21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 3d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T49f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Adware.MobogenieCRTD Sample b7a1a5901b93… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b7a1a5901b93…. Malware family: Adware.MobogenieCRTD. Threat score 100/100. 2/28 AV engines flagged this file. 9 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b7a1a5901b93f80a699fdac1ad2896bb8abf6cb98b51fcc9fb0408c5d48e141f","keywords":["Malicious","Adware.MobogenieCRTD","malware analysis","sandbox report","threat intelligence","b7a1a5901b93f80a699fdac1ad2896bb8abf6cb98b51fcc9fb0408c5d48e141f"],"about":{"@type":"SoftwareApplication","name":"YoudaoDict.exe","applicationCategory":["peexe","executable"],"identifier":"b7a1a5901b93f80a699fdac1ad2896bb8abf6cb98b51fcc9fb0408c5d48e141f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Adware.MobogenieCRTD","antivirusDetections":{"malicious":2,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T65b,SetUnhandledExceptionFilter@KERNEL32.DLL at 00027858-00002708-48804-16-00C6999A SetUnhandledExceptionFilter@KERNEL32.DLL at 00028375-00003684-44648-16-0040999A SetUnhandledExceptionFilter@KERNEL32.DLL at 00028375-00003684-44648-8022-00409969 SetUnhandledExceptionFilter@KERNEL32.DLL at 00028549-00002412-19493-18-00E2F0B7 SetUnhandledExceptionFilter@KERNEL32.DLL at 00028549-00002412-19493-395-00E2F086 SetUnhandledExceptionFilter@KERNEL32.DLL at 00029455-00002592-22785-18-0005F0B7 SetUnhandledExceptionFilter@KERNEL32.DLL at 00029455-00002592-22785-395-0005F086 SetUnhandledExceptionFilter@KERNEL32.DLL at 00029976-00003068-25626-18-0117F0B7 SetUnhandledExceptionFilter@KERNEL32.DLL at 00029976-00003068-25626-395-0117F086 SetUnhandledExceptionFilter@KERNEL32.DLL at 00030494-00003012-28446-18-0117F0B7 SetUnhandledExceptionFilter@KERNEL32.DLL at 00030494-00003012-28446-395-0117F086 SetUnhandledExceptionFilter@KERNEL32.DLL at 00031009-00002696-31441-18-0039F0B7 SetUnhandledExceptionFilter@KERNEL32.DLL at 00031009-00002696-31441-395-0039F086 SetUnhandledExceptionFilter@KERNEL32.DLL at 00031557-00003768-36408-16-0048999A SetUnhandledExceptionFilter@KERNEL32.DLL at 00032271-00003924-31904-12-00D25BE7 SetUnhandledExceptionFilter@KERNEL32.DLL at 00032271-00003924-31904-32-00D27CA1 SetUnhandledExceptionFilter@KERNEL32.DLL at 00032271-00003924-31904-379-00D28762 SetUnhandledExceptionFilter@KERNEL32.DLL at 00033793-00001772-34851-16-003A999A SetUnhandledExceptionFilter@KERNEL32.DLL at 00033793-00001772-34851-8022-003A9969 SetUnhandledExceptionFilter@KERNEL32.DLL at 00034316-00002720-6932-16-0024999A23:T5f8,GetSystemTimeAsFileTime@KERNEL32.DLL at 00027858-00002708-48804-371-00C6947B GetSystemTime@KERNEL32.DLL at 00027858-00002708-48804-1623-00C86F80 GetSystemTimeAsFileTime@KERNEL32.DLL at 00027858-00002708-48804-2204-00C616E3 GetSystemTimeAsFileTime@KERNEL32.DLL at 00028375-00003684-44648-371-0040947B GetSystemTime@KERNEL32.DLL at 00028375-00003684-44648-1623-00426F80 GetSystemTimeAsFileTime@KERNEL32.DLL at 00028375-00003684-44648-2204-004016E3 GetSystemTimeAsFileTime@KERNEL32.DLL at 00028375-00003684-44648-4702-00408425 GetSystemTimeAsFileTime@KERNEL32.DLL at 00028375-00003684-44648-8017-004083FA GetSystemTimeAsFileTime@KERNEL32.DLL at 00028375-00003684-44648-8186-004272F0 GetSystemTimeAsFileTime@KERNEL32.DLL at 00028549-00002412-19493-239-00E2EBB3 GetSystemTimeAsFileTime@KERNEL32.DLL at 00029455-00002592-22785-239-0005EBB3 GetSystemTimeAsFileTime@KERNEL32.DLL at 00029976-00003068-25626-239-0117EBB3 GetSystemTimeAsFileTime@KERNEL32.DLL at 00030494-00003012-28446-239-0117EBB3 GetSystemTimeAsFileTime@KERNEL32.DLL at 00031009-00002696-31441-239-0039EBB3 GetSystemTimeAsFileTime@KERNEL32.DLL at 00031557-00003768-36408-371-0048947B GetSystemTime@KERNEL32.DLL at 00031557-00003768-36408-1623-004A6F80 GetSystemTimeAsFileTime@KERNEL32.DLL at 00031557-00003768-36408-2204-004816E3 GetSystemTimeAsFileTime@KERNEL32.DLL at 00032271-00003924-31904-174-00D290F5 GetSystemTimeAsFileTime@KERNEL32.DLL at 00033793-00001772-34851-371-003A947B GetSystemTime@KERNEL32.DLL at 00033793-00001772-34851-1623-003C6F8024:T554,GetVersionExW@KERNEL32.DLL at 00017767-00003368-40555-60-0040650D GetVersion@KERNEL32.DLL at 00017767-00003368-40555-15-00406966 GetVersion@KERNEL32.DLL at 00017767-00003368-45790-15-00406966 GetVersionExW@KERNEL32.DLL at 00027858-00002708-48804-316-00B3B53E GetVersionExW@KERNEL32.DLL at 00027858-00002708-48804-1277-00CDE120 GetVersionExW@KERNEL32.DLL at 00027858-00002708-48804-1568-00C9E400 GetVersionExW@KERNEL32.DLL at 00027858-00002708-48804-1561-00C9EE60 GetVersionExW@KERNEL32.DLL at 00027858-00002708-48804-1606-00C913A0 GetVersionExW@KERNEL32.DLL at 00027858-00002708-48804-1557-00C9F570 GetVersionExW@KERNEL32.DLL at 00027858-00002708-48804-1662-00C84D30 GetVersionExW@KERNEL32.DLL at 00028375-00003684-44648-316-002DB53E GetVersionExW@KERNEL32.DLL at 00028375-00003684-44648-1277-0047E120 GetVersionExW@KERNEL32.DLL at 00028375-00003684-44648-1557-0043F570 GetVersionExW@KERNEL32.DLL at 00028375-00003684-44648-1568-0043E400 GetVersionExW@KERNEL32.DLL at 00028375-00003684-44648-1662-00424D30 GetVersionExW@KERNEL32.DLL at 00028375-00003684-44648-1561-0043EE60 GetVersionExW@KERNEL32.DLL at 00028375-00003684-44648-1606-004313A0 GetVersionExW@KERNEL32.DLL at 00028375-00003684-44648-8167-00425190 GetVersionExW@KERNEL32.DLL at 00028375-00003684-44648-8154-0043F410 GetVersionExW@KERNEL32.DLL at 00028375-00003684-44648-8155-004256E025:T50f,GetUserDefaultUILanguage@KERNEL32.DLL at 00028375-00003684-44648-2680-002EE8BD GetUserDefaultUILanguage@KERNEL32.DLL at 00028375-00003684-44648-4581-003FF028 GetUserDefaultUILanguage@KERNEL32.DLL at 00031557-00003768-36408-2680-0036E8BD GetUserDefaultUILanguage@KERNEL32.DLL at 00033793-00001772-34851-2680-0028E8BD GetUserDefaultUILanguage@KERNEL32.DLL at 00033793-00001772-34851-4581-0039F028 GetUserDefaultUILanguage@KERNEL32.DLL at 00034316-00002720-6932-2683-0012E8BD GetUserDefaultLCID@KERNEL32.dll at 1648-2097-1001E964 EnumSystemLocalesW@KERNEL32.dll at 1648-2094-1001E87A EnumSystemLocalesW@KERNEL32.dll at 1648-2215-1002C7AC GetUserDefaultLCID@KERNEL32.dll at 1648-2317-1002C713 EnumSystemLocalesW@KERNEL32.dll at 1648-2217-1002C72F GetUserDefaultLCID@KERNEL32.dll at 1648-2213-1002CCCF EnumSystemLocalesW@KERNEL32.dll at 1648-2214-1002C6D3 GetUserDefaultLCID@KERNEL32.dll at 300-1855-0000000180023268 EnumSystemLocalesW@KERNEL32.dll at 300-1859-00000001800230E0 GetUserDefaultLCID@KERNEL32.dll at 300-1875-000000018002F668 EnumSystemLocalesW@KERNEL32.dll at 300-1876-000000018002F014 EnumSystemLocalesW@KERNEL32.dll at 300-2432-000000018002EEE4 EnumSystemLocalesW@KERNEL32.dll at 300-1877-000000018002EF60 GetUserDefaultUILanguage@KERNEL32.dll at 6963-6290-004239F326:T35a6,Found API call GetVersionExW@KERNEL32.DLL (Target: "YoudaoDictInstaller.exe"; Stream UID: "00027858-00002708-48804-316-00B3B53E") which is directly followed by "cmp dword ptr [ebp-00000120h], 06h" and "jne 00B3B710h". See related instructions: "...+280 call dword ptr [00CF7494h] ;GetCurrentThreadId+286 mov dword ptr [esi+30h], eax+289 xor eax, eax+291 mov dword ptr [edi+04h], esi+294 xor edi, edi+296 mov dword ptr [esi+00000098h], eax+302 inc edi+303 lea eax, dword ptr [ebp-00000124h]+309 mov dword ptr [esi+44h], ebx+312 push eax+313 mov dword ptr [esi+00000080h], ebx+319 mov dword ptr [esi+68h], ebx+322 mov dword ptr [esi+6Ch], ebx+325 mov dword ptr [esi+58h], ebx+328 mov dword ptr [esi+64h], ebx+331 mov dword ptr [esi+54h], ebx+334 mov dword ptr [esi+0000008Ch], ebx+340 mov dword ptr [esi+5Ch], ebx+343 mov dword ptr [esi+48h], ebx+346 mov dword ptr [esi+00000094h], ebx+352 mov dword ptr [esi+00000090h], ebx+358 mov dword ptr [esi+00000084h], ebx+364 mov dword ptr [esi+00000088h], ebx+370 mov dword ptr [esi+74h], ebx+373 mov dword ptr [esi+78h], ebx+376 mov dword ptr [esi+0000009Ch], ebx+382 mov dword ptr [esi+000000A4h], ebx+388 mov dword ptr [esi+60h], ebx+391 mov dword ptr [esi+70h], ebx+394 mov dword ptr [esi+000000A0h], 00000200h+404 mov dword ptr [esi+000000ACh], ebx+410 mov dword ptr [esi+000000B0h], 000493E0h+420 mov dword ptr [esi+000000B4h], edi+426 mov dword ptr [ebp-00000124h], 00000114h+436 call dword ptr [00CF742Ch] ;GetVersionExW+442 cmp dword ptr [ebp-00000120h], 06h+449 jne 00B3B710h" ... at 00027858-00002708-48804-316-00B3B53E Found API call GetVersionExW@KERNEL32.DLL (Target: "YoudaoDictInstaller.exe"; Stream UID: "00027858-00002708-48804-1277-00CDE120") which is directly followed by "cmp eax, 02h" and "jne 00CDE180h". See related instructions: "...+33 lea eax, dword ptr [ebp-00000118h]+39 mov dword ptr [ebp-00000118h], 00000114h+49 push eax+50 call dword ptr [00CF742Ch] ;GetVersionExW+56 xor eax, eax+58 cmp dword ptr [ebp-00000108h], 02h+65 sete al+68 inc eax+69 mov dword ptr [00D6BD18h], eax+74 cmp eax, 02h+77 mov eax, dword ptr [00D60E1Ch]+82 push 00000000h+84 jne 00CDE180h" ... at 00027858-00002708-48804-1277-00CDE120 Found API call GetVersionExW@KERNEL32.DLL (Target: "YoudaoDictInstaller.exe"; Stream UID: "00027858-00002708-48804-1568-00C9E400") which is directly followed by "cmp ecx, 02h" and "jne 00C9E4A1h". See related instructions: "...+50 lea eax, dword ptr [ebp-00000118h]+56 mov dword ptr [ebp-00000118h], 00000114h+66 push eax+67 call dword ptr [00CF742Ch] ;GetVersionExW+73 xor ecx, ecx+75 cmp dword ptr [ebp-00000108h], 02h+82 sete cl+85 inc ecx+86 mov dword ptr [00D6BD18h], ecx+92 push ebx+93 push 00000000h+95 push 00000000h+97 cmp ecx, 02h+100 jne 00C9E4A1h" ... at 00027858-00002708-48804-1568-00C9E400 Found API call GetVersionExW@KERNEL32.DLL (Target: "YoudaoDictInstaller.exe"; Stream UID: "00027858-00002708-48804-1561-00C9EE60") which is directly followed by "cmp eax, 02h" and "jne 00C9EEF7h". See related instructions: "...+39 lea eax, dword ptr [ebp-00000118h]+45 mov dword ptr [ebp-00000118h], 00000114h+55 push eax+56 call dword ptr [00CF742Ch] ;GetVersionExW+62 xor eax, eax+64 cmp dword ptr [ebp-00000108h], 02h+71 sete al+74 inc eax+75 mov dword ptr [00D6BD18h], eax+80 cmp eax, 02h+83 jne 00C9EEF7h" ... at 00027858-00002708-48804-1561-00C9EE60 Found API call GetVersionExW@KERNEL32.DLL (Target: "YoudaoDictInstaller.exe"; Stream UID: "00027858-00002708-48804-1606-00C913A0") which is directly followed by "cmp eax, 02h" and "jne 00C91406h". See related instructions: "...+32 lea eax, dword ptr [ebp-00000118h]+38 mov dword ptr [ebp-00000118h], 00000114h+48 push eax+49 call dword ptr [00CF742Ch] ;GetVersionExW+55 xor eax, eax+57 cmp dword ptr [ebp-00000108h], 02h+64 sete al+67 inc eax+68 mov dword ptr [00D6BD18h], eax+73 cmp eax, 02h+76 jne 00C91406h" ... at 00027858-00002708-48804-1606-00C913A0 Found API call GetVersionExW@KERNEL32.DLL (Target: "YoudaoDictInstaller.exe"; Stream UID: "00027858-00002708-48804-1557-00C9F570") which is directly followed by "cmp eax, 02h" and "jne 00C9F62Bh". See related instructions: "...+80 lea eax, dword ptr [ebp-00000220h]+86 mov dword ptr [ebp-00000220h], 00000114h+96 push eax+97 call dword ptr [00CF742Ch] ;GetVersionExW+103 xor eax, eax+105 cmp dword ptr [ebp-00000210h], 02h+112 sete al+115 inc eax+116 mov dword ptr [00D6BD18h], eax+121 cmp eax, 02h+124 jne 00C9F62Bh" ... at 00027858-00002708-48804-1557-00C9F570 Found API call GetVersionExW@KERNEL32.DLL (Target: "YoudaoDictInstaller.exe"; Stream UID: "00027858-00002708-48804-1662-00C84D30") which is directly followed by "cmp eax, 02h" and "jne 00C84DE6h". See related instructions: "...+77 lea eax, dword ptr [ebp-00000118h]+83 mov dword ptr [ebp-00000118h], 00000114h+93 push eax+94 call dword ptr [00CF742Ch] ;GetVersionExW+100 xor eax, eax+102 cmp dword ptr [ebp-00000108h], 02h+109 sete al+112 inc eax+113 mov dword ptr [00D6BD18h], eax+118 push ebx+119 cmp eax, 02h+122 jne 00C84DE6h" ... at 00027858-00002708-48804-1662-00C84D30 Found API call GetSystemTime@KERNEL32.DLL (Target: "YoudaoDictInstaller.exe"; Stream UID: "00027858-00002708-48804-1623-00C86F80") which is directly followed by "cmp eax, 04h" and "jc 00C86FCDh". See related instructions: "...+32 lea eax, dword ptr [ebp-14h]+35 push eax+36 call dword ptr [00CF73FCh] ;GetSystemTime+42 movdqu xmm0, dqword ptr [ebp-14h]+47 mov esi, 00000010h+52 movdqu dqword ptr [ebx], xmm0+56 mov eax, edi+58 sub eax, esi+60 cmp eax, 04h+63 jc 00C86FCDh" ... at 00027858-00002708-48804-1623-00C86F80 Found API call GetVersionExW@KERNEL32.DLL (Target: "YoudaoDictInstaller.exe"; Stream UID: "00028375-00003684-44648-316-002DB53E") which is directly followed by "cmp dword ptr [ebp-00000120h], 06h" and "jne 002DB710h". See related instructions: "...+280 call dword ptr [00497494h] ;GetCurrentThreadId+286 mov dword ptr [esi+30h], eax+289 xor eax, eax+291 mov dword ptr [edi+04h], esi+294 xor edi, edi+296 mov dword ptr [esi+00000098h], eax+302 inc edi+303 lea eax, dword ptr [ebp-00000124h]+309 mov dword ptr [esi+44h], ebx+312 push eax+313 mov dword ptr [esi+00000080h], ebx+319 mov dword ptr [esi+68h], ebx+322 mov dword ptr [esi+6Ch], ebx+325 mov dword ptr [esi+58h], ebx+328 mov dword ptr [esi+64h], ebx+331 mov dword ptr [esi+54h], ebx+334 mov dword ptr [esi+0000008Ch], ebx+340 mov dword ptr [esi+5Ch], ebx+343 mov dword ptr [esi+48h], ebx+346 mov dword ptr [esi+00000094h], ebx+352 mov dword ptr [esi+00000090h], ebx+358 mov dword ptr [esi+00000084h], ebx+364 mov dword ptr [esi+00000088h], ebx+370 mov dword ptr [esi+74h], ebx+373 mov dword ptr [esi+78h], ebx+376 mov dword ptr [esi+0000009Ch], ebx+382 mov dword ptr [esi+000000A4h], ebx+388 mov dword ptr [esi+60h], ebx+391 mov dword ptr [esi+70h], ebx+394 mov dword ptr [esi+000000A0h], 00000200h+404 mov dword ptr [esi+000000ACh], ebx+410 mov dword ptr [esi+000000B0h], 000493E0h+420 mov dword ptr [esi+000000B4h], edi+426 mov dword ptr [ebp-00000124h], 00000114h+436 call dword ptr [0049742Ch] ;GetVersionExW+442 cmp dword ptr [ebp-00000120h], 06h+449 jne 002DB710h" ... at 00028375-00003684-44648-316-002DB53E Found API call GetVersionExW@KERNEL32.DLL (Target: "YoudaoDictInstaller.exe"; Stream UID: "00028375-00003684-44648-1277-0047E120") which is directly followed by "cmp eax, 02h" and "jne 0047E180h". See related instructions: "...+33 lea eax, dword ptr [ebp-00000118h]+39 mov dword ptr [ebp-00000118h], 00000114h+49 push eax+50 call dword ptr [0049742Ch] ;GetVersionExW+56 xor eax, eax+58 cmp dword ptr [ebp-00000108h], 02h+65 sete al+68 inc eax+69 mov dword ptr [0050BD18h], eax+74 cmp eax, 02h+77 mov eax, dword ptr [00500E1Ch]+82 push 00000000h+84 jne 0047E180h" ... at 00028375-00003684-44648-1277-0047E120 Found API call GetVersionExW@KERNEL32.DLL (Target: "YoudaoDictInstaller.exe"; Stream UID: "00028375-00003684-44648-1557-0043F570") which is directly followed by "cmp eax, 02h" and "jne 0043F62Bh". See related instructions: "...+80 lea eax, dword ptr [ebp-00000220h]+86 mov dword ptr [ebp-00000220h], 00000114h+96 push eax+97 call dword ptr [0049742Ch] ;GetVersionExW+103 xor eax, eax+105 cmp dword ptr [ebp-00000210h], 02h+112 sete al+115 inc eax+116 mov dword ptr [0050BD18h], eax+121 cmp eax, 02h+124 jne 0043F62Bh" ... at 00028375-00003684-44648-1557-0043F570 Found API call GetSystemTime@KERNEL32.DLL (Target: "YoudaoDictInstaller.exe"; Stream UID: "00028375-00003684-44648-1623-00426F80") which is directly followed by "cmp eax, 04h" and "jc 00426FCDh". See related instructions: "...+32 lea eax, dword ptr [ebp-14h]+35 push eax+36 call dword ptr [004973FCh] ;GetSystemTime+42 movdqu xmm0, dqword ptr [ebp-14h]+47 mov esi, 00000010h+52 movdqu dqword ptr [ebx], xmm0+56 mov eax, edi+58 sub eax, esi+60 cmp eax, 04h+63 jc 00426FCDh" ... at 00028375-00003684-44648-1623-00426F80 Found API call GetVersionExW@KERNEL32.DLL (Target: "YoudaoDictInstaller.exe"; Stream UID: "00028375-00003684-44648-1568-0043E400") which is directly followed by "cmp ecx, 02h" and "jne 0043E4A1h". See related instructions: "...+50 lea eax, dword ptr [ebp-00000118h]+56 mov dword ptr [ebp-00000118h], 00000114h+66 push eax+67 call dword ptr [0049742Ch] ;GetVersionExW+73 xor ecx, ecx+75 cmp dword ptr [ebp-00000108h], 02h+82 sete cl+85 inc ecx+86 mov dword ptr [0050BD18h], ecx+92 push ebx+93 push 00000000h+95 push 00000000h+97 cmp ecx, 02h+100 jne 0043E4A1h" ... at 00028375-00003684-44648-1568-0043E400 Found API call GetVersionExW@KERNEL32.DLL (Target: "YoudaoDictInstaller.exe"; Stream UID: "00028375-00003684-44648-1662-00424D30") which is directly followed by "cmp eax, 02h" and "jne 00424DE6h". See related instructions: "...+77 lea eax, dword ptr [ebp-00000118h]+83 mov dword ptr [ebp-00000118h], 00000114h+93 push eax+94 call dword ptr [0049742Ch] ;GetVersionExW+100 xor eax, eax+102 cmp dword ptr [ebp-00000108h], 02h+109 sete al+112 inc eax+113 mov dword ptr [0050BD18h], eax+118 push ebx+119 cmp eax, 02h+122 jne 00424DE6h" ... at 00028375-00003684-44648-1662-00424D30 Found API call GetVersionExW@KERNEL32.DLL (Target: "YoudaoDictInstaller.exe"; Stream UID: "00028375-00003684-44648-1561-0043EE60") which is directly followed by "cmp eax, 02h" and "jne 0043EEF7h". See related instructions: "...+39 lea eax, dword ptr [ebp-00000118h]+45 mov dword ptr [ebp-00000118h], 00000114h+55 push eax+56 call dword ptr [0049742Ch] ;GetVersionExW+62 xor eax, eax+64 cmp dword ptr [ebp-00000108h], 02h+71 sete al+74 inc eax+75 mov dword ptr [0050BD18h], eax+80 cmp eax, 02h+83 jne 0043EEF7h" ... at 00028375-00003684-44648-1561-0043EE60 Found API call GetVersionExW@KERNEL32.DLL (Target: "YoudaoDictInstaller.exe"; Stream UID: "00028375-00003684-44648-1606-004313A0") which is directly followed by "cmp eax, 02h" and "jne 00431406h". See related instructions: "...+32 lea eax, dword ptr [ebp-00000118h]+38 mov dword ptr [ebp-00000118h], 00000114h+48 push eax+49 call dword ptr [0049742Ch] ;GetVersionExW+55 xor eax, eax+57 cmp dword ptr [ebp-00000108h], 02h+64 sete al+67 inc eax+68 mov dword ptr [0050BD18h], eax+73 cmp eax, 02h+76 jne 00431406h" ... at 00028375-00003684-44648-1606-004313A0 Found API call GetVersionExW@KERNEL32.DLL (Target: "YoudaoDictInstaller.exe"; Stream UID: "00028375-00003684-44648-8167-00425190") which is directly followed by "cmp eax, 02h" and "jne 00425216h". See related instructions: "...+78 lea eax, dword ptr [ebp-00000118h]+84 mov dword ptr [ebp-00000118h], 00000114h+94 push eax+95 call dword ptr [0049742Ch] ;GetVersionExW+101 xor eax, eax+103 cmp dword ptr [ebp-00000108h], 02h+110 sete al+113 inc eax+114 mov dword ptr [0050BD18h], eax+119 push edi+120 push esi+121 cmp eax, 02h+124 jne 00425216h" ... at 00028375-00003684-44648-8167-00425190 Found API call GetVersionExW@KERNEL32.DLL (Target: "YoudaoDictInstaller.exe"; Stream UID: "00028375-00003684-44648-8154-0043F410") which is directly followed by "cmp ecx, 02h" and "jne 0043F4E5h". See related instructions: "...+100 lea eax, dword ptr [ebp-00000220h]+106 mov dword ptr [ebp-00000220h], 00000114h+116 push eax+117 call dword ptr [0049742Ch] ;GetVersionExW+123 xor ecx, ecx+125 cmp dword ptr [ebp-00000210h], 02h+132 sete cl+135 inc ecx+136 mov dword ptr [0050BD18h], ecx+142 mov eax, esi+144 push edi+145 cmp ecx, 02h+148 jne 0043F4E5h" ... at 00028375-00003684-44648-8154-0043F410 Found API call GetVersionExW@KERNEL32.DLL (Target: "YoudaoDictInstaller.exe"; Stream UID: "00028375-00003684-44648-8155-004256E0") which is directly followed by "cmp ecx, 02h" and "jne 004257ABh". See related instructions: "...