376"},{"pid":3604,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6240 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00003604"},{"pid":716,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=8568 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00000716"},{"pid":3872,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5476 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00003872"},{"pid":3168,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5428 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00003168"},{"pid":4444,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6412 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00004444"},{"pid":1792,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6892 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00001792"},{"pid":4208,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=8616 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00004208"},{"pid":3224,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6620 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00003224"},{"pid":8492,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2648 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00008492"},{"pid":2684,"ppid":8348,"name":"msedge.exe","command_line":"--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22621.1194 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=6612 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:2","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00002684"},{"pid":984,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6468 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00000984"},{"pid":8996,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6160 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00008996"},{"pid":7528,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6896 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00007528"},{"pid":7520,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6556 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00007520"},{"pid":7156,"ppid":8348,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6476 --field-trial-handle=2000,i,272429453563891125,16195776986391938196,262144 /prefetch:8","sha256":"4add69ca218fe536c80c54176ee9c12b9c877a797b44c2af9b6142dc69ef8d95","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008348","uid":"00000000-00007156"}],"all_imported_dlls":["mlang.dll","credssp.dll","cabinet.dll","jp2ssv.dll","jscript.dll","cryptsp.dll","mswsock.dll","dhcpcsvc6.dll","msvcr90.dll","MSOHEV.DLL","nsi.dll","secur32.dll","deploy.dll","ONBttnIE.dll","ssv.dll","clbcatq.dll","FWPUCLNT.DLL","urlmon.dll","rasman.dll","sspicli.dll","profapi.dll","user32.dll","shell32.dll","comctl32.dll","apphelp.dll","rasapi32.dll","propsys.dll","msvcr100.dll","mshtml.dll","usp10.dll","shlwapi.dll","IPHLPAPI.DLL","npmproxy.dll","cryptnet.dll","IEShims.dll","ws2_32.dll","nlaapi.dll","ieframe.dll","wship6.dll","xmllite.dll","bcrypt.dll","bcryptprimitives.dll","imagehlp.dll","msimg32.dll","msxml3r.dll","SensApi.dll","msasn1.dll","psapi.dll","kernel32.dll","KernelBase.dll","msimtf.dll","pngfilt.dll","msvcrt.dll","dwmapi.dll","rtutils.dll","pnrpnsp.dll","URLREDIR.DLL","iertutil.dll","Wldap32.dll","version.dll","ExplorerFrame.dll","wintrust.dll","RpcRtRemote.dll","comdlg32.dll","ONBTTN~1.DLL","netprofm.dll","webio.dll","dnsapi.dll","WSHTCPIP.DLL","oleaccrc.dll","sqmapi.dll","url.dll","setupapi.dll","oleaut32.dll","rsaenh.dll","imm32.dll","winnsi.dll","NapiNSP.dll","sxs.dll","gpapi.dll","rpcss.dll","ole32.dll","devobj.dll","oleacc.dll","ieui.dll","normaliz.dll","dhcpcsvc.dll","winhttp.dll","tzres.dll","winrnr.dll","userenv.dll","devrtl.dll","cryptbase.dll","dui70.dll","ncrypt.dll","rpcrt4.dll","msctf.dll","ntmarta.dll","imgutil.dll","GdiPlus.dll","advapi32.dll","msxml3.dll","sechost.dll","gdi32.dll","cfgmgr32.dll","duser.dll","schannel.dll","iecompat.dll","iepeers.dll","wininet.dll","crypt32.dll","rasadhlp.dll","MSOXMLMF.DLL","msls31.dll","uxtheme.dll","msfeeds.dll","lpk.dll","ieproxy.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","wshqos.dll","AcroPDF.dll","msdart.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","msvcr120.dll","npctrl.dll","wow64win.dll","winmm.dll","samcli.dll","powrprof.dll","mscorwks.dll","netapi32.dll","d3d10warp.dll","scrrun.dll","AcroPDFImpl.dll","MMDevAPI.dll","D3DCompiler_47.dll","jscript9.dll","agcore.dll","wkscli.dll","VxSSL64.dll","Control.dll","wmp.dll","dinput8.dll","DWrite.dll","msado15.dll","mscms.dll","mscoree.dll","mscoreei.dll","WindowsCodecs.dll","msvcp120.dll","wmploc.DLL","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","netutils.dll","dsound.dll","api-ms-win-downlevel-version-l1-1-0.dll","wow64.dll","wow64cpu.dll","d3d11.dll","mpr.dll","SwDir_1231201.dll","d2d1.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","dxgi.dll","jsIntl.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","srvcli.dll","atl.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","Windows.Networking.Connectivity.dll","msmpeg2vdec.dll","gdi32full.dll","DataExchange.dll","telclient.dll","AudioSes.dll","directmanipulation.dll","ffmpeg.dll","mfsensorgroup.dll","wlanapi.dll","fwpolicyiomgr.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","dbghelp.dll","mfperfhelper.dll","libGLESv2.dll","twinapi.appcore.dll","dpapi.dll","msvcp_win.dll","Windows.Security.Authentication.OnlineId.dll","WinTypes.dll","dsreg.dll","mfplat.dll","vulkan-1.dll","avrt.dll","OneCoreCommonProxyStub.dll","Windows.Web.dll","fwbase.dll","oneds.dll","Windows.Security.Authentication.Web.Core.dll","ResourcePolicyClient.dll","mf.dll","rmclient.dll","ntasn1.dll","OneCoreUAPCommonProxyStub.dll","combase.dll","CoreUIComponents.dll","dcomp.dll","FirewallAPI.dll","d3dcompiler_47.dll","BitsProxy.dll","dmcmnutils.dll","wldp.dll","msedge.dll","edputil.dll","ucrtbase.dll","tbs.dll","UIAutomationCore.dll","Windows.UI.dll","winsta.dll","msvcp110_win.dll","CoreMessaging.dll","RTWorkQ.dll","aepic.dll","msvproc.dll","CompPkgSup.dll","vk_swiftshader.dll","SHCore.dll","microsoft_apis.dll","actxprxy.dll","fltLib.dll","wtsapi32.dll","atlthunk.dll","vaultcli.dll","libEGL.dll","twinapi.dll","dxva2.dll","winmmbase.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","srumapi.dll","win32u.dll","windows.storage.dll","Windows.Media.dll","linkinfo.dll","PCPKsp.dll","D3D12.dll","kernel.appcore.dll","onramp.dll","DolbyDecMFT.dll","dxilconv.dll","msedge_elf.dll","KBDUS.DLL","mdmregistration.dll","cldapi.dll","TextInputFramework.dll","wpnapps.dll","windowsudk.shellcommon.dll","Windows.StateRepositoryClient.dll","Windows.StateRepositoryPS.dll","StartTileData.dll","Windows.System.Profile.RetailInfo.dll","mobilenetworking.dll","Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient.dll","capauthz.dll","TenantRestrictionsPlugin.dll","Windows.System.Launcher.dll","aadWamExtension.dll","execmodelproxy.dll","ServicingCommon.dll","omadmapi.dll","slc.dll","CorePrivacySettingsStore.dll","dxil.dll","AcLayers.dll","AssignedAccessRuntime.dll","directxdatabasehelper.dll","onnxruntime.dll","usermgrcli.dll","dxcompiler.dll","wscapi.dll","vcruntime140_1.dll","umpdc.dll","msi.dll","msIso.dll","policymanager.dll","StartMenu.dll","Windows.Storage.ApplicationData.dll","nlansp_c.dll","InputHost.dll","Windows.ApplicationModel.dll","Windows.StateRepositoryCore.dll","vcruntime140_app.dll","Windows.Devices.Sensors.dll","msvcp140.dll","ntdll.dll","wevtapi.dll","pcacli.dll","sfc_os.dll","DXCore.dll","biwinrt.dll","CryptoWinRT.dll","vcruntime140_1_app.dll","libsmartscreenn.dll","ncryptprov.dll","TileDataRepository.dll","Windows.StateRepository.dll","Windows.Internal.Shell.Broker.dll","msvcp140_app.dll","dusmapi.dll","AppXDeploymentClient.dll","StateRepository.Core.dll","DiagnosticDataSettings.dll","UserMgrProxy.dll","vcruntime140.dll","ExecModelClient.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"pspubws@reddit[1].txt","sha256":"653d658a3b7311e854751117fbd6147fd4b6eeefd3a86d74544932811cdc3a45","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"pspubws@reddit[2].txt","sha256":"1083314338fb1840ff1e348a2dc74e070a061e2ded7bc88dacae37d5f49bdf0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"RecoveryStore.{BDC8E593-8AC3-11E8-9C42-0A002745DB77}.dat","sha256":"61a2006747217925aedb0240194736ba417e25546bf6ca0133a6a7e0364df5f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"{BDC8E594-8AC3-11E8-9C42-0A002745DB77}.dat","sha256":"0206005b34d96b489d394b54b3aa51a8d0e6ab5fdb11a7ffc428ede587633c60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"3ZfYo3IO5Uz2QGPU7uOcD6Mhhusp6oYLsQcMPcY8tJg[1].jpg","sha256":"0dec72047f4e97860fe97df8b0dbf53a9d87e04618ca889166090d73b2ab68a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"6WJUgBR8z0EvkSUEUWMSOWWr2ggLLrmSuxoCRkTRsJs[1].jpg","sha256":"9a975b61fb0df1f31186a0dcdcd7b6541e07a712f30611568180bb5e23d2b7cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"7FBmr-G-w9q86qP8at-6gxnuokkrxI2qA3YqNohmcto[1].jpg","sha256":"b781e6beca0838a561bf506818d30d86631c8ef19b3aa134f4f7d538b28d783c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"OpTkpCem_D3ak9OONIU18JpawaQKroI7r3yLIBvVDYE[1].jpg","sha256":"5f70c89bca0524317bc4c15353d61d6e5a62bdb082d7193cdf1b370bb02573a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"afN182JJH_AiL841_wOJtkOjrUNYA8bv0HuOzgjzxyQ[1].jpg","sha256":"c5e743f66c9f4c6f46b8bdb44bd9bcfae2c2eae70418278e0d743f9c6bf38a0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"droparrowgray[1].gif","sha256":"83338b42e6ead92b9292d520191bacc85129abfc46d7f3666ede13e42fd417b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"f[1].txt","sha256":"0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"f[2].txt","sha256":"0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"inpage_linkid[1].js","sha256":"989a73eb9e9faa5bcf87eb500ba218549b0b1ef37dc53d9ac948b33010bd78da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"pixel[1].png","sha256":"ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"qjcn2GliwqInRRB-WRF-PcZFe6aJksC32yT-SUbS_-U[1].jpg","sha256":"ad1e0c02df6b2fde0499de7afa33ea9e2640f66a81bb55cc8a35482b8d730371","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"reddit-init-legacy.en-us.tObaCgryyuc[1].js","sha256":"9595dd4b583b0fe56e33d7544d4ccf7f7672f7f935bdf7d7004cbec335a6cc00","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"reddit_com[1].htm","sha256":"2c28d42c34561b01e6ed70d358e52e316d1898916dfa39ddfd3eb036cc13c64c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"reddit_com[1].txt","sha256":"5ef1617ef4c269bf77f1c9ff5b4381c0ff0f09f10f0c8161fe4f12bbd2a71f19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"videoplayer.gJEaOQ_ircg[1].js","sha256":"a9fbc99b790205a22f90015d88198ec7b6038f8241a5124b83484f2ee7d8a428","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"yMbZHCQlVvvHmUo2ZiqaLpGO9lcZO8TB0ydonQ7HloQ[1].jpg","sha256":"9abc5db763a1260e3da07644a9c66bcf2310e02c26f342edab52b6f73783a9ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"2ObI2rSkBNUvBq_T2V8UeUXkhCSYQS72erd2LoIy2kQ[1].jpg","sha256":"0b1f2d17e778b470ef2bb4ac37510fb8d2fe59b34eae9c680f1d31bad2c460d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"LtB8qNdDvMoGMi4vtIJP5qIivsCtf6Axo_BxGwvdrcA[1].jpg","sha256":"e2e4538ceaee513063b05192b976c9f15ba7cb6bdc119e50bf7226a4cb08b82f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"TgTGk2sBoAI4ea2YQY5itamJ-q7mQqQuEiq73mKjG-k[1].jpg","sha256":"67ee85f2d946665f49bb59ee43e4171014aef4403aa5a3defa5290d5d2577889","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"aTpgWe0fSc1z957WQFpBVDvRBakL9BJCsfDOXHQuzUQ[1].jpg","sha256":"305ce04fea5b8f05f539e890aff8a55bf1b81fb3d89af6ca8362e9f2c15be133","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"analytics[1].js","sha256":"3fab1c883847e4b5a02f3749a9f4d9eab15cd4765873d3b2904a1a4c8755fba3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"desktoponboarding.tyCk8A5m9n8[1].css","sha256":"a1dc8a7f912eed10619d8918eb6eed851f0298989b6ad6b05bdd0cc9854012a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"fB4XONq_LQdlcRY7tWn2rGQmh9Tzq4LHQfeZHFeRE1M[1].jpg","sha256":"f468344912435884c87988ccf775a50554d927a2e2151e811f18445686e8b2e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"goldvertisement-gold[1].png","sha256":"1cafe845f36d597add6b1894d33701d8ab973179b45b05946b56d1c68b8c5552","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"goldvertisement-logo[1].png","sha256":"b3ff496834266249d87bf73e0390114da58ca850bcb39b92c92916c2f2a0ecce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"gpt[1].js","sha256":"db210e5b26d436cddd27f9323c9f921c8a6a69ddd345bb2a88243e2efe3fa89a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"known_providers_download_v1[1].xml","sha256":"1e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"moatframe[1].js","sha256":"4db4605a16e0b2cd25dffa44a71c4af1f2707e3741a5446915a2b13782778374","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"oZfgWaDBWkAF8rp5RKGVm4tMx9SlGBFmNEdOt40rLug[1].jpg","sha256":"d1b0ec98a0da52e45d4e96c38b707469b9900ca698413f396645b2ef1ee94b00","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"sprite-reddit.bTLvdEETokI[1].png","sha256":"113c13671e8512ae404ad360c47998701c6e8f823257d82f9adfdff4d59657e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"videoplayercontrols.a_TwaTy76-k[1].css","sha256":"2726f92ed75ce614ff705d8fa6dc63c8454a75ae533cf54d629e735bd583d235","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"5VjZuXDSyuhpqfKaJBL-0bMavu6OK4qsH6aoFsY3lw4[1].jpg","sha256":"d60ea61f67205dcc3ed0be734f4fc9000083b269385fc022172808673be8ec42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"DWuJN8OQHxkP0rbNoe1Lm6C-mZkQ5J0NEfP8-Fdy278[1].jpg","sha256":"d2dc851f4246e093245431734ca2e2329b33e238c46fc93e577316a4a893ba79","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"E3eC_XbsFnBdU59-hsMyL3BX_K-uJc_M2fo7SwNV1Fo[1].jpg","sha256":"15bce55b93dc6319d30883052f0e0d9a20018d62d70da137a4db7ea82bc2b3b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"ZE4HFQDgmRH6XbBvq3wKsHvrYZkTiX_UVbG9xE1bvx4[1].jpg","sha256":"dd250ea06a16808e5eb028c5d638cebc9ddb6ee708f88aa174a5f0a58ff1025f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"apstag[1].js","sha256":"384e30e2bb474d8d51182cb3d58d22c74a950447633126cea40d2225914fa35b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"author-tooltip.uiV1oYrKgxk[1].css","sha256":"5a09d0cfee95b2d5ca66acb4783f2e6ee4f233b29fdec55043701c972414bc7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"expando.gMzRK16vwrQ[1].css","sha256":"2f9d380cf7fdd5fcf8dfe047f977ad86ee594aa964aaef5438361ccaf420a100","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"favicon[1].ico","sha256":"6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"favicon[2].ico","sha256":"5e31f0c49736e0f32e62d4cdcfc9948b966da1285ab1140879e14dc6413fc7a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"goldvertisement-gild[1].png","sha256":"f79f6e0d3c37015f5bf59da58b7a0acdf074ffcaa60071651a7f86fa55205c3e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"iWaTHXXj_qZv8cjKkDHKzS0wNdd3-b7RsCuLfhcKgC8[1].jpg","sha256":"bda15d9f5c019d5bb16ccfbc0e89b8a442733246d56c3ff8252aa4b3b26cbbeb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"popup-notification.6-JvPBpHWMo[1].css","sha256":"e8dd3ba85ec61c1ff393affe5b9878b78d87e9f6cbd1214f36272a484d095ae6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"sprite-expando.69EqpDZz3HM[1].png","sha256":"b2ea3ba0a51f000b734296ca7f69c995f03299f77c646c2620b1d33593493bfd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"videoplayer.YbUSlMWPXyg[1].css","sha256":"a1e73a5d1eeead997c18eb148c9cd1d722f235debbf813e183cc8c0032ae2921","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"zkxw7Imi9cUKVUj5CirzGrJIQT_busKHyusqdLlrEek[1].jpg","sha256":"f7d551133df7ce3ff2e5c07b5a96f97cb1bb341b04dc5397e0dcd7e4a21d41dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"0E8ETOSU.txt","sha256":"06c60266a67f53a08d48ef2ebd374cd3d7921fea89c3e10649af55d6fd5e7e26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"0ZJDWV6J.txt","sha256":"eea76dae2acbe2c87857975dab04b0c1d1d77fed85a614dbe8597adec81720ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"154OKWWL.txt","sha256":"57fe63129c93d10565c63669812e8de7c45746560de66cd5fb61449210b17473","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"1MUSINLW.txt","sha256":"d6b9947a4d55321a6868c272469edbf8fd443153d0dc4dfab59a4318886e63b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"1Q3VAIWG.txt","sha256":"b0d1e4871ab96e51997eea801977aab9349faa89ac946613cfd928d0f57a0463","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"27DD7ZK2.txt","sha256":"83b56eea7035092a7f73cf9b1b5dd1b34d6b6e2bc61d87d6d6312037cb3ff07a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"2DWIIUKP.txt","sha256":"159e2e6dcdf68ecdf82278666ccd1c56305c75c787cfefa478b685cfe8a76576","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"2GRGMBJJ.txt","sha256":"af41845b8356c899a9e80fc340da0c390f81785d5eee8f1b4d0761b0a52a6532","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"2S93XLGK.txt","sha256":"a26b5cff21e0a44cf826a864cd7ea86dce632fcadfebea7d4abb56bde75d0c8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"34CKWZRE.txt","sha256":"5f179951d2792935427bf3809696f1642593c00bcff2222a03e77cf4b80f3d03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"36LCSYQB.txt","sha256":"7e25446183c3c820b69ca3598399b7f6250b0270f91f98bf44d569dea66eaf6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"3JW19L7N.txt","sha256":"8c883f4fc2e574c3015596e3e56cdfc16ea6e31ad04fb68cd974d423b41b35d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"3WDD1YUF.txt","sha256":"81fbf61f213e132e359ee5c5438485e0476f1080d9f412579cb8ee0af6cbb293","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"4E93U0HY.txt","sha256":"6011ff33eb4394dbfbc51c0b5b9ef50d99b571e64bb5641c2480d649744dd0e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"4GFIMF0H.txt","sha256":"12422205c7fd05aae86ba04d6effa611c55ff6e5be2359e36be2a0be68c7216a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"4Z2L5ZCJ.txt","sha256":"e9cd069e9725537f90d57afc80ccd6ebe44c90d7379a4d42ddb423adc025eb98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"50OU74L0.txt","sha256":"9a612c761fa49f0d97265b155f4bb85aeaf1728f1efa565d10863e0194738ee9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"59MYA6O9.txt","sha256":"eea76dae2acbe2c87857975dab04b0c1d1d77fed85a614dbe8597adec81720ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"5AZUET4Q.txt","sha256":"eea3d65ec8742703e55769b0056c959d61a05324de833dea10fedc05a24ec71b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"5KG29WUA.txt","sha256":"0c02b19125cfd2c72e89276defa4fa6c482cf55acfa3fa06cef27e44d19ab89d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"5YMXN8MD.txt","sha256":"81fbf61f213e132e359ee5c5438485e0476f1080d9f412579cb8ee0af6cbb293","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"65ANA8J1.txt","sha256":"7b3cb2d26e35dfc6b293e092dee0a163849ef9ac596ebffa2b08e7d6f9989fee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"6IUD5GVI.txt","sha256":"597c307051e97c80db44546e984ca476b787bdbd72ae7d07a6d3bb2323276411","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"6PB8FNAP.txt","sha256":"3ab79b4d6f99eff50fa9b49700c06780d1de8faf48e5b6c40054cf81f6c41736","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"6X0J4504.txt","sha256":"b3281e9865f71ee678c35467c0289a963446e5bbfc587fb7912380d55164fd22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"7EI9O3NG.txt","sha256":"e7cb3d8dd96929e3874b58416902063b8009aec72660449bd4033fc954490d01","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"7G272V22.txt","sha256":"d7ace2b9652f712c0dd1cd4aa24a5ea7bc0bf7255ed0c40848300b73389374ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"7R39G1SL.txt","sha256":"eb281d13f952ca88093993f7edb877724b8955224ffd4b845544a47523dfc7bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"8HK4KQ8W.txt","sha256":"5e8dd11bf5d6613a14cc4a0140af1ee6f124b669c44222483bf4b3dca73427fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"8M6LTJ1B.txt","sha256":"3466ac58c9592f53d57eb0edb09f4803930ef05af4aceffc897edfb136aec184","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"8Z5SKGIE.txt","sha256":"2d4868aaf0ef48a8efa6942d6fd6d1d20e88436f595546dc6ff30f85dc8dc43e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"92203L8A.txt","sha256":"69c063b544b056da4bb3c19fdb7d48c7672da0f14c73d3db4287afd34c411cad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"9OG6KJCX.txt","sha256":"4e5c8732bcd5fb6d2cd6023bcc4d64ebf015e1c67e16116fe941f12c73bf8767","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"9TZEAENL.txt","sha256":"f254703a0fb7a7daa90a32d6f6d02373be0dfa74842e3a2190c7a80cf6a02e51","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"AE8G7CF2.txt","sha256":"5f20f9da29b8e6e10060b528edee1670a790e1dafdb8551f69eaa5b88d498662","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"AVCYSHNU.txt","sha256":"83a67a96fed2acd2b6ea3f8cb968e2e7d6dd3558a7c341dabaa7cd7edaf99e3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"AXPV5YLL.txt","sha256":"86b1cb48e54392eb862bf45b0bc3c3873a7bc04a8580a25465a0c20877903ab7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"AYHOXR4X.txt","sha256":"a1eba93b0e487b4f3bad80fe124247e549ac23900aa022f77697928c9880da94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"BIORZWS2.txt","sha256":"69bea8bbfc5675c0021097af452ed1ac91785c77c6682506795226fe711441f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"BOQQL7GP.txt","sha256":"5adec0c02f1b6c900aba805bb0fb5747f4bf535085ed2ae99d022ed0dc2a9340","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"CBN8DYH8.txt","sha256":"ce91810426f8eb287d21f68ba16c4b5ced6cdee56de72647af6f7b3b36e1d319","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"CIAH3BE7.txt","sha256":"b0713855059b282c98dd32360afc57779d8c104c820b5ff4cb713a62e6c71d9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"CQPND3MM.txt","sha256":"38acf9d6d424c7cdb911d373a59449c297436ee91382394e62e2e50c63487f67","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"CV5T3G55.txt","sha256":"1630c49f3845fa71db50a114575c3e21ef47065576eb507d3fd06f3a3dcf5202","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"CYVMK4JI.txt","sha256":"8122202f743070bb0d31110dda1d89f2b5203c1f8393612a66ef888cd09cd251","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"D1FMFCRY.txt","sha256":"2dfe1e5c6c40bdc1ae9fd60e42cab84ed4c2f47f26833e006a93b310279db167","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"E1ZMWW79.txt","sha256":"cea565ab983817df1fce7c5d7c7f2d8b8f3a502ce2a779845fa2bfcda2735c99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"EKABUF50.txt","sha256":"3ba4c459acd337834eed7890c6fa13bc9c34981febec955c77c42ade6a845e01","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"EL1QDQBV.txt","sha256":"5b69065ec862034f3831255fbd484033128562e068f4985fa9c5653e31ad4adb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"F28GTJSE.txt","sha256":"6a41a56fab89ff0415cf0d85804d605d09a9604a696ed434ba299b2026b275b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"urlref_httpswww.reddit.com","sha256":"e742a380d6d0d39ab3cb081b9669e7069d7a7601162fefcd8cf21bdb731ea5cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"},{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"widevinecdm.dll","sha256":"db695a96adb70d5f6246273f4e6c218b2c44f02b3726c3dee4d56b6428bb0ddf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"7bcc501f-9e1d-489d-8ed9-28a75fa36966.tmp","sha256":"a5adc9c8a9e40ed98f5c42b91143318193b33fc5d83f87e2306cd0162b8e2544","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"7d74ac0e-c84c-4875-9325-65ac2f8bf15c.tmp","sha256":"fa081b4a4ad591cd1b5c9d27f297cdfe355989405f570e2ffe2b8f349e9cf124","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"7f13326e-dc26-4062-a886-7ae41e6f8272.tmp","sha256":"d24f6988a6ad365ed821f54383b646c32b465cd736519c9c6c89a462cc59613e