+55 lea eax, dword ptr [ebp-00000118h]+61 mov dword ptr [ebp-00000118h], 00000114h+71 push eax+72 call dword ptr [0049742Ch] ;GetVersionExW+78 xor ecx, ecx+80 cmp dword ptr [ebp-00000108h], 02h+87 sete cl+90 inc ecx+91 mov dword ptr [0050BD18h], ecx+97 push 00000000h+99 push 00000000h+101 push 00000000h+103 push esi+104 cmp ecx, 02h+107 jne 004257ABh" ... at 00028375-00003684-44648-8155-004256E0 Found API call GetVersionExW@KERNEL32.DLL (Target: "YoudaoDictInstaller.exe"; Stream UID: "00028375-00003684-44648-8153-004242F0") which is directly followed by "cmp eax, 02h" and "jne 0042443Bh". See related instructions: "...+250 lea eax, dword ptr [ebp-00000220h]+256 mov dword ptr [ebp-00000220h], 00000114h+266 push eax+267 call dword ptr [0049742Ch] ;GetVersionExW+273 mov ecx, dword ptr [ebp-00000228h]+279 xor eax, eax+281 cmp dword ptr [ebp-00000210h], 02h+288 mov edx, dword ptr [ebp-00000240h]+294 sete al+297 inc eax+298 mov dword ptr [0050BD18h], eax+303 push 00000000h+305 push dword ptr [ebp-00000224h]+311 push edi+312 push 00000000h+314 push 00000003h+316 push edx+317 push ecx+318 cmp eax, 02h+321 jne 0042443Bh" ... at 00028375-00003684-44648-8153-004242F027:T560,GetProcessHeap@KERNEL32.DLL at 00027858-00002708-48804-369-00C68C2C GetProcessHeap@KERNEL32.DLL at 00027858-00002708-48804-2213-00C77D86 GetProcessHeap@KERNEL32.DLL at 00028375-00003684-44648-369-00408C2C GetProcessHeap@KERNEL32.DLL at 00028375-00003684-44648-2213-00417D86 GetProcessHeap@KERNEL32.DLL at 00028549-00002412-19493-72-00E22670 GetProcessHeap@KERNEL32.DLL at 00028549-00002412-19493-237-00E2BE2D GetProcessHeap@KERNEL32.DLL at 00029455-00002592-22785-72-00052670 GetProcessHeap@KERNEL32.DLL at 00029455-00002592-22785-237-0005BE2D GetProcessHeap@KERNEL32.DLL at 00029976-00003068-25626-72-01172670 GetProcessHeap@KERNEL32.DLL at 00029976-00003068-25626-237-0117BE2D GetProcessHeap@KERNEL32.DLL at 00030494-00003012-28446-72-01172670 GetProcessHeap@KERNEL32.DLL at 00030494-00003012-28446-237-0117BE2D GetProcessHeap@KERNEL32.DLL at 00031009-00002696-31441-72-00392670 GetProcessHeap@KERNEL32.DLL at 00031009-00002696-31441-237-0039BE2D GetProcessHeap@KERNEL32.DLL at 00031557-00003768-36408-369-00488C2C GetProcessHeap@KERNEL32.DLL at 00031557-00003768-36408-2213-00497D86 GetProcessHeap@KERNEL32.DLL at 00033793-00001772-34851-369-003A8C2C GetProcessHeap@KERNEL32.DLL at 00033793-00001772-34851-2213-003B7D86 GetProcessHeap@KERNEL32.DLL at 00034316-00002720-6932-369-00248C2C GetProcessHeap@KERNEL32.DLL at 00034316-00002720-6932-2216-00257D8628:T5aa,"" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE"; Key: "PATH"; Value: "00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\网易有道词典") "" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\网易有道词典") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\有道词典BETA版") "" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\有道词典BETA版") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\有道词典") "" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\有道词典") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\有道桌面词典") "" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\有道桌面词典") "InstallHelper.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\INSTALLHELPER.EXE") "InstallHelper.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\INSTALLHELPER.EXE")29:T588,"SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0" "SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'" "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" "UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;" "UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;" "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" "CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);" "CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));" "CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);" "CREATE TABLE %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);" "UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');"2a:T5b5,"" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nsiC83D.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\YoudaoDictInstaller.exe" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\checkbox.bmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\checkbox_null.bmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\checkbox_license.bmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\checkbox_license_null.bmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\checkbox_bind.bmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\checkbox_bind_null.bmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\SkinBtn.dll" "" created file "C:\Users\jDJOPbh\AppData\Local\Temp\nscC852.tmp\SkinBtn.dll" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\btn_close.bmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\bg.bmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\bg_extend.bmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\btn_install.bmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\btn_custom1.bmp"2b:T61b,Antivirus vendors marked dropped file "Acrobat2Dict.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "YoudaoCookieAssist.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "iconfont.svg" as clean (type is "SVG Scalable Vector Graphics image"), Antivirus vendors marked dropped file "YoudaoGetWord64.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "SkinBtn.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "nsDialogs.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "libtiff.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "YoudaoEH.exe" as clean (type is "PE32+ executable (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "WordStrokeHelper64.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "TextExtractorImpl64.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "LockedList.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "OP_ProgressBar.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows")2c:T9b4,Spawned process "YoudaoDictInstaller.exe" with commandline ""nsiinstall" "%TEMP%\nscC852.tmp\install.ini" "0"" (UID: 00027858-00002708) Spawned process "YoudaoDictInstaller.exe" with commandline "rundicttask * "%LOCALAPPDATA%\Youdao\Dict\Application\YoudaoDict.exe" "0"" (UID: 00028375-00003684) Spawned process "InstallHelper.exe" with commandline ""exports" "%TEMP%\nscC852.tmp\dict.7z" "%LOCALAPPDATA%\Youdao\Dict\Application\install_7.5.2.0"" (UID: 00028549-00002412) Spawned process "InstallHelper.exe" with commandline ""move" "%LOCALAPPDATA%\Youdao\Dict\Application\install_7.5.2.0\YodaoDict.exe" "%LOCALAPPDATA%\Youdao\Dict\Application\YodaoDict.exe"" (UID: 00029455-00002592) Spawned process "InstallHelper.exe" with commandline ""move" "%LOCALAPPDATA%\Youdao\Dict\Application\install_7.5.2.0\YoudaoDict.exe" "%LOCALAPPDATA%\Youdao\Dict\Application\YoudaoDict.exe"" (UID: 00029976-00003068) Spawned process "InstallHelper.exe" with commandline ""move" "%LOCALAPPDATA%\Youdao\Dict\Application\install_7.5.2.0\7.5.2.0" "%LOCALAPPDATA%\Youdao\Dict\Application\7.5.2.0"" (UID: 00030494-00003012) Spawned process "InstallHelper.exe" with commandline ""move" "%LOCALAPPDATA%\Youdao\Dict\Application\install_7.5.2.0\Stable" "%LOCALAPPDATA%\Youdao\Dict\Application\Stable"" (UID: 00031009-00002696) Spawned process "YoudaoDictInstaller.exe" with commandline ""%TEMP%\nscC852.tmp\install.ini" "full" 0" (UID: 00031557-00003768) Spawned process "regsvr32.exe" with commandline ""%LOCALAPPDATA%\Youdao\Dict\Application\stable\YoudaoGetWord32.dll" /s" (UID: 00031876-00002520) Spawned process "regsvr32.exe" with commandline ""%LOCALAPPDATA%\Youdao\Dict\Application\stable\YoudaoGetWord64.dll" /s" (UID: 00031892-00003736) Spawned process "cmd.exe" with commandline "/c echo y| cacls "%ALLUSERSPROFILE%\Youdao\DeskDict\pluginconfig.ini" /c /g everyone:f" (UID: 00031930-00003812) Spawned process "cmd.exe" with commandline "/S /D /c" echo y"" (UID: 00031948-00003864) Spawned process "cacls.exe" with commandline "cacls "%ALLUSERSPROFILE%\Youdao\DeskDict\pluginconfig.ini" /c /g everyone:f" (UID: 00031954-00003716) Spawned process "InstallDaemon.exe" with commandline "GetSoftListADC softs.ini ${BIND_SOFT_URL}" (UID: 00032271-00003924) Spawned process "YoudaoDictInstaller.exe" with commandline ""cleanup" "%LOCALAPPDATA%\Youdao\Dict\Application"" (UID: 00033793-00001772) Spawned process "YoudaoDictInstaller.exe" with commandline "instreport" (UID: 00034316-00002720)2d:T62c,"YoudaoDictIcon.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "zlib1.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "Acrobat2Dict.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "libjpeg.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "ffmpegsumo.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "XDLL.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "tessdll.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "uninst.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "libzplay.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Monitor.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "YoudaoCookieAssist.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "npswf32.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "InstallHelper.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "TextExtractorImpl32.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "iconfont.svg" has type "SVG Scalable Vector Graphics image" "YoudaoGetWord64.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "SkinBtn.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "nsDialogs.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "libtiff.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"2e:T97d,Heuristic match: "#?])