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"898a9ed8-b4ab-47ae-9343-40aa113971b8.tmp","sha256":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"77330c40-2e31-4835-8003-d4ba3d487584.tmp","sha256":"14f956387a44dcb3aba2e7c1dda9df4e34a95ef5a6b236223cfa01464547062f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"manifest.fingerprint","sha256":"34488457957d96c5fbefa0808a1f5e8c6d401ab58313081ebdb11e6551d7dac5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"manifest.json","sha256":"cb012e0b41d8e35b0f2f1a5e101adc754502c6a6956464f89d09498556ce2e5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"crl-set","sha256":"b12dfac860a4892b9cfb33b68a447457ce76142130ce1eee6f6d1e78815aa1b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"settings.dat","sha256":"cd56751d0d27cdfeb2a397e48b9a2f56f9941ef6540e97684d0bf440523739fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"136bf75c-1de2-415d-a2a6-a1223131258f.tmp","sha256":"cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"19356d15-07de-4906-8b5b-933911362263.tmp","sha256":"ad1b289f559daa446bc34d05881b10bc18970580c7979eef9850ecb010dd6476","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"1f3ef862-13de-4824-b510-f99d61e98c12.tmp","sha256":"1d29f101d6184e68501b2b244a759492642606126713e2f0554ab1d6f09fc6cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"5b436bbd-bfe9-4225-8184-07df1bfaaf1a.tmp","sha256":"d3e73b718003d8d653f2d994240c2f3cc5c82cf3d2ee9798e8d0b825c0644472","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"data_0","sha256":"1fadaf375fbd0d1dac5be3a0b6a5855813687a4cf5da99dbd5d120e904c28aa1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"data_1","sha256":"5d6489ca4d5e29828e99132fa3c9d7b2b0b3abe2d2a183d2bb84340c0a13fcf6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"data_2","sha256":"60cefed58c5e6a88803b4e6a88fffa551c09c7883759a0c65987a60a3603cfb8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_00023b","sha256":"35fa86210f5eabe2f73b593123bdd4c6eeb061392f5645eab9a0b05c2792903b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000246","sha256":"1fb4a511a96fa2bfbc2cf700c7f025700b974f4e051e739bd5c6d3388e2b1d2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000247","sha256":"e9a2e7847b72c27d70cfc0690c17e25d2ffea3566e146c8d8df684196b78c773","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_00024a","sha256":"f7548b4cad1d61a09a70ca5cf91a58ed12ed6ec45aef04d126a2b06499d250c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_00024d","sha256":"47d0880913058312bf847a8f2d95af7ed6adc65b0cf0ad9ea166fdd08cfa622d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_00024e","sha256":"05d908bf03e16495eceba0b36457d3d42c6898a4e842b2388624b8bf1ea3ae11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_00024f","sha256":"62b5de32da29990a9ac377d0deece6ca8c3ad2dcaa5b966705dab8c9b215ca13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000251","sha256":"2558aca1b3c360d9dcb27226d23865518e65dbea587dbedc00c41b5f9d5b7ae7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000252","sha256":"45e635280011b4174cc8789eb4dd880f2a799d7036d190f6328fba8a0f03a93e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000258","sha256":"4fde8c475a57050f091ce07cc166f5e91ad7b4274c7f42871dacb3cc535483de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_00025c","sha256":"960d9d7581f34d06c50b2b16f00c4c5225221f936d75282308984777e4b25127","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_00025e","sha256":"48d7f61862d0ed9e6ce67022c603f26bf440356fca46ec1209fe28320bb46f0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_00025f","sha256":"711b567bc1730dd4d4b592b8aa48b1e704f466b63f36147ad046d3e710f19476","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000260","sha256":"124035a41a814b15d5ea0543a4c6eb8caa7e95cd5db4de377ee2ed79781f9a79","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000263","sha256":"0780fb59a576c405f7b9e5ea1fc932cff31c48f7d97662e73ba6572405cc1f75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000264","sha256":"6f5f7e8d02c1b15736f8441f3f1e5611091820bfdc951d2685b6b8fa91d3d000","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000265","sha256":"4643d2f0b590d9d81a15fa12e0f31e24fa60ffe5f32e0e37d375c5f758551402","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000266","sha256":"820d180f89fb1916916fe171f3068601269cfc0c4b691f07974f67f53895862f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_00026c","sha256":"b02a429593914bc6ad7de040d8d7cce5e0849d0917aa95ae797b2781387d25ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000270","sha256":"778f6ff85685f8ee56830079aa6d7f68da17f7d54935bfb0fe2da79aa82850e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000271","sha256":"4b412897a428a18aeb1ceceb76b254b85cd5f3b720cf4487d8fc00b64a7cae3e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000273","sha256":"6f371eb7dd78b5ba28627fe579a35daaf9212df9da3de6e0d2fbaf804c7617d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000275","sha256":"f0accb521da51191452401cb9052db9167d7f5aaa35c173b8b730aa0296cf24b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000276","sha256":"c2abf645bfd2c7ee38f6e78e742be03e58dc3cd45c6675f07a8bc5476ba31bd2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000277","sha256":"97c4bd73a898c243369ff335b9e315758f8a80ea2a59ee74bc818d58ded44f87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_00027a","sha256":"93cde5cb70bd771eb4da4454e87018953019eb0b30a9d223ee2016682de4c392","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_00027c","sha256":"47d0880913058312bf847a8f2d95af7ed6adc65b0cf0ad9ea166fdd08cfa622d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_00027d","sha256":"a5f210741b835fbcb419085bfdbb4e8c17713d915534e568b7f737756fa20199","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_00027e","sha256":"946874443067a44b3ff2ed04781fb52d944a32fd961425facf67cd463202d86f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000281","sha256":"173207e1eb24ea6b835ef6e1dc59ce1e56bc3c00c5c090633e603129823863e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000282","sha256":"77f3febf33742a2356bcbc947e5099c72537d136d859f9cabff4b0a858db71b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000283","sha256":"908a41a1447ccc92cc42517c6b384dfa4481b2355489d1e3bd934bb870ce366f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000284","sha256":"5595ff2902e72350cf865119d3b6c870bcf04755a29fcd3c448b7bce6e3d5484","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"f_000285","sha256":"8367c9640aa9fd39ac0ebcb788a0562f15e4f4293cae98a777dd8a50bf6742f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"ADNotificationManager.exe","sha256":"cb83f04591cc1d602e650dd5c12f4470cf21b04328477bd6a52081f37c04bd7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"ADelRCP.exe","sha256":"e67a45f4f2ac29b0e8781d4289cb2041522bf7c36c49cd44a0b26e35c0982353","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"AcroCEF.exe","sha256":"d87e96e326bdc689272650a27461da1cf9e93ab04343056592a72c9fad24619f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"AcroDunamis.dll","sha256":"18ec8308b1c68db3f80b14727799d83e54b1437a01591c27221f0e2202dd2945","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"AcroTextExtractor.exe","sha256":"47ca600c5dac01308c5ef91b529c4bd6fb7a0e7024dc6ac3b14c5b08ab7a28d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"AcrobatInfo.exe","sha256":"a2fcff4bdb226de13625e7d8d5fe3fb7be1e1c77e8bcb6fda3504391d9f63f26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"Adobe Crash Processor.exe","sha256":"bdff5163ff3787a7a8b6bb3f688e877c5fa10db2ad535bb9765c91e976fbcafe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"WCChromeNativeMessagingHost.exe","sha256":"c962d2db08e19a285943c8e1466bc2802a9c48c8f280d10246e31376422eb1c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"CRLogTransport.exe","sha256":"37462e31a348d32c9421557f38a601a632c0bdf24d8157481ba82b45f8fef64f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"CRWindowsClientService.exe","sha256":"b309045509efc205eb35d6037d64640093fde6c54ec5934e329b447417005a50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"icucnv71.dll","sha256":"6daac7f843ba17f93e7536c0e0ba2ab51b1815feef159e7f76f013a8cff45ccc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"icuuc71.dll","sha256":"03863fcdba39401496b662027bfc9c2e368fd4a6120b9e0671a332f725014c66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"MSRMSPIBroker.exe","sha256":"019da0f66f9400b067fe95ed5156cfc89b2c28cd684e257e8c8d4afbe98cbbcc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"Acrobat.exe","sha256":"903adf3e1521fcb8643e48c68cdca94c5183fdb67b75787fc9c4810e186a90cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"Adobe Acrobat.lnk","sha256":"ecacf70d0242a67058aad89b1eba05547ca7d2ee1ff81587b7ad1c4d62a233dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.ar_AE.txt","sha256":"ab65abe1b2d292eb98f7b01ca5b5a460d4d66f7b2e20595db935edc257d02727","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.ar_EG.txt","sha256":"529e065122d0f7a062a29fe79fb16d1d33cf3b85caa52a6e6ccd7309177cbd34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.bg.txt","sha256":"bf2321f11a983e2de439bf4132ae4c9aa7ca215ff74882aee611090e87bc30d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.ca.txt","sha256":"182f39967007e902114a8bb35c12ba92ed08b6b35302230a2c1a0c734cdb1694","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.cs.txt","sha256":"1e3c42ba2f7b96b3f3774c1fcf3a367b281f4c3a9794b58b0b8b1781c0e26015","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.da.txt","sha256":"16edaf6158ce0824f8e56abcb0459c4152e7e7f49a94ae3889c152c32575b4ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.de_CH.txt","sha256":"319d0d473845a1c299950212b59bf3d638a8b65827200bf94e2c5401848670ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.de_DE.txt","sha256":"903dd02d71be59691cf77aa5d19de9af0de6cace757409280ec813f27299c9ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.de_DE_PREEURO.txt","sha256":"be66acf17ed667636a3c824e602da907cd48ca04b2bb41dca024ca92394d5981","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.el_GR.txt","sha256":"2771a725a0b1c04f4285f96f3741b19a59ba218321b3d2b3a674db509ec114f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.el_GR_PREEURO.txt","sha256":"3570595fc1f25a38a8f1b45bd45cd2c3dad7e41a897e73863eb703489645727e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.en_US_POSIX.txt","sha256":"3dd21e0ba84bfc31ca439ba3306ba26760684626b18e72ae1a2adcffe01c2f6d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.es.txt","sha256":"56217e944ac45fcb1542987dc5733b60adaade527946dd1a0549315c2f9cc35b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.es_CO.txt","sha256":"a21f3ac5ef655127d6896ea9ee836436820120b84fabcb37929df178cbcb13ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.es_EC.txt","sha256":"8d8f752c2b91104a4ec6fc180aaae3f0011204ba7d1882631d04d159cc24553f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.es_ES.txt","sha256":"9dfbf0b85d3e82bcc69f4b5bed439b7e07b18d039aa62bead4ece48cf55b7ed1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.es_MX.txt","sha256":"7330705d783ca01437302e3f84b656970d5866c99d2a58dbd2d901c33f1f8856","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.es_NI.txt","sha256":"97a9072623b952fdb0022a42aea8b1bfbc584b8b48714ffba48f5e0a74100e03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.es_PY.txt","sha256":"20995e244722deb156ac6b4158bf7a85d92801890397faf51e3fa9cda60e880a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.et.txt","sha256":"99ded58e6f1691ad01b0cf8d4798cad811683da74db3c41937356387d6796377","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.fi.txt","sha256":"a1b36909f3ef1924257c85f9835662dbd983d68a227101942d2b3a5d47034131","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.fi_FI_PREEURO.txt","sha256":"1736aedb5210fd4e2d095c367bd39e76759ef4fff1e388beba4c7f0ab6ddaf59","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.fr_CA.txt","sha256":"f03431aaf42cb7fa573e913c416bd2450cddbf77df495f6102a28ea18ab9a4c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.fr_FR.txt","sha256":"35bccd0ea3f3422cdf973a536f6828eb70c19048a7ca5e057398c270c445ff54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.fr_FR_PREEURO.txt","sha256":"39ed81735c2126b91188bdfac330d7c5837891d1c452a6f72eae0d596caa1672","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.he.txt","sha256":"ae2fad894469a01d18aa2f94638b76cf14ee0c67ae4d660f32914a033a5237f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.hr.txt","sha256":"e35c70aec77e61485333dec1fc3c60f70d3510c2a3c3e13e9fbed3e9f1d393e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.hu_HU.txt","sha256":"aeead7eb4e30ec69fc26f5f010bbeabd28a861024419817690602965c83b40d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.it_IT.txt","sha256":"3cfef57f8b4ed4af1f405034261f7c662adb61f11c43168ea715722c8a07c77b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.it_IT_PREEURO.txt","sha256":"b9bed86d4ddba0132d1b7703c12ecf465f3eb843537728c2ba74f4c85d8d6553","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.ja_JP.txt","sha256":"4db58c0e60f5ac7980ec5feb102c5403e62133d08aca569c264bccf50eee8fd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.ja_JP_TRADITIONAL.txt","sha256":"1d2979b73c0db069f70776218abb919ffae11a3193bbd97d78ab39a9fcb6d6ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.ko.txt","sha256":"b44b8cd12e08eda061d6bb7d4fd8e745fa0be298590cde919b6c8730d4e4e37f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.lt_LT.txt","sha256":"fdd45c211b3d35ab624132ecb75672821b46cc76d2314c5bdffa844be7059265","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.lv_LV.txt","sha256":"419a888bf15c175803a1271410f2e641a85ac103ffb7d07909059053e6f3881d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.nb.txt","sha256":"83db3fe974dbee5caf7080da599d70d5b7adbde4ea8eaaa19b23c966fc6e38fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.nl.txt","sha256":"3b3ce9f1ca53c9b7f39d8f5991577618b2d84f65789c137ef9201c48e8d1aa3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.nl_BE_PREEURO.txt","sha256":"713b50bcfed16155fb3193d41d535160d4e11a3ad89e2cd92e503bb5f745e8f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.nn_NO.txt","sha256":"9f49a7c805e674a4986f4996c69a168d7c1a169cbd9a79e227a0e619b11924cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.pl.txt","sha256":"d2d25e4775a5390729341ef606882eecf5df0991f1db2cf2eb4ec69e09ad74ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.pt_BR.txt","sha256":"09eea193c6515100f510eb8e4a6e7cade378a0bb4adaa67949ef6d66c836f07a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.pt_PT.txt","sha256":"bf800ff5f8fec55ef156faec26561c04f2d63998bce74ae4347253f23e8c8b7a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.pt_PT_PREEURO.txt","sha256":"d752dfd8f4ca57b724ad86612a61cd008bc89137d3713e9daa4ec533c156e5f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.ro.txt","sha256":"3cb61abd974c39ad748384b769fa745cd735c0e1f0504667de44df61bc961331","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.ru_RU.txt","sha256":"a34b24bd621518abf3bf691207ed0621f05788ac51adbcff8532ee161ac16638","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.ru_UA.txt","sha256":"3f01e795332f75308b66a5201c740c9eaf3884c35d5aef9499e2178c89134e93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.sk_SK.txt","sha256":"6cc46a0c213f66bd16a2e67cc9fc914214f98c8cf86b410eaa5355a8b500b5ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.sl_SI.txt","sha256":"65786622a5adddfdc5576b964a5f40095792ac46212ef2c429e61d35367c8b8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"DisplayLanguageNames.sv_FI.txt","sha256":"2a3c5662a0a300531f72ab0baba0ed18416e81524a6c2f6c4d0992e819363f90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"AdobeHunspellPlugin.dll","sha256":"d3773871e04c1b02c48bc8949d190bcd07adc2e2d3d1a09d9ddbf3a22243f7a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"AIDE.dll","sha256":"e396dc848f9ac88b8683f450bb2bdea05097331c64d242a060a67f44b9d3ff83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"SingleClientServicesUpdater.exe","sha256":"5f335c208532d84b03cad96b268053f3743b8b090641d4770c2d61c6f822d4f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"libEGL.dll","sha256":"44cb1470c208075df486ea126d53c6a024cc8999636ef9493937421852228d01","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"libGLESv2.dll","sha256":"9f69c1b20d0fea7d0f45c1ee3d311c071e4296310d26cdfbeb2a1e1ab1d0cc0c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"Acrobat.dll","sha256":"3c438ecf9552191a3a5e679dd227f2e0a9bf9e9c9a262894cac1aad6cbcde344","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"AcrobatRes.dll","sha256":"d01442a26fb2285fd0d2a4a72c0222e5cce3f83c53d446203039994b0846a7af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"AdobeCollabSync.exe","sha256":"92cf1cc15bcbc24c1878aff214f9392aaaa6f6650c9aa6ed2085ef4df630c98f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"AdobeLinguistic.dll","sha256":"057211c5786f9c9748092b4da3e9a065fb08684e3a5704805b3de8b2ab3b9a80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"AdobeXMP.dll","sha256":"45a896d0f7b7d76d7292d314c679a81866adddc7256ccca562100f6213180e92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"nppdf32.dll","sha256":"3a16224a90315dd0923acd6d11589d3853fb8d4babfecb50a7b52c0b403b7f93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"CRClient.dll","sha256":"c8bad97d8717f883836b355a09fa1899984f54536eddb147ca68c9b358dc1f1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"ExtendScript.dll","sha256":"9795f91f509c8833005ebb1314738cfe64debde2e5e29114825f575c1a3253ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"JP2KLib.dll","sha256":"54baa570baf369db5c28f38eb2e3f333bdb08e13e3f4bc306ed57712c810dfeb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"ReaderUC.dll","sha256":"d09b19eb0d42ae2ed8e513d5aa565a855537fe639e3f4cd23e123952aa9583d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"ScCore.dll","sha256":"1373cecd4e4766999c600faffc00226b5477462b9862a1c65f9fc82e702c0bc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"ahclient.dll","sha256":"627b97b845a2c451886fd2d6d7d4e53c3b2649f1dbc6467a0d606c85e3187bac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"icucnv58.dll","sha256":"a0d2b1706aeb5afcf1b4ca1257a3a24e9047a4cd3b362c2690ba5cd9dae9da4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"icucnv67.dll","sha256":"ee9dfbec08fcabfb692040dd1f5354a3c702d1fb0832cdac92d5698be91f9620","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"icucnv69.dll","sha256":"73fb2e9bc1f114720bc1640e746d7646f08dd487789d423baf4ef3a64e562a6d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"icudt58.dll","sha256":"83a0e94d419bc459d048438984ec5d92ee6b827a91604bddd470d71cd8a04e78","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"icudt67.dll","sha256":"65ae0deece3f897b3ce7669ce11d7d70d2e8489e2baa67bc484800e8be94d778","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"icudt69.dll","sha256":"1ecd20f7f9cf53b9790039a08c9e22e9d6977d8eae792d89d5acd594cbeeebbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"icudt71.dll","sha256":"7f0cf1437ea9c3e150f6a9c287aac8393c0727e123b1d20e8fb449e4027301be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"icuuc58.dll","sha256":"c1e5f3b34ea46d004f5ec6903115eeca909b36f47b8e1ba3c4c1658e253adb25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"icuuc67.dll","sha256":"d6a8e5ebc499770c2cd101f3bf473b8cccbaa39cff92b1d25476332713427212","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"icuuc69.dll","sha256":"089e025669e09ee0244aadbe94a6a7ff5c892b7d81a0181fb92ebc75558c567c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"rt3d.dll","sha256":"7ad2bd49be68e56f962f4483985e033867807decb661a74990e962ae7c596ee8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"Aiod.dll","sha256":"6380f9aa729496cdaf55aaddccaf90c9aef997b73f4982a9575bd53fe26736aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"fa9b7.msp","sha256":"2953bf347028965810e7d94a161ca214fed212a8d5e87e7019245b975bfa78ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]}],"files_written":[{"path":"%WINDIR%\\System32\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\System32\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"C:\\186d8790fec7564b4f81100471788e2291dbbaa950a72fe8497b07bbc16a5697.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\Low","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%TEMP%\\Low","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{BDC8E593-8AC3-11E8-9C42-0A002745DB77}.dat","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%TEMP%\\~DFD05B9F33211B48EC.TMP","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%WINDIR%\\System32\\url.dll","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\ONBttnIE.dll","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\frameiconcache.dat","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\ONBTTN~1.DLL","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"},{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{BDC8E594-8AC3-11E8-9C42-0A002745DB77}.dat","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%TEMP%\\~DFC2092F470E512439.TMP","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url:favicon","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Web Slice Gallery.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4shared.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5pk.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\7k7k.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\17kuxun.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\URLREDIR.DLL","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_25\\lib\\plugin.jar","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_25\\bin\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\System32\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%WINDIR%\\System32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds Cache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iecompat.dll","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_1374AC543829516A5CA56081CD00C32A","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\69C6F6EC64E114822DF688DC12CDD86C","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6DB145CFEEC544B1582FED1ADA3370DD","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\System32\\en-US\\winhttp.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\1616.net.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\163.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\2345.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\27.cn.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\355.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\360.cn.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4399.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\51wan.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\56.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\61.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\95599.cn.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\96pk.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\abchina.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\abcnews.go.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\abril.com.br.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\accountonline.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\addictinggames.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\agame.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\allegro.pl.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\alot.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.co.jp.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.de.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ameblo.jp.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\americanexpress.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\answers.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\aol.