\u~.qa" Heuristic match: "*,mh,P#.ai" Heuristic match: "{@{]c2.uA" Heuristic match: "uZGb_%.vu" Heuristic match: "1N#O8S.jm" Heuristic match: "lAy5]cB.uG" Pattern match: "http://ocsp.thawte.com0" Pattern match: "http://crl.thawte.com/ThawteTimestampingCA.crl0" Pattern match: "http://ts-ocsp.ws.symantec.com07" Pattern match: "http://ts-aia.ws.symantec.com/tss-ca-g2.cer0" Pattern match: "http://ts-crl.ws.symantec.com/tss-ca-g2.crl0" Pattern match: "http://sv.symcb.com/sv.crl0a" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://sv.symcd.com0&" Pattern match: "http://sv.symcb.com/sv.crt0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://cidian.youdao.com/" Pattern match: "http://nsis.sf.net/NSIS_Error" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: s2.symcb.com" Pattern match: "http://www.symauth.com/rpa0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEA1%2FFA%2F9MAHTylYdN8RQIIk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: sv.symcd.com" Pattern match: "http://www.symauth.com/cps0*" Heuristic match: "cidian.youdao.com" Pattern match: "http://youdao.com/" Pattern match: "http://cidian.youdao.com/icomplete.html" Pattern match: "www.youdao.com" Pattern match: "dian.youdao.com/icomplete.html" Pattern match: "youdao.com/installbrowserextension.jsp?name=sogouExp" Pattern match: "udao.com/installbrowserextension.jsp?name=360se" Pattern match: "cidian.youdao.com/installbrowserextension.jsp?name=liebao" Pattern match: "http://cidian.youdao.com/help.jsp" Pattern match: "fanyi.youdao.com/translate_a?keyfrom=%s&version=2.1&client=%s&i=%s&from=%s&to=%s&doctype=json&salt=%s&sign=%s" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "http://toolbar.corp.youdao.com/profile.ini" Pattern match: "toolbar.corp.youdao.com/profile.ini" Pattern match: "http://cidian.youdao.com/uninstall.html?id=%s&keyfrom=deskdict.%s&vendor=%s"2f:T546,"YoudaoDictIcon.exe" was detected as "Visual C++ 2005 Release -> Microsoft" "Acrobat2Dict.dll" was detected as "Borland Delphi 3.0 (???)" "libjpeg.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "ffmpegsumo.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "XDLL.dll" was detected as "Armadillo v1.xx - v2.xx" "tessdll.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "uninst.exe" was detected as "VC8 -> Microsoft Corporation" "libzplay.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "Monitor.exe" was detected as "VC8 -> Microsoft Corporation" "YoudaoCookieAssist.exe" was detected as "Visual C++ 2005 Release -> Microsoft" "InstallHelper.exe" was detected as "VC8 -> Microsoft Corporation" "TextExtractorImpl32.dll" was detected as "Borland Delphi 3.0 (???)" "libtiff.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "YoudaoOcr.exe" was detected as "VC8 -> Microsoft Corporation" "text_extractor_host.exe" was detected as "VC8 -> Microsoft Corporation" "YoudaoDictInstaller.exe" was detected as "VC8 -> Microsoft Corporation" "icudt.dll" was detected as "Microsoft visual C++ vx.x DLL" "d3dcompiler_46.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "libGLESv2.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "InstallDaemon.exe" was detected as "VC8 -> Microsoft Corporation"30:T558,FindResourceW@KERNEL32.DLL at 00027858-00002708-48804-123-00B14830 LockResource@KERNEL32.DLL at 00027858-00002708-48804-128-00B14700 FindResourceW@KERNEL32.DLL at 00027858-00002708-48804-328-00B14770 FindResourceW@KERNEL32.DLL at 00027858-00002708-48804-1903-00B837C6 LockResource@KERNEL32.DLL at 00027858-00002708-48804-2430-00B3F8E9 FindResourceW@KERNEL32.DLL at 00027858-00002708-48804-2429-00B1C3B0 LockResource@KERNEL32.DLL at 00028375-00003684-44648-128-002B4700 FindResourceW@KERNEL32.DLL at 00028375-00003684-44648-123-002B4830 FindResourceW@KERNEL32.DLL at 00028375-00003684-44648-328-002B4770 FindResourceW@KERNEL32.DLL at 00028375-00003684-44648-1903-003237C6 FindResourceW@KERNEL32.DLL at 00028375-00003684-44648-2429-002BC3B0 LockResource@KERNEL32.DLL at 00028375-00003684-44648-2430-002DF8E9 FindResourceW@KERNEL32.DLL at 00028375-00003684-44648-2932-002E2ED6 FindResourceW@KERNEL32.DLL at 00028375-00003684-44648-2835-002DF5B6 FindResourceW@KERNEL32.DLL at 00028375-00003684-44648-2742-002DCCCF FindResourceW@KERNEL32.DLL at 00028375-00003684-44648-2836-002DF6B6 FindResourceW@KERNEL32.DLL at 00028375-00003684-44648-4989-0034293C FindResourceW@KERNEL32.DLL at 00028375-00003684-44648-4579-003E5396 FindResourceW@KERNEL32.DLL at 00028375-00003684-44648-4581-003FF028 FindResourceW@KERNEL32.DLL at 00028375-00003684-44648-4266-0031974231:T683,"YoudaoDictIcon.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "zlib1.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "Acrobat2Dict.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "libjpeg.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "ffmpegsumo.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "XDLL.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "tessdll.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "uninst.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "libzplay.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Monitor.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "YoudaoCookieAssist.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "npswf32.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "InstallHelper.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "TextExtractorImpl32.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "YoudaoGetWord64.dll" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "SkinBtn.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "nsDialogs.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "libtiff.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "YoudaoEH.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows" "YoudaoOcr.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"32:T572,GetAsyncKeyState@USER32.DLL at 00017767-00003368-40555-88-00404605 GetAsyncKeyState@USER32.DLL at 00017767-00003368-45790-88-00404605 GetKeyboardState@USER32.DLL at 00028375-00003684-44648-4786-0034C033 GetAsyncKeyState@USER32.DLL at 00028375-00003684-44648-4790-0034406B GetAsyncKeyState@USER32.DLL at 00028375-00003684-44648-4177-00314A3B GetAsyncKeyState@USER32.DLL at 00028375-00003684-44648-4783-0034C26C GetAsyncKeyState@USER32.DLL at 00028375-00003684-44648-4239-003180E0 GetAsyncKeyState@USER32.DLL at 00028375-00003684-44648-4672-00335020 GetAsyncKeyState@USER32.DLL at 00028375-00003684-44648-4776-0038A9B4 GetAsyncKeyState@USER32.DLL at 00028375-00003684-44648-4256-00318BD7 GetAsyncKeyState@USER32.DLL at 00028375-00003684-44648-5656-0036AC7F GetAsyncKeyState@USER32.DLL at 00028375-00003684-44648-5605-00392E73 GetAsyncKeyState@USER32.DLL at 00028375-00003684-44648-6443-00395798 GetAsyncKeyState@USER32.DLL at 00028375-00003684-44648-6851-003B0CDC GetAsyncKeyState@USER32.DLL at 00028375-00003684-44648-7114-003C6E9B GetAsyncKeyState@USER32.DLL at 00028375-00003684-44648-7240-003D0CFD GetAsyncKeyState@USER32.DLL at 00028375-00003684-44648-7154-003CB274 GetAsyncKeyState@USER32.DLL at 00028375-00003684-44648-7235-003D03F6 GetAsyncKeyState@USER32.DLL at 00028375-00003684-44648-7211-003CEE23 GetAsyncKeyState@USER32.DLL at 00028375-00003684-44648-7821-003D004733:T4ac,"C:\b7a1a5901b93f80a699fdac1ad2896bb8abf6cb98b51fcc9fb0408c5d48e141f.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsfC665.tmp" for deletion "C:\b7a1a5901b93f80a699fdac1ad2896bb8abf6cb98b51fcc9fb0408c5d48e141f.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp" for deletion "C:\b7a1a5901b93f80a699fdac1ad2896bb8abf6cb98b51fcc9fb0408c5d48e141f.exe" marked "C:\Users\%OSUSER%\AppData\Local\youdao\dict\Application\installertest.dat" for deletion "C:\b7a1a5901b93f80a699fdac1ad2896bb8abf6cb98b51fcc9fb0408c5d48e141f.exe" marked "C:\Users\%OSUSER%\AppData\Local\youdao\dict\Application\7.5.2.0\fullversions.xml" for deletion "C:\b7a1a5901b93f80a699fdac1ad2896bb8abf6cb98b51fcc9fb0408c5d48e141f.exe" marked "C:\Users\%OSUSER%\AppData\Local\youdao\dict\Application\install_7.5.2.0" for deletion "%LOCALAPPDATA%\youdao\dict\Application\7.5.2.0\YoudaoDictInstaller.exe" marked "C:\Users\%OSUSER%\AppData\Local\youdao\dict\Application\7.5.2.0\default_config.ini" for deletion "%LOCALAPPDATA%\youdao\dict\Application\7.5.2.0\YoudaoDictInstaller.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7N5LGTOO\icomplete[1].htm" for deletion34:T53c,"" opened "C:\Users\jDJOPbh\AppData\Local\Temp\nsfC665.tmp" with delete access "" opened "C:\Users\jDJOPbh\AppData\Local\Temp\nscC852.tmp" with delete access "" opened "C:\Users\jDJOPbh\AppData\Local\Youdao\Dict\Application\installertest.dat" with delete access "" opened "C:\Users\jDJOPbh\AppData\Local\Youdao\Dict\Application\7.5.2.0\fullversions.xml" with delete access "" opened "C:\Users\jDJOPbh\AppData\Local\Youdao\Dict\Application\install_7.5.2.0\" with delete access "InstallHelper.exe" opened "C:\Users\%OSUSER%\AppData\Local\youdao\dict\Application\install_7.5.2.0\YodaoDict.exe" with delete access "InstallHelper.exe" opened "C:\Users\%OSUSER%\AppData\Local\youdao\dict\Application\install_7.5.2.0\YoudaoDict.exe" with delete access "InstallHelper.exe" opened "C:\Users\%OSUSER%\AppData\Local\youdao\dict\Application\install_7.5.2.0\7.5.2.0" with delete access "InstallHelper.exe" opened "C:\Users\%OSUSER%\AppData\Local\youdao\dict\Application\install_7.5.2.0\Stable" with delete access "YoudaoDictInstaller.exe" opened "C:\Users\jDJOPbh\AppData\Local\Youdao\Dict\Application\7.5.2.0\default_config.ini" with delete access "YoudaoDictInstaller.exe" opened "C:\Users\jDJOPbh\AppData\Local\Temp\nscC852.tmp\plug_ins\YodaoDict.api" with delete access35:T571,"zlib1.dll" claimed CRC 83488 while the actual is CRC 174920 "Acrobat2Dict.dll" claimed CRC 1810241 while the actual is CRC 83488 "libjpeg.dll" claimed CRC 197859 while the actual is CRC 1810241 "ffmpegsumo.dll" claimed CRC 1669284 while the actual is CRC 197859 "XDLL.dll" claimed CRC 159353 while the actual is CRC 1669284 "tessdll.dll" claimed CRC 2241233 while the actual is CRC 159353 "uninst.exe" claimed CRC 2195153 while the actual is CRC 2241233 "libzplay.dll" claimed CRC 2400474 while the actual is CRC 2195153 "Monitor.exe" claimed CRC 325097 