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ask.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\att.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\avast.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\badoo.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baidu.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baixaki.com.br.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bankofamerica.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baomihua.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bbc.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bing.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\blogger.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\blogspot.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\booking.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\caixa.gov.br.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cartoonnetwork.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ccb.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\china.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\chinanews.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\clubpenguin.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cnet.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cnn.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\comcast.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\comcast.net.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\commentcamarche.net.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cyworld.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dailymotion.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dangdang.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dell.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dianping.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\discoverbing.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\docin.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\douban.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\duowan.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ebay.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ehow.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\exoplanetwar.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\facemoods.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\fedex.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\fileserve.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\filestube.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\flickr.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\foxsports.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\friv.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\funshion.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\geocities.jp.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\gmx.net.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\goo.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\google.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\gougou.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\groupon.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\guardian.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\gyyx.cn.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hao123.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hatena.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hi5.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\homedepot.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hotels.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hotfile.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hp.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\huanqiu.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\huffingtonpost.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\hulu.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\iciba.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\iegallery.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ifeng.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\imdb.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\imesh.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\iminent.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\in.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\inbox.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\indeed.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\java.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\joy.cn.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\juegos.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\kaixin001.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\kakaku.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\kugou.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\leboncoin.fr.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\linkedin.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\livedoor.jp.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\livejournal.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\livingsocial.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\lowes.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\manta.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\match.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mediafire.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\megavideo.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mercadolivre.com.br.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\metrolyrics.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\microsoft.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\microsofttranslator.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\miniclip.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mlb.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\monster.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\moonbasa.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mop.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mozilla.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mozilla.org.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\msn.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\mylife.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nate.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\netflix.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\netlog.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nhk.or.jp.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nicovideo.jp.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\nk.pl.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\norton.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ocn.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\okwave.jp.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\onet.pl.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\orange.fr.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\orkut.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\oyunlar1.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pagesjaunes.fr.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\paipai.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\pandora.com.url","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"path":"%WINDIR%\\SysWOW64\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\AppPatch\\acwow64.dll","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\ieproxy.dll","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\UrlBlockManager\\urlblocklist.bin","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Low","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"},{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Tracking Protection","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\TabRoaming","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\PlayReady","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException\\Low","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache\\Low","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\en\\IEXPLORE.EXE.mui","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%TEMP%\\~DFEB9651A54E6BEF6C.TMP","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{FF351B3B-5244-11E9-84D9-3C002745AA6A}.dat","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%TEMP%\\~DF1506D6D265D754C5.TMP","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%PROGRAMFILES(X86)%\\MICROS~2\\Office14\\URLREDIR.DLL","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_151\\lib\\plugin.jar","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_151\\bin\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\System32\\Macromed\\Flash\\Flash64_27_0_0_187.ocx","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\wshtcpip.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\wship6.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\wshqos.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\R4J2YFDI.txt","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\8HK4KQ8W.txt","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\92203L8A.txt","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\FGLDYUV8.txt","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OX8EQCT0\\C2JT99H7.htm","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\mshtml.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%TEMP%\\~nnmraay.tmp","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\listing-comments.AZZO7Kj_O88[1].css","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\expando.gMzRK16vwrQ[1].css","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\reddit.LpYPn6prsaM[1].css","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\crosspost-preview.De3P20Yb4PY[1].css","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\author-tooltip.1VKQhhDIRMI[1].css","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\desktoponboarding.GwBQjruLr-k[1].css","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VC2ME0V4\\videoplayer.YbUSlMWPXyg[1].css","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VC2ME0V4\\videoplayercontrols.a_TwaTy76-k[1].css","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\popup-notification.6-JvPBpHWMo[1].css","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VC2ME0V4\\reddit-init.en.C_vxycnfttU[1].js","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OX8EQCT0\\icon-sponsored-rank[1].png","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OX8EQCT0\\videoplayer.gJEaOQ_ircg[1].js","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OX8EQCT0\\reddit.en.bEo8geSJHzA[1].js","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OX8EQCT0\\spoiler-text.vsLMfxcst1g[1].js","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OX8EQCT0\\icon-sponsored-tiny[1].png","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QSQQQ22U\\uqab8tkYdtC6URjEdzN_MsUeAcJhSLmnncvYj4TtlJA[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QSQQQ22U\\ADsb7Nm8Q8lEUhrXOHb4JtT3jxNYFFSVnN0GvKPq4QY[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QSQQQ22U\\I17h5E71VkZRQLl6xvygx_Moh1au9x9pI-c1HGG3q5s[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QSQQQ22U\\1M6ai5eTa1tH1Kf_pyivlR0ApQTdU4bOzwf3kPXrEWQ[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QSQQQ22U\\BNdORt6n_Ma5dVf9ppDqnEISUAyE9Yr5qvHGVAC4ugM[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QSQQQ22U\\Sk-gumuhBwnXqpwCB4-mAhkmDGMnFyeLNneMLFhKA9I[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QSQQQ22U\\jqFk8l5hhdvjX7e8Y9FvMpnYG6-a3uxIT6uFDydxnkQ[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QSQQQ22U\\cdIBodjgQZvX58GFwq6kT-iKZXDwF8ZFF-HJ52SqSrc[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QSQQQ22U\\3X3Kq0QhbX08oDXVaTjcrdrA0lDqTv96swmUUnnJ5us[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\TBFHKZCA\\pixel[1].png","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QSQQQ22U\\q1bnOKu0gWKm6yF6LHhVG5k2l2HqePc_3HFNmsstNdo[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QSQQQ22U\\FlAq7nC-qpnL058gnAnFXZz7YbXoetKAcT8p2ovNmKw[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QSQQQ22U\\WxwzNzBR6LBzmy4lVnhXfQ4R1fAXvb5IIU9Vs4e8E3Y[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\TBFHKZCA\\AGtniQl14c4xNppVNvtsuvxfBscB6SBbSVI-X9IQW3E[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\TBFHKZCA\\Ao6aSv-o7yQA4p59jCX8LrN_ulXh2BrNXAzvvlmKEOs[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\TBFHKZCA\\Unb_6bRZC8LKM4rmMJWDyVUpjYxwH6CrQTcOCHyDAVw[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\TBFHKZCA\\sZ6HqI-WR2bceoABKCBNfvoFWTaFTuL8iiz8gTFiIB4[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\TBFHKZCA\\Lo1XHwso7fiWFh-LnHj8HcAWSJysGx_OAZfvDJRaeL8[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\TBFHKZCA\\c-yLlq3jsDse8QEdbbkH6-SRauFm7rKx5LDE6PFu2h4[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\TBFHKZCA\\SqOgNPkN3V4E6as2VVDfExhPK4P0-J29VilTCKe3170[1].jpg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\PU4P3OOW\\www.reddit[1].xml","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\jscript9.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VC2ME0V4\\moatframe[1].js","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\Fonts\\verdana.ttf","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VC2ME0V4\\jail[1].htm","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VC2ME0V4\\proxy[1].htm","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\Fonts\\verdanab.ttf","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\Fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VC2ME0V4\\sprite-reddit.riHZOmfmJVk[1].png","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VC2ME0V4\\throbber[1].gif","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\Fonts\\seguisym.ttf","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VC2ME0V4\\premium-title[1].png","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VC2ME0V4\\listingsignupbar-orbit-2[1].png","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VC2ME0V4\\listingsignupbar-orbit-1[1].png","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VC2ME0V4\\sprite-expando.69EqpDZz3HM[1].png","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VC2ME0V4\\droparrowgray[1].gif","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\H3XVNPGD\\gpt[1].js","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q38I0BE9\\apstag[1].js","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\1WM1P7IF.txt","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_7F4AA74A3B6AAF7E85F2F3FE1488680F","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\85B3F147E3624A14E6A20DB4F6C2C5D9","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{FF351B39-5244-11E9-84D9-3C002745AA6A}.dat","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B398B80134F72209547439DB21AB308D_592839A8569F831D0F2306AE4BB5C24B","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B398B80134F72209547439DB21AB308D_B4BD50FFE8748CFA91062E87ABCD641B","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[5].ico","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B66240B0F6C84BD4857ABA60CF5CE4A0_F03A28002BA04D67D40293EB07685203","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6A2279C2CA42EBEE26F14589F0736E50","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\Macromed\\Flash\\ss.sgn","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\Macromed\\Flash\\ss.cfg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\Macromed\\Flash\\mms.cfg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\Macromed\\Flash\\oem.cfg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\oem.cfg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\94D901CE4AD8BABEF1A9F51A72BF8CE8.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\NativeCache.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\D19A124A63BC3E484EE0CC12F63FFE86\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\14FE212574D1C626E7D9F8D9E261A62B\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\58D75590E211D1B0C26C176059D52D75\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\DE89D1447AB1E99DD87F51CA87C52655\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\9DCB33E1CFD76DD078ED1898ECBAEFEE\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\668D0A067F2436E1D58EA37A2D7DAF2E\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\396B667C011CF74AFE66D655E875014B\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\7FCDFC8C65295F95F1B2B94C4B4AC6BF\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\BF4BB2C7EE96F73EC15D03471A3C7190\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\24FB7F8BF29F9D5B1BA5F5BD986D6BDB\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\27B164FB036E31553875E83C0CEADD7C\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\E5617A3A2E52B334393316C9AF28E65D\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\74C6CC968D46AD77ED26CD2279AFAD4A\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\5E1695CF661F2AC6997BB8E3D81DF826\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\53C2449AF5289A3021851A926C9292AE\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\2B9A81C6A66630E584CDC25504552597\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\46ED9160074E9FE80B68B8F4635E1E1F\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\7624407C79FD148BD154961B5C878D06\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\52A424DE7FAAAC541C1DDDCE9E5AB317\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\915E84FE7E8929AA0AF1E491D8AA8669\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\A0B83912A1953D21B712724637B8789A\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\824E0FF07F7744CEBFDAF4FF92BE9E8F\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\63241689DE8DD5590FBBFA84AD7D116C\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\5F01BA1496F8B8F767931AACBF93267B\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\340EE80BB6C2BDC03A237663EA24C806\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache\\B8A777454276EE030F7A5FF3F6E693DC\\Info.directory","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\AssetCache","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%USERPROFILE%\\.telemetry.cfg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%USERPROFILE%\\telemetry.cfg","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\Macromed\\Flash\\activex.vch","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\scrrun.dll","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\SysWOW64\\Adobe\\Shockwave 12\\Control.dll","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B398B80134F72209547439DB21AB308D_592839A8569F831D0F2306AE4BB5C24B","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\6CY2NG59.txt","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4E93U0HY.txt","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\24I82KXY.txt","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OX8EQCT0\\aax[1].js","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\System32\\en-US\\wshtcpip.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\System32\\en-US\\wship6.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%WINDIR%\\System32\\en-US\\wshqos.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_FDB452422670E72EDD3FB3D65568F821","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CFE86DBBE02D859DC92F1E17E0574EE8_FDB452422670E72EDD3FB3D65568F821","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_E06F7726D26827CC881B38A9DDF0F0D7","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\01B16CDBADE7DB774141D7E30D50EC69","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1E11E75149C17A93653DA7DC0B8CF53F_CDB10B225B1070CC128C712F3AB71453","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1E11E75149C17A93653DA7DC0B8CF53F_B03EEE6F808770CC76415F98F08B6524","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6B17EC2CD0C9B19353018FF1C12BC489","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5B9763FB83E74617D0DB58992800F69B","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BAD725C80F9E10846F35D039A996E4A8_01BD2FE9C7DF0143054864DFB0B10442","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BCB67D7ECB470284AF35679F339E879F","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\50OU74L0.txt","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\1E11E75149C17A93653DA7DC0B8CF53F_CDB10B225B1070CC128C712F3AB71453","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_397E41A2F252913B147EAF3FA1644BE8","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\F5F320A94D4D2B4465D8F17E2BB2D351_397E41A2F252913B147EAF3FA1644BE8","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_49FC544F04082FD9F64F9EFB226AF8B5","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\P6QSO9MS\\gpt[1].js","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\reports","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\attachments","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\metadata","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Variations","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\BrowserMetrics\\BrowserMetrics-63CEA7A7-8BC.pma","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\lockfile","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Sync Data\\LevelDB\\LOG","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Sync Data\\LevelDB\\LOCK","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Sync Data\\LevelDB\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgeCoupons\\coupons_data.db\\LOG.old~RF1336e2.TMP","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Site Characteristics Database\\LOG","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Site Characteristics Database\\LOCK","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgeCoupons\\coupons_data.db\\LOCK","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgePushStorageWithConnectTokens\\LOCK","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgePushStorageWithConnectTokenAndKey\\LOG.old~RF13374f.TMP","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgePushStorageWithConnectTokenAndKey\\LOCK","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"},{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\136bf75c-1de2-415d-a2a6-a1223131258f.tmp","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"path":"%WINDIR%\\SysWOW64\\Elevation.tmp","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\BrowserMetrics\\BrowserMetrics-659986DE-209C.pma","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\\settings.dat","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\8799fcb4-85f6-421e-ba71-f0e0b3ce8c37.tmp","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\sslkey.txt","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Last Version","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\ShaderCache\\index","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Local State~RFfd72d.TMP","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\segmentation_platform\\ukm_db","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\segmentation_platform\\ukm_db-journal","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Web Data","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\History","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Web Data-journal","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgePushStorageWithConnectTokens\\LOG","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\HubApps Icons","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Top Sites","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Nurturing\\campaign_history","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\History-journal","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Site Characteristics