while the actual is CRC 2400474 "YoudaoCookieAssist.exe" claimed CRC 106091 while the actual is CRC 325097 "npswf32.dll" claimed CRC 9624523 while the actual is CRC 106091 "InstallHelper.exe" claimed CRC 174889 while the actual is CRC 4197607 "TextExtractorImpl32.dll" claimed CRC 2098651 while the actual is CRC 174889 "YoudaoGetWord64.dll" claimed CRC 441179 while the actual is CRC 2098651 "libtiff.dll" claimed CRC 287983 while the actual is CRC 16010 "YoudaoEH.exe" claimed CRC 2850500 while the actual is CRC 287983 "YoudaoOcr.exe" claimed CRC 5134620 while the actual is CRC 2850500 "WordStrokeHelper64.dll" claimed CRC 140817 while the actual is CRC 5134620 "TextExtractorImpl64.dll" claimed CRC 2838792 while the actual is CRC 140817 "text_extractor_host.exe" claimed CRC 286812 while the actual is CRC 283879236:T595,WriteProcessMemory VirtualAllocEx IsDebuggerPresent GetTickCount OpenProcess LockResource GetModuleHandleW UnhandledExceptionFilter GetStartupInfoW ReadProcessMemory GetProcAddress TerminateProcess FindResourceW Sleep GetWindowThreadProcessId FindWindowW FindWindowExW RegCreateKeyExW RegDeleteValueW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegDeleteKeyW GetFileAttributesW FindResourceExW OutputDebugStringA CopyFileW OutputDebugStringW GetModuleFileNameW GetModuleFileNameA LoadLibraryExW CreateThread ExitThread GetModuleHandleExW LoadLibraryW GetVersionExW VirtualProtect LoadLibraryA GetFileSize GetTempFileNameW WriteFile GetFileSizeEx FindFirstFileW CreateFileW GetCommandLineA GetModuleHandleA GetFileAttributesExW GetTempPathW VirtualAlloc ShellExecuteW SetWindowsHookExW GetUpdateRect GetLastActivePopup GetStartupInfoA CreateFileA FindFirstFileA FindNextFileA CreateProcessA socket send WSAStartup connect recv RegEnumKeyW DeviceIoControl CreateDirectoryW DeleteFileW FindNextFileW GetCommandLineW ShellExecuteExW GetVersionExA CreateFileMappingW MapViewOfFile CreateProcessW InternetOpenW InternetCloseHandle InternetOpenUrlW closesocket OpenProcessToken CreateProcessAsUserW OpenFileMappingA GetThreadContext CreateToolhelp32Snapshot VirtualProtectEx OpenFileMappingW GetFileAttributesA GetTempPathA DeleteFileA GetTempFileNameA37:T81d,"" wrote bytes "c4ca717680bb7176aa6e72769fbb717608bb717646ce717661387276de2f7276d0d97176000000001779b9764f91b9767f6fb976f4f7b97611f7b976f283b976857eb97600000000" to virtual address "0x733C1000" (part of module "MSIMG32.DLL") "" wrote bytes "0857fa76047803770000000051c1cf779498cf77ee9ccf7775dcd177273ed177efb2d5770000000046ce7176013d727638ed7276cfcd717631237176de2f7276c4ca717680bb7176aa6e72769fbb717692bb717646ba71760abf717600000000" to virtual address "0x73311000" (part of module "SHFOLDER.DLL") "" wrote bytes "9498cf7751c1cf77efb2d577ee9ccf7775dcd1779097cf771099cf7700000000013d727638ed7276cfcd717631237176de2f7276c4ca717680bb7176aa6e72769fbb7176707f707692bb717646ba71760abf717600000000" to virtual address "0x705F1000" (part of module "MSLS31.DLL") "YoudaoDictInstaller.exe" wrote bytes "4053ba775858bb77186abb77653cbc770000000000bf71760000000056cc7176000000007cca7176000000003768f4756a2cbc77d62dbc77000000002069f4750000000029a6717600000000a48df47500000000f70e717600000000" to virtual address "0x77CC1000" (part of module "NSI.DLL") "YoudaoDictInstaller.exe" wrote bytes "c4ca717680bb7176aa6e72769fbb717608bb717646ce717661387276de2f7276d0d97176000000001779b9764f91b9767f6fb976f4f7b97611f7b976f283b976857eb97600000000" to virtual address "0x733C1000" (part of module "MSIMG32.DLL") "YoudaoDictInstaller.exe" wrote bytes "92e6b77779a8bc77be72bc77d62dbc771de2b77705a2bc77bee3b777616fbc776841ba770050ba7700000000ad3780768b2d8076b641807600000000" to virtual address "0x751C1000" (part of module "WSHTCPIP.DLL") "YoudaoDictInstaller.exe" wrote bytes "7739b87779a8bc77be72bc77d62dbc771de2b77705a2bc77c868bb7757d1c277bee3b777616fbc776841ba770050ba7700000000ad3780768b2d8076b641807600000000" to virtual address "0x756F1000" (part of module "WSHIP6.DLL") "InstallDaemon.exe" wrote bytes "4053ba775858bb77186abb77653cbc770000000000bf71760000000056cc7176000000007cca7176000000003768f4756a2cbc77d62dbc77000000002069f4750000000029a6717600000000a48df47500000000f70e717600000000" to virtual address "0x77CC1000" (part of module "NSI.DLL")38:Td70,3/68 Antivirus vendors marked dropped file "YoudaoDictIcon.exe" as malicious (classified as "PUA.Youdao" with 4% detection rate) 1/66 Antivirus vendors marked dropped file "zlib1.dll" as malicious (classified as "Adware.MobogenieCRTD" with 1% detection rate) 2/73 Antivirus vendors marked dropped file "libjpeg.dll" as malicious (classified as "Adware.MobogenieCRTD" with 2% detection rate) 1/66 Antivirus vendors marked dropped file "ffmpegsumo.dll" as malicious (classified as "Adware.MobogenieCRTD" with 1% detection rate) 1/67 Antivirus vendors marked dropped file "XDLL.dll" as malicious (classified as "Adware.MobogenieCRTD" with 1% detection rate) 1/67 Antivirus vendors marked dropped file "tessdll.dll" as malicious (classified as "Adware.MobogenieCRTD" with 1% detection rate) 2/73 Antivirus vendors marked dropped file "uninst.exe" as malicious (classified as "Adware.MobogenieCRTD" with 2% detection rate) 1/67 Antivirus vendors marked dropped file "libzplay.dll" as malicious (classified as "Adware.MobogenieCRTD" with 1% detection rate) 3/68 Antivirus vendors marked dropped file "Monitor.exe" as malicious (classified as "Adware.MobogenieCRTD" with 4% detection rate) 1/68 Antivirus vendors marked dropped file "InstallHelper.exe" as malicious (classified as "Adware.MobogenieCRTD" with 1% detection rate) 1/67 Antivirus vendors marked dropped file "TextExtractorImpl32.dll" as malicious (classified as "Adware.MobogenieCRTD" with 1% detection rate) 2/67 Antivirus vendors marked dropped file "YoudaoOcr.exe" as malicious (classified as "Adware.MobogenieCRTD" with 2% detection rate) 3/68 Antivirus vendors marked dropped file "text_extractor_host.exe" as malicious (classified as "Youdao.A potentially unwanted" with 4% detection rate) 2/67 Antivirus vendors marked dropped file "YoudaoDictInstaller.exe" as malicious (classified as "Youdao.A potentially unwanted" with 2% detection rate) 1/67 Antivirus vendors marked dropped file "d3dcompiler_46.dll" as malicious (classified as "Adware.MobogenieCRTD" with 1% detection rate) 1/67 Antivirus vendors marked dropped file "libGLESv2.dll" as malicious (classified as "Adware.MobogenieCRTD" with 1% detection rate) 2/67 Antivirus vendors marked dropped file "InstallDaemon.exe" as malicious (classified as "Youdao.A potentially unwanted" with 2% detection rate) 1/67 Antivirus vendors marked dropped file "leptonica.dll" as malicious (classified as "Adware.MobogenieCRTD" with 1% detection rate) 3/66 Antivirus vendors marked dropped file "CrashRpt.dll" as malicious (classified as "PUA.Youdao" with 4% detection rate) 2/65 Antivirus vendors marked dropped file "YoudaoToolbar.exe" as malicious (classified as "Suspected of Trojan.Downloader.gen" with 3% detection rate) 2/72 Antivirus vendors marked dropped file "YoudaoGetWord32.dll" as malicious (classified as "Adware.MobogenieCRTD" with 2% detection rate) 1/66 Antivirus vendors marked dropped file "libpng.dll" as malicious (classified as "Adware.MobogenieCRTD" with 1% detection rate) 1/67 Antivirus vendors marked dropped file "YDFFMiddleware.dll" as malicious (classified as "Trojan.GamaniaCRTD" with 1% detection rate) 1/67 Antivirus vendors marked dropped file "YoudaoDictHelper.exe" as malicious (classified as "Adware.MobogenieCRTD" with 1% detection rate) 2/74 Antivirus vendors marked dropped file "YodaoDict.exe" as malicious (classified as "Adware.MobogenieCRTD" with 2% detection rate)39:T6f0,2/67 Antivirus vendors marked spawned process "YoudaoDictInstaller.exe" (PID: 2708) as malicious (classified as "Youdao.A potentially unwanted" with 2% detection rate) 2/67 Antivirus vendors marked spawned process "YoudaoDictInstaller.exe" (PID: 3684) as malicious (classified as "Youdao.A potentially unwanted" with 2% detection rate) 1/68 Antivirus vendors marked spawned process "InstallHelper.exe" (PID: 2412) as malicious (classified as "Adware.MobogenieCRTD" with 1% detection rate) 1/68 Antivirus vendors marked spawned process "InstallHelper.exe" (PID: 2592) as malicious (classified as "Adware.MobogenieCRTD" with 1% detection rate) 1/68 Antivirus vendors marked spawned process "InstallHelper.exe" (PID: 3068) as malicious (classified as "Adware.MobogenieCRTD" with 1% detection rate) 1/68 Antivirus vendors marked spawned process "InstallHelper.exe" (PID: 3012) as malicious (classified as "Adware.MobogenieCRTD" with 1% detection rate) 1/68 Antivirus vendors marked spawned process "InstallHelper.exe" (PID: 2696) as malicious (classified as "Adware.MobogenieCRTD" with 1% detection rate) 2/67 Antivirus vendors marked spawned process "YoudaoDictInstaller.exe" (PID: 3768) as malicious (classified as "Youdao.A potentially unwanted" with 2% detection rate) 2/67 Antivirus vendors marked spawned process "InstallDaemon.exe" (PID: 3924) as malicious (classified as "Youdao.A potentially unwanted" with 2% detection rate) 2/67 Antivirus vendors marked spawned process "YoudaoDictInstaller.exe" (PID: 1772) as malicious (classified as "Youdao.A potentially unwanted" with 2% detection rate) 2/67 Antivirus vendors marked spawned process "YoudaoDictInstaller.exe" (PID: 2720) as malicious (classified as "Youdao.A potentially unwanted" with 2% detection rate)3a:Tf69,"" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\YoudaoDictInstaller.exe" (Handle: 536) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\YoudaoDictInstaller.exe" (Handle: 536) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\YoudaoDictInstaller.exe" (Handle: 536) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\YoudaoDictInstaller.exe" (Handle: 