Database\\LOG.old~RFfd7b9.TMP","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Sync Data\\LevelDB\\LOG.old~RFfd7b9.TMP","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\2e526049-029f-490c-9c1a-1e66731129c5.tmp","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\52e6b251-1697-459b-92a8-146a09708c77.tmp","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgePushStorageWithConnectTokenAndKey\\LOG.old~RFfd7d8.TMP","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgePushStorageWithConnectTokenAndKey\\LOG","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\PersistentOriginTrials\\LOG","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Site Characteristics Database\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data-journal","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Site Characteristics Database\\000003.log","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Nurturing\\campaign_history","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgeCoupons\\coupons_data.db\\LOG.old~RFfd7d8.TMP","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\PersistentOriginTrials\\LOCK","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\parcel_tracking_db\\LOG","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension Rules\\LOG.old~RFfd7e8.TMP","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension Rules\\LOG","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension Rules\\LOCK","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension Rules\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\commerce_subscription_db\\LOG.old~RFfd7d8.TMP","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\parcel_tracking_db\\LOCK","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension Rules\\000003.log","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension Scripts\\LOG.old~RFfd7e8.TMP","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Favicons","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Shared Dictionary\\db","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Shared Dictionary\\cache\\index","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\Trust Tokens","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Shared Dictionary\\db-journal","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Shared Dictionary\\db","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Shared Dictionary\\cache\\index","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Shared Dictionary\\db-journal","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Network\\Trust Tokens","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Network\\Trust Tokens-journal","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\index","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Shared Dictionary\\cache\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Shared Dictionary\\cache\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\Cookies","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\Cookies-journal","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\Reporting and NEL","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_00009d","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_00009e","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Cache\\Cache_Data\\index","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Cache\\Cache_Data\\data_0","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Cache\\Cache_Data\\data_1","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Cache\\Cache_Data\\data_2","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Cache\\Cache_Data\\data_3","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\Reporting and NEL-journal","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_00009f","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0000a0","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\ee1236c5-d287-47cc-8597-6a963f9f3a32.tmp","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\SCT Auditing Pending Reports~RFffcc6.TMP","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0000a1","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Network\\Reporting and NEL","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Network\\Reporting and NEL-journal","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Network\\a24662ad-bd13-4f6c-8d68-78e4c2a4e3dc.tmp","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Network\\SCT Auditing Pending Reports~RFfff17.TMP","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0000a2","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0000a3","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0000a4","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0000a5","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0000a6","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0000a7","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0000a8","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0000a9","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0000aa","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0000ab","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0000ac","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0000ad","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\bc41628d-48b0-4d56-a284-7f79858bdbac.tmp","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\SCT Auditing Pending Reports~RF1009e5.TMP","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0000ae","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0000af","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\6d6f0079-36f5-41a5-a31b-3864b7a886c6.tmp","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\Sdch Dictionaries~RF1012ce.TMP","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0000b0","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Cache\\Cache_Data\\f_0000b1","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\LOG","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Asset Store\\assets.db\\000010.log","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EntityExtraction\\EntityExtractionAssetStore.db\\000003.ldb","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EntityExtraction\\domains_config.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EntityExtraction\\EntityExtractionAssetStore.db\\LOG","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EntityExtraction\\EntityExtractionAssetStore.db\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EntityExtraction\\EntityExtractionAssetStore.db\\000004.log","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\manifest.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_157048624\\CRX_INSTALL\\manifest.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\page_embed_script.js","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\ar\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\no\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\ur\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\tr\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\sl\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\hy\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\ml\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\ja\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\lv\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\my\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\eu\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\am\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\fi\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\es\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\ko\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\af\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\pa\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\el\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\vi\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\az\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\sr\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\pt_BR\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\sw\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\en_GB\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\sk\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\fr_CA\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\en_US\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\lt\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\nl\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\km\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\fr\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\si\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\it\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\cs\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\be\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\ta\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\kn\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\te\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\fil\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\th\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\gu\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\fa\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\hi\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\en_CA\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\bn\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\kk\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\ka\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\gl\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\id\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\zh_HK\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\pl\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\zh_CN\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\zu\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\ro\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\is\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\ms\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\sv\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\et\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\pt_PT\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\zh_TW\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\iw\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\en\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\mr\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\uk\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\es_419\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\mn\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\cy\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\da\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\lo\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\ne\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\hr\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\bg\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\hu\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\ru\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\de\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\_locales\\ca\\messages.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\offscreendocument_main.js","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\offscreendocument.html","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\128.png","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\service_worker_bin_prod.js","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_1373974137\\CRX_INSTALL\\dasherSettingSchema.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_157048624\\CRX_INSTALL\\content.js","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_157048624\\CRX_INSTALL\\content_new.js","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%TEMP%\\scoped_dir8348_157048624\\CRX_INSTALL\\_metadata\\verified_contents.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%WINDIR%\\SystemTemp\\chrome_PuffinComponentUnpacker_BeginUnzipping8348_891140741\\keys.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%WINDIR%\\SystemTemp\\chrome_PuffinComponentUnpacker_BeginUnzipping8348_891140741\\LICENSE","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%WINDIR%\\SystemTemp\\chrome_PuffinComponentUnpacker_BeginUnzipping8348_891140741\\manifest.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"path":"%WINDIR%\\SystemTemp\\chrome_PuffinComponentUnpacker_BeginUnzipping8348_891140741\\_metadata\\verified_contents.json","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKCU\\\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\EDGE\\BLBEACON\\\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\EDGE\\\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKCU\\SOFTWARE\\\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"key":"HKCUHKCU\\SOFTWARE\\ADOBE\\ADOBE ARM\\1.0\\ARM\\COLLECTDATA\\","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"key":"HKLMHKLM\\SOFTWARE\\ADOBE\\INSTALLER\\{AC76BA86-1033-1033-7760-BC15014EA700}\\","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGEUPDATE\\CLIENTS\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\COMMANDS\\ON-LOGON-AUTOLAUNCH\\","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"key":"HKCUHKCU\\\\","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"key":"HKCUHKCU\\SOFTWARE\\\\","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\\\","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\\\","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\EDGE\\BLBEACON\\\\","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\LINKSBAR\\ITEMCACHE\\0\\EXPIRATION\\EXPIRATION","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\LINKSBAR\\ITEMCACHE\\1\\EXPIRATION\\EXPIRATION","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"key":"HKCU\\LOCAL SETTINGS\\SOFTWARE\\MICROSOFT\\WINDOWS\\SHELL\\MUICACHE\\@%WINDIR%\\SYSTEM32\\IEFRAME.DLL,-12385\\@%WINDIR%\\SYSTEM32\\IEFRAME.DLL,-12385","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"key":"HKCU\\LOCAL SETTINGS\\SOFTWARE\\MICROSOFT\\WINDOWS\\SHELL\\MUICACHE\\@C:\\WINDOWS\\SYSTEM32\\IEFRAME.DLL,-12385\\@C:\\WINDOWS\\SYSTEM32\\IEFRAME.DLL,-12385","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\SHELLNOROAM\\MUICACHE\\@%WINDIR%\\SYSTEM32\\IEFRAME.DLL.MUI,-12385\\@%WINDIR%\\SYSTEM32\\IEFRAME.DLL.MUI,-12385","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\SHELLNOROAM\\MUICACHE\\@C:\\WINDOWS\\SYSTEM32\\IEFRAME.DLL.MUI,-12385\\@C:\\WINDOWS\\SYSTEM32\\IEFRAME.DLL.MUI,-12385","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SUGGESTED SITES\\ENABLED\\ENABLED","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\75E0ABB6138512271C04F85FDDDE38E4B7242EFE\\75E0ABB6138512271C04F85FDDDE38E4B7242EFE","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\5.0\\CACHE\\EXTENSIBLE CACHE\\MSHIST012017022820170301\\","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\5.0\\CACHE\\EXTENSIBLE CACHE\\MSHIST012017030120170302\\","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TABBEDBROWSING\\NEWTABPAGE\\MFV\\MFV","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{EC814DF5-6D42-43EC-9EED-DA58E10CAEC7}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{00000000-0000-0000-0000-000000000000}\\{00000000-0000-0000-0000-000000000000}","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\104C63D2546B8021DD105E9FBA5A8D78169F6B32\\104C63D2546B8021DD105E9FBA5A8D78169F6B32","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8\\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\339CDD57CFD5B141169B615FF31428782D1DA639\\339CDD57CFD5B141169B615FF31428782D1DA639","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0\\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4\\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\MEDIAPLAYER\\HEALTH\\{528A51A1-EEC4-4344-BC05-70C3212D871B}\\","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"key":"HKLMHKLM\\SOFTWARE\\ADOBE\\INSTALLER\\{AC76BA86-1033-1033-7760-BC15014EA700}\\","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\ConnHashTable<2400>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"Local\\Feed Arbitration Shared Memory Mutex [ User : S-1-5-21-4162757579-3804539371-4239455898-1000 ]","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"Local\\RSS Eventing Connection Database Mutex 00000960","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"Local\\Feed Eventing Shared Memory Mutex S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"ConnHashTable<2400>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"Local\\Feeds Store Mutex S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RSS Eventing Connection Database Mutex 00000960","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Feed Eventing Shared Memory Mutex S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Feed Arbitration Shared Memory Mutex [ User : S-1-5-21-4162757579-3804539371-4239455898-1000 ]","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Feeds Store Mutex S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!privacie!","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"Local\\!PrivacIE!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!mshist012018071820180719!","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"Local\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!privacie!","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!local!microsoft!feeds cache!","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!iecompatcache!","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!feeds cache!","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!iecompatcache!","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!PrivacIE!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"},{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!mshist012018071820180719!","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"5b4f2a097ca3e10fa00f9103"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_cf8_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"Local\\InternetShortcutMutex","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"},{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"IsoScope_cf8_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"IsoScope_cf8_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3320","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"IsoScope_cf8_IE_EarlyTabStart_0xe04_Mutex","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"IsoScope_cf8_ConnHashTable<3320>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"IsoScope_cf8_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3320","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_cf8_IE_EarlyTabStart_0xe04_Mutex","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_cf8_ConnHashTable<3320>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_cf8_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_cf8_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"IsoScope_cf8_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"Local\\https://secure-assets.rubiconproject.com/","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"Local\\https://ads.pubmatic.com/","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"Local\\DirectSound DllMain mutex (0x00000DE8)","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"{1B655094-FE2A-433c-A877-FF9793445069}","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"Local\\https://www.reddit.com/","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\https://www.reddit.com/","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_cf8_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\DirectSound DllMain mutex (0x00000DE8)","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{1B655094-FE2A-433c-A877-FF9793445069}","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\https://ads.pubmatic.com/","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\https://secure-assets.rubiconproject.com/","sources":[{"report_type":"sandbox","report_id":"5c9e5281028838a1087acd2e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2236:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"Local\\SM0:7892:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"Local\\SM0:7892:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"Local\\SM0:2236:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"Local\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"Local\\SM0:2236:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2236:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8036:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"Local\\SM0:8036:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7824:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"Local\\SM0:7824:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7652:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"Local\\SM0:7652:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"Local\\SM0:5552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3908:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"Local\\SM0:3908:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"Local\\SM0:4120:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1124:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"Local\\SM0:1124:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4536:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"Local\\SM0:4536:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"Local\\SM0:2020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"Local\\SM0:4636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2588:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"Local\\SM0:2588:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2660:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"Local\\SM0:2660:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2252:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"Local\\SM0:2252:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6728:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"Local\\SM0:6728:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63cea6301b28b14afa285ecc"}]},{"name":"Local\\SM0:5980:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"InternetShortcutMutex","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"SM0:5980:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"Local\\SM0:5996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"Local\\SM0:5996:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"SM0:5996:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5980:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\InternetShortcutMutex","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5980:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5996:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5996:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"659915e17e579c855700419a"}]}]}},"report_ids":{"sandbox_job_ids":["63cea6301b28b14afa285ecc","659915e17e579c855700419a","5c9e5281028838a1087acd2e","5eca048943a6d963215e4aa7","5b4f2a097ca3e10fa00f9103"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample 186d8790fec7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 186d8790fec7…. Threat score 100/100. 0/6 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/186d8790fec7564b4f81100471788e2291dbbaa950a72fe8497b07bbc16a5697"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 186d8790fec7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 186d8790fec7…. Threat score 100/100. 0/6 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/186d8790fec7564b4f81100471788e2291dbbaa950a72fe8497b07bbc16a5697"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 186d8790fec7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 186d8790fec7…. Threat score 100/100. 0/6 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L39","11",{}]]