536) "" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\YoudaoDictInstaller.exe" (Handle: 544) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\YoudaoDictInstaller.exe" (Handle: 544) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\YoudaoDictInstaller.exe" (Handle: 544) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\YoudaoDictInstaller.exe" (Handle: 544) "" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\InstallHelper.exe" (Handle: 536) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\InstallHelper.exe" (Handle: 536) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\InstallHelper.exe" (Handle: 536) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\InstallHelper.exe" (Handle: 536) "" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\InstallHelper.exe" (Handle: 564) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\InstallHelper.exe" (Handle: 564) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\InstallHelper.exe" (Handle: 564) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\InstallHelper.exe" (Handle: 564) "" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\InstallHelper.exe" (Handle: 336) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\InstallHelper.exe" (Handle: 336) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\InstallHelper.exe" (Handle: 336) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\InstallHelper.exe" (Handle: 336) "" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\InstallHelper.exe" (Handle: 440) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\InstallHelper.exe" (Handle: 440) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\InstallHelper.exe" (Handle: 440) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nscC852.tmp\InstallHelper.exe" (Handle: 440) "" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\youdao\dict\Application\7.5.2.0\YoudaoDictInstaller.exe" (Handle: 564) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\youdao\dict\Application\7.5.2.0\YoudaoDictInstaller.exe" (Handle: 564) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\youdao\dict\Application\7.5.2.0\YoudaoDictInstaller.exe" (Handle: 564) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\youdao\dict\Application\7.5.2.0\YoudaoDictInstaller.exe" (Handle: 564)3b:T9ef,Spawned process "" (UID: 00017767-00003368) Spawned process "YoudaoDictInstaller.exe" with commandline ""nsiinstall" "%TEMP%\nscC852.tmp\install.ini" "0"" (UID: 00027858-00002708) Spawned process "YoudaoDictInstaller.exe" with commandline "rundicttask * "%LOCALAPPDATA%\Youdao\Dict\Application\YoudaoDict.exe" "0"" (UID: 00028375-00003684) Spawned process "InstallHelper.exe" with commandline ""exports" "%TEMP%\nscC852.tmp\dict.7z" "%LOCALAPPDATA%\Youdao\Dict\Application\install_7.5.2.0"" (UID: 00028549-00002412) Spawned process "InstallHelper.exe" with commandline ""move" "%LOCALAPPDATA%\Youdao\Dict\Application\install_7.5.2.0\YodaoDict.exe" "%LOCALAPPDATA%\Youdao\Dict\Application\YodaoDict.exe"" (UID: 00029455-00002592) Spawned process "InstallHelper.exe" with commandline ""move" "%LOCALAPPDATA%\Youdao\Dict\Application\install_7.5.2.0\YoudaoDict.exe" "%LOCALAPPDATA%\Youdao\Dict\Application\YoudaoDict.exe"" (UID: 00029976-00003068) Spawned process "InstallHelper.exe" with commandline ""move" "%LOCALAPPDATA%\Youdao\Dict\Application\install_7.5.2.0\7.5.2.0" "%LOCALAPPDATA%\Youdao\Dict\Application\7.5.2.0"" (UID: 00030494-00003012) Spawned process "InstallHelper.exe" with commandline ""move" "%LOCALAPPDATA%\Youdao\Dict\Application\install_7.5.2.0\Stable" "%LOCALAPPDATA%\Youdao\Dict\Application\Stable"" (UID: 00031009-00002696) Spawned process "YoudaoDictInstaller.exe" with commandline ""%TEMP%\nscC852.tmp\install.ini" "full" 0" (UID: 00031557-00003768) Spawned process "regsvr32.exe" with commandline ""%LOCALAPPDATA%\Youdao\Dict\Application\stable\YoudaoGetWord32.dll" /s" (UID: 00031876-00002520) Spawned process "regsvr32.exe" with commandline ""%LOCALAPPDATA%\Youdao\Dict\Application\stable\YoudaoGetWord64.dll" /s" (UID: 00031892-00003736) Spawned process "cmd.exe" with commandline "/c echo y| cacls "%ALLUSERSPROFILE%\Youdao\DeskDict\pluginconfig.ini" /c /g everyone:f" (UID: 00031930-00003812) Spawned process "cmd.exe" with commandline "/S /D /c" echo y"" (UID: 00031948-00003864) Spawned process "cacls.exe" with commandline "cacls "%ALLUSERSPROFILE%\Youdao\DeskDict\pluginconfig.ini" /c /g everyone:f" (UID: 00031954-00003716) Spawned process "InstallDaemon.exe" with commandline "GetSoftListADC softs.ini ${BIND_SOFT_URL}" (UID: 00032271-00003924) Spawned process "YoudaoDictInstaller.exe" with commandline ""cleanup" "%LOCALAPPDATA%\Youdao\Dict\Application"" (UID: 00033793-00001772) Spawned process "YoudaoDictInstaller.exe" with commandline "instreport" (UID: 00034316-00002720)3c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAJmZmZmZmZmZmZmZmZmZAAmZmZmZmZmZmZmZmZmZmZCZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmJmZmZj4mZmZeP//95mZmZ/5mZ///5mZj//////5mZmY+Jn/mf+Z//+JmZmZf4mZmf+Z95n/j/+Zf///+JmJmZn/mf+Z////mfiZl/+ZmZmZ//n///+ZmJn/mZn/mZmZmf//mZn/mZ+Z+P///5mZmPmPf/iZ/5n/mf+Zmf+ZmZmP/4mP//+Z+Jn4////mZmZmP/3mZn/mZmJ+Zl3/5mZmZn/j////5mf+f////+ZmZmZn5mZmZmZ/4mZn/eZmZmZn//4iIiHmYef////iIeZmZiI//j///iZmIj4j/j/mZmZmX/5mZmZmZmY+J//mZmZmZmYiZmZmZmZmYeZ95mZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZCZmZmZmZmZmZmZmZmZmZkACZmZmZmZmZmZmZmZmZmQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"b7a1a5901b93f80a699fdac1ad2896bb8abf6cb98b51fcc9fb0408c5d48e141f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790269361492,"unified_at":"2026-09-24T17:02:41.492Z","metadata":{"hashes":{"sha256":"b7a1a5901b93f80a699fdac1ad2896bb8abf6cb98b51fcc9fb0408c5d48e141f","sha1":"0bd72b9936b197b15315c8aafc2f74e2b8ab2884","md5":"ddfa36c49dd9aba8cb5de535b2ff89f5","sha512":"37700495858b04295ddbc54133c7a93ae1dbf65e1bb9ea165dbdfbcd1b32d67b38482e7059b04ba6dc2096edcea98a88c343eb1afc43f3476f729307be7e239d","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"YoudaoDict.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":38036400,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1516816405000,"last_seen":1768551306000,"last_multi_scan":1768551306000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["quarian"]},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":30,"suspicious_count":24,"malicious_count":9,"total":63},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Adware.MobogenieCRTD.Win32.11272","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Adware.MobogenieCRTD","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"$22","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero\n Raw size of \".data\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"$23","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00027858-00002708-48804-1519-00C6D523\n GetTimeZoneInformation@KERNEL32.DLL at 00028375-00003684-44648-1519-0040D523\n GetTimeZoneInformation@KERNEL32.DLL at 00031557-00003768-36408-1519-0048D523\n GetTimeZoneInformation@KERNEL32.DLL at 00033793-00001772-34851-1519-003AD523\n GetTimeZoneInformation@KERNEL32.DLL at 00034316-00002720-6932-1528-0024D523\n GetTimeZoneInformation@KERNEL32.dll at 6963-5754-00543C83","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"$24","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"$25","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00017767-00003368-40555-88-00404605\n GetDiskFreeSpaceW@KERNEL32.DLL at 00017767-00003368-45790-88-00404605\n GetDiskFreeSpaceA@KERNEL32.DLL at 00028375-00003684-44648-8154-0043F410\n GetDiskFreeSpaceA@KERNEL32.DLL at 00033793-00001772-34851-8154-003DF410","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$26","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"$27","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$28","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"cidian.youdao.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"59.111.179.141:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"eamCity\\workspace\\YDProject\\dict-pc\\src\\bin\\Release\\YoudaoDictInstaller.pdb\"\n \"E:\\TeamCity\\workspace\\YDProject\\dict-pc\\src\\bin\\Release\\InstallHelper.pdb\"\n \"E:\\work\\dict-pc\\src\\bindinstall\\Release\\InstallDaemon.pdb\"\n \"E:\\TeamCity\\workspace\\YDProject\\dict-pc\\src\\bin\\Release\\stable\\YoudaoGetWord32.pdb\"\n \"E:\\TeamCity\\workspace\\YDProject\\dict-pc\\src\\bin\\Release\\stable\\YoudaoGetWord64.pdb\"\n \"E:\\app\\dict-pc\\src\\bin\\Release\\libjpeg.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$29","origin":"File/Memory","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"$2a","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\!PrivacIE!SharedMemory!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\!PrivacIE!SharedMemory!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}\"\n \"\\Sessions\\1\\BaseNamedObjects\\{3480CE0E-C867-4657-8B39-F679E6CF90BA}\"\n \"\\Sessions\\1\\BaseNamedObjects\\{4A856E36-7472-47EB-818F-36F1BD90FDF6}\"\n \"{4A856E36-7472-47EB-818F-36F1BD90FDF6}\"\n \"{3480CE0E-C867-4657-8B39-F679E6CF90BA}\"\n \"\\Sessions\\1\\BaseNamedObjects\\{BEDEFA07-CF3E-4770-8118-5C21666CAF0F}b4ceb07d6785d7b8b129d4c7e3ac1548\"\n \"{BEDEFA07-CF3E-4770-8118-5C21666CAF0F}b4ceb07d6785d7b8b129d4c7e3ac1548\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$2b","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /icomplete.html?keyfrom=deskdict.7.5.2.0&client=deskdict&id=6b8b0fc3615a33d1f&vendor=unknown&in=b7a1a5901b93f80a699fdac1ad2896bb8abf6cb98b51fcc9fb0408c5d48e141f.&appVer=7.5.2.0&appZengqiang=2&autorun=1&ins_toolbar=&ins_personalhome= HTTP/1.1Accept: */*User-Agent: Youdao Desktop Dict (Windows NT 6.1)Host: cidian.youdao.comConnection: Keep-AliveCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6DEC0000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c echo y| cacls \"%ALLUSERSPROFILE%\\Youdao\\DeskDict\\pluginconfig.ini\" /c /g everyone:f\" on 2018-1-24.09:44:02.014\n \"/S /D /c\" echo y\"\" on 2018-1-24.09:44:02.235","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"#32770\"\n \"YoudaoDictInstaller.exe\" searching for class \"MozillaWindowClass\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$2c","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"Installation/Persistance","name":"Accessed IE Quick Launch directory","description":"\"YoudaoDictInstaller.exe\" obtained handle to \"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":10,"id":"handle-2","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"YoudaoDictInstaller.exe\" connecting to \"\\ThemeApiPort\"\n \"InstallHelper.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$2d","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\msctf.dll.mui\"\n \"\" touched file \"%WINDIR%\\Fonts\\StaticCache.dat\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\user32.dll.mui\"\n \"\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2e","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"u$v'-\"\n \"u$v'-\"\n \"7^Zwu\"\n \"oktw_u5iu}=}89w_\"\n \"jYzx*\"\n \"{)z(a\"","origin":"Network Traffic","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"YoudaoDictInstaller.exe\" opened \"\\Device\\KsecDD\"\n \"InstallHelper.exe\" opened \"\\Device\\KsecDD\"\n \"regsvr32.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"$2f","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 20 calls to GetProcAddress@KERNEL32.dll at 300-1427-0000000180014FFC\n Found 13 calls to GetProcAddress@KERNEL32.dll at 300-2318-0000000180014374","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"YoudaoGetWord32.dll.2897157162\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00028375-00003684-44648-8029-0040B6FD\n cpuid at 00028549-00002412-19493-204-00E27BD0\n cpuid at 00028549-00002412-19493-381-00E2BC2C\n cpuid at 00029455-00002592-22785-204-00057BD0\n cpuid at 00029455-00002592-22785-381-0005BC2C\n cpuid at 00029976-00003068-25626-204-01177BD0\n cpuid at 00029976-00003068-25626-381-0117BC2C\n cpuid at 00030494-00003012-28446-204-01177BD0\n cpuid at 00030494-00003012-28446-381-0117BC2C\n cpuid at 00031009-00002696-31441-204-00397BD0\n cpuid at 00031009-00002696-31441-381-0039BC2C\n cpuid at 00033793-00001772-34851-8029-003AB6FD\n cpuid at 1648-1973-10013961","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"YoudaoDictInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"InstallHelper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"cacls.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"InstallDaemon.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"YoudaoDictInstaller.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"YoudaoDictInstaller.exe\" sleeping for \"00120000\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/66 reputation engines marked \"http://sv.symcb.com/sv.crl0a\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"$30","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%TEMP%\\nscC852.tmp\\install.ini\"\n \"YoudaoDictInstaller.exe\" read file \"%TEMP%\\nscC852.tmp\\install.ini\"\n \"YoudaoDictInstaller.exe\" read file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Yodao\\DeskDict\\config.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"$31","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"YoudaoDictInstaller.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"YoudaoDictInstaller.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"YOUDAODICT\"; Value: \"\"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\YoudaoDict.exe\" -hide -autostart\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"/icomplete.html?keyfrom=deskdict.7.5.2.0&client=deskdict&id=6b8b0fc3615a33d1f&vendor=unknown&in=b7a1a5901b93f80a699fdac1ad2896bb8abf6cb98b51fcc9fb0408c5d48e141f.&appVer=7.5.2.0&appZengqiang=2&autorun=1&ins_toolbar=&ins_personalhome=\"\n \"3.6.23.1\"\n Heuristic match: \"1.3.6.1.4.1.311.2.1.12\"\n \"7.5.2.0\"\n Heuristic match: \"\"move\" \"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\" \"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\7.5.2.0\"\"\n Heuristic match: \"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\7.5.2.0\\YoudaoDictInstaller.exe\"\n Heuristic match: \"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\7.5.2.0\\InstallDaemon.exe\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.DLL at 00032271-00003924-31904-240-00D229F0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"YoudaoDictInstaller.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"YoudaoDictInstaller.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\" (Type: \"FileHandle\")\n \"InstallDaemon.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"InstallDaemon.exe\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00017767-00003368-40555-93-0040522D\n OpenClipboard@USER32.DLL at 00028375-00003684-44648-12049-00321112\n OpenClipboard@USER32.DLL at 00033793-00001772-34851-12047-002C1112","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"$32","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$33","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$34","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"YoudaoDictInstaller.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"YoudaoDictInstaller.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"YoudaoDictInstaller.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"YoudaoDictInstaller.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"YoudaoDictInstaller.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"YoudaoDictInstaller.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$35","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$36","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$37","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cacls.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"6/67 Antivirus vendors marked sample as malicious (8% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"$38","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"$39","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$3a","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"QuarianCode\" classified file \"npswf32.dll\" as \"quarian\" based on indicators: \"c1e0048b4df4c1e90533c1,c1e1048b55f4c1ea0533ca\" (Author: Seth Hardy)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"malicious","category":"System Security","name":"Modifies the access control lists of files","description":"Process \"cacls.exe\" with commandline \"cacls \"%ALLUSERSPROFILE%\\Youdao\\DeskDict\\pluginconfig.ini\" /c /g everyone:f\" (UID: 00031954-00003716)","origin":"Monitored Target","relevance":5,"id":"target-12","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00017767-00003368-40555-1-004039E3","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$3b","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Accesses potentially sensitive information from local browsers"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]}]},"activity":{"stats":{"process_count":17,"spawned_processes_count":17,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":40,"imported_dlls_count":113,"dropped_files_count":0,"extracted_files_count":60,"files_written_count":548,"files_deleted_count":0,"registry_keys_created_count":25,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":25,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["quarian"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5a68c3f07ca3e171a359f473","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Youdao","contacted_countries":["CHN"],"submit_name":"YoudaoDict.exe","analysis_start_time":"2018-01-24T18:36:35+00:00","indicators_count":{"informative":30,"suspicious":37,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"59.111.179.141","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]}],"dns_resolutions":[{"domain":"cidian.youdao.com","address":"59.111.179.141","country":"China","registrar_name":"NETWORK SOLUTIONS, LLC.","registrar_organization":"NetEase Yodao Information Technology (Beijing) Co.","registrar_name_servers":"NS1.YODAO.COM","registrar_creation_date":"2002-06-15T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]}],"http_requests":[{"host":"cidian.youdao.com","host_ip":"59.111.179.141:80","url":"/icomplete.html?keyfrom=deskdict.7.5.2.0&client=deskdict&id=6b8b0fc3615a33d1f&vendor=unknown&in=b7a1a5901b93f80a699fdac1ad2896bb8abf6cb98b51fcc9fb0408c5d48e141f.&appVer=7.5.2.0&appZengqiang=2&autorun=1&ins_toolbar=&ins_personalhome=","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /icomplete.html?keyfrom=deskdict.7.5.2.0&client=deskdict&id=6b8b0fc3615a33d1f&vendor=unknown&in=b7a1a5901b93f80a699fdac1ad2896bb8abf6cb98b51fcc9fb0408c5d48e141f.&appVer=7.5.2.0&appZengqiang=2&autorun=1&ins_toolbar=&ins_personalhome= HTTP/1.1\nAccept: */*\nUser-Agent: Youdao Desktop Dict (Windows NT 6.1)\nHost: cidian.youdao.com\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}],"processes":[{"pid":3368,"ppid":0,"name":"b7a1a5901b93f80a699fdac1ad2896bb8abf6cb98b51fcc9fb0408c5d48e141f.exe","command_line":"","sha256":"b7a1a5901b93f80a699fdac1ad2896bb8abf6cb98b51fcc9fb0408c5d48e141f","normalized_path":"C:\\b7a1a5901b93f80a699fdac1ad2896bb8abf6cb98b51fcc9fb0408c5d48e141f.exe","uid":"00017767-00003368","icon":"$3c"},{"pid":2708,"ppid":3368,"name":"YoudaoDictInstaller.exe","command_line":"\"nsiinstall\" \"%TEMP%\\nscC852.tmp\\install.ini\" \"0\"","sha256":"65b12f8205f5ad156efd0f39fdaae751333147171a6d5ad68f3552dcf309d18a","normalized_path":"%TEMP%\\nscC852.tmp\\YoudaoDictInstaller.exe","parent_uid":"00017767-00003368","uid":"00027858-00002708"},{"pid":3684,"ppid":3368,"name":"YoudaoDictInstaller.exe","command_line":"rundicttask * \"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\YoudaoDict.exe\" \"0\"","sha256":"65b12f8205f5ad156efd0f39fdaae751333147171a6d5ad68f3552dcf309d18a","normalized_path":"%TEMP%\\nscC852.tmp\\YoudaoDictInstaller.exe","parent_uid":"00017767-00003368","uid":"00028375-00003684"},{"pid":2412,"ppid":3368,"name":"InstallHelper.exe","command_line":"\"exports\" \"%TEMP%\\nscC852.tmp\\dict.7z\" \"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\"","sha256":"12a42b86f896bf964900e3ed586643eb29830a0dbbc8e4e8213d35c53463cff6","normalized_path":"%TEMP%\\nscC852.tmp\\InstallHelper.exe","parent_uid":"00017767-00003368","uid":"00028549-00002412"},{"pid":2592,"ppid":3368,"name":"InstallHelper.exe","command_line":"\"move\" \"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\YodaoDict.exe\" \"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\YodaoDict.exe\"","sha256":"12a42b86f896bf964900e3ed586643eb29830a0dbbc8e4e8213d35c53463cff6","normalized_path":"%TEMP%\\nscC852.tmp\\InstallHelper.exe","parent_uid":"00017767-00003368","uid":"00029455-00002592"},{"pid":3068,"ppid":3368,"name":"InstallHelper.exe","command_line":"\"move\" \"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\YoudaoDict.exe\" \"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\YoudaoDict.exe\"","sha256":"12a42b86f896bf964900e3ed586643eb29830a0dbbc8e4e8213d35c53463cff6","normalized_path":"%TEMP%\\nscC852.tmp\\InstallHelper.exe","parent_uid":"00017767-00003368","uid":"00029976-00003068"},{"pid":3012,"ppid":3368,"name":"InstallHelper.exe","command_line":"\"move\" \"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\" \"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\7.5.2.0\"","sha256":"12a42b86f896bf964900e3ed586643eb29830a0dbbc8e4e8213d35c53463cff6","normalized_path":"%TEMP%\\nscC852.tmp\\InstallHelper.exe","parent_uid":"00017767-00003368","uid":"00030494-00003012"},{"pid":2696,"ppid":3368,"name":"InstallHelper.exe","command_line":"\"move\" \"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\Stable\" \"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\Stable\"","sha256":"12a42b86f896bf964900e3ed586643eb29830a0dbbc8e4e8213d35c53463cff6","normalized_path":"%TEMP%\\nscC852.tmp\\InstallHelper.exe","parent_uid":"00017767-00003368","uid":"00031009-00002696"},{"pid":3768,"ppid":3368,"name":"YoudaoDictInstaller.exe","command_line":"\"%TEMP%\\nscC852.tmp\\install.ini\" \"full\" 0","sha256":"65b12f8205f5ad156efd0f39fdaae751333147171a6d5ad68f3552dcf309d18a","normalized_path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\7.5.2.0\\YoudaoDictInstaller.exe","parent_uid":"00017767-00003368","uid":"00031557-00003768"},{"pid":2520,"ppid":3768,"name":"regsvr32.exe","command_line":"\"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\stable\\YoudaoGetWord32.dll\" /s","sha256":"890c1734ed1ef6b2422a9b21d6205cf91e014add8a7f41aa5a294fcf60631a7b","normalized_path":"%WINDIR%\\System32\\regsvr32.exe","parent_uid":"00031557-00003768","uid":"00031876-00002520"},{"pid":3736,"ppid":3768,"name":"regsvr32.exe","command_line":"\"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\stable\\YoudaoGetWord64.dll\" /s","sha256":"890c1734ed1ef6b2422a9b21d6205cf91e014add8a7f41aa5a294fcf60631a7b","normalized_path":"%WINDIR%\\System32\\regsvr32.exe","parent_uid":"00031557-00003768","uid":"00031892-00003736"},{"pid":3812,"ppid":3768,"name":"cmd.exe","command_line":"/c echo y| cacls \"%ALLUSERSPROFILE%\\Youdao\\DeskDict\\pluginconfig.ini\" /c /g everyone:f","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00031557-00003768","uid":"00031930-00003812"},{"pid":3864,"ppid":3812,"name":"cmd.exe","command_line":"/S /D /c\" echo y\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00031930-00003812","uid":"00031948-00003864"},{"pid":3716,"ppid":3812,"name":"cacls.exe","command_line":"cacls \"%ALLUSERSPROFILE%\\Youdao\\DeskDict\\pluginconfig.ini\" /c /g everyone:f","sha256":"439f7977a0d2b49fadec31db40dc6b0d8ded2ceded52cf3055260f7a1eeecae6","normalized_path":"%WINDIR%\\System32\\cacls.exe","parent_uid":"00031930-00003812","uid":"00031954-00003716"},{"pid":3924,"ppid":3368,"name":"InstallDaemon.exe","command_line":"GetSoftListADC softs.ini ${BIND_SOFT_URL}","sha256":"bc7b7e49aa6b047ee4c380a606935adff48f355da8dd69a5db337a0f4a4d139c","normalized_path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\7.5.2.0\\InstallDaemon.exe","parent_uid":"00017767-00003368","uid":"00032271-00003924"},{"pid":1772,"ppid":3368,"name":"YoudaoDictInstaller.exe","command_line":"\"cleanup\" \"%LOCALAPPDATA%\\Youdao\\Dict\\Application\"","sha256":"65b12f8205f5ad156efd0f39fdaae751333147171a6d5ad68f3552dcf309d18a","normalized_path":"%TEMP%\\nscC852.tmp\\YoudaoDictInstaller.exe","parent_uid":"00017767-00003368","uid":"00033793-00001772"},{"pid":2720,"ppid":3368,"name":"YoudaoDictInstaller.exe","command_line":"instreport","sha256":"65b12f8205f5ad156efd0f39fdaae751333147171a6d5ad68f3552dcf309d18a","normalized_path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\7.5.2.0\\YoudaoDictInstaller.exe","parent_uid":"00017767-00003368","uid":"00034316-00002720"}],"all_imported_dlls":["wship6.dll","advapi32.dll","urlmon.dll","shdocvw.dll","netprofm.dll","comctl32.dll","iertutil.dll","ws2_32.dll","rasman.dll","WSHTCPIP.DLL","oledlg.dll","mswsock.dll","gdi32.dll","usp10.dll","msimg32.dll","sfc.dll","msi.dll","sspicli.dll","rasadhlp.dll","cryptdll.dll","FWPUCLNT.DLL","mpr.dll","kernel32.dll","shlwapi.dll","sechost.dll","crypt32.dll","IPHLPAPI.DLL","tzres.dll","lpk.dll","rpcss.dll","clbcatq.dll","wer.dll","winnsi.dll","dnsapi.dll","imageres.dll","ntshrui.dll","OP_WndProc.dll","nsi.dll","ole32.dll","comdlg32.dll","slc.dll","cryptsp.dll","netutils.dll","SensApi.dll","msls31.dll","LockedList.dll","OP_Logging.dll","msacm32.dll","ntmarta.dll","msvcrt.dll","NapiNSP.dll","winbrand.dll","Wldap32.dll","SkinBtn.dll","setupapi.dll","srvcli.dll","profapi.dll","riched20.dll","apphelp.dll","oleacc.dll","dhcpcsvc.dll","normaliz.dll","cfgmgr32.dll","System.dll","nsDialogs.dll","winrnr.dll","msctf.dll","oleaut32.dll","nsisSlideshow.dll","xmllite.dll","ieframe.dll","propsys.dll","linkinfo.dll","sfc_os.dll","imm32.dll","shfolder.dll","msxml3r.dll","YoudaoGetWord32.dll","wininet.dll","RpcRtRemote.dll","rpcrt4.dll","cryptbase.dll","cscapi.dll","winmm.dll","dhcpcsvc6.dll","ntdll.dll","version.dll","devobj.dll","msasn1.dll","pnrpnsp.dll","userenv.dll","acppage.dll","AcGenral.dll","GdiPlus.dll","nlaapi.dll","shell32.dll","gameux.dll","devrtl.dll","samcli.dll","mshtml.dll","psapi.dll","rasapi32.dll","KernelBase.dll","OP_ProgressBar.dll","npmproxy.dll","user32.dll","uxtheme.dll","dwmapi.dll","rsaenh.dll","oleaccrc.dll","msxml3.dll","rtutils.dll","twext.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"CrashRpt.dll","sha256":"495eaec5bbb06b642a5cf525fd91a7caafb9592a625e7ccc2b99e23eaf9bbd80","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Monitor.exe","sha256":"6563af31ca5c665f550004f2f31d98cd465d5a9e8746073b22484bcb100751b5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"TextExtractorImpl32.dll","sha256":"5112f24250608ca99e0df8f1121092dadd791205ad6320f0f5b329167e99f7c9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"XDLL.dll","sha256":"02cfa877e40143a6eb7414a45ee6e9e5751337f5d463879b35937de3c4920e63","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"YoudaoDictHelper.exe","sha256":"83308706c330cc3f421b3ee3e7f75ad49ff5c5157af765a947bf05d759055063","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"YoudaoOcr.exe","sha256":"dc8983c7910068e815dc535a37c6eb259db257fe604b8a5f650200fefdb27c91","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"d3dcompiler_46.dll","sha256":"82f050d6bd1505a81493396e2ee4e07da9e14400816ca9fd7da3efb2be5a90d8","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"ffmpegsumo.dll","sha256":"303eeb7d9f53553ff667fe104b1ce41cac810d66b945dde3cd08f74443489c87","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"leptonica.dll","sha256":"33d6db49d8dcc0ba1caa5ead09186441318c1834bd275192dd313f1dc8a09271","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"libGLESv2.dll","sha256":"971926472232019c2c25b60688fd8bb5d113d23d1556b88c8497b923aa82e068","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"libjpeg.dll","sha256":"d9310d58567665b521a1ceb8514423e5a3be649979c7397ee1fae02df9fb0605","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"libpng.dll","sha256":"eb6ba34e02acaa495c3db634ab7bf000f14ca1d4475105e4f40d206c68527d84","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"libzplay.dll","sha256":"58f9c4790392a65444b9e9246699b373f1cad0709ea91cac973d20f42696f065","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"tessdll.dll","sha256":"4d30a36b653f5d615526dc4ec3bccbb6256b0a93ee6fea891d024d0fb501fb5e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"zlib1.dll","sha256":"185b9253b2df7106371baec321568d3d01365d233519a3a7474dd63cc5370f13","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"YDFFMiddleware.dll","sha256":"429180c2d5553ea1d48c4511ae11a19ffc8055291fd5f2afcd226ad408f890b7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"text_extractor_host.exe","sha256":"21b22a320fca667a960f5b0e1873dda6e1122e9c40cfca811d507c4988ee6f18","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"InstallDaemon.exe","sha256":"bc7b7e49aa6b047ee4c380a606935adff48f355da8dd69a5db337a0f4a4d139c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"YoudaoGetWord32.dll","sha256":"cd3e933892aa6debd98d66173f97621f1111ab66267cc9c9e98a3aa765cd631d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"YodaoDict.exe","sha256":"a170548cb6bf44665982e75a67e7c2cc7209800cb114dd9245db8e44e79f90bc","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"uninst.exe","sha256":"77b24f33cabb1f6b2f8011d7b1758765b8fa82d7a407c8eb8336a242508af0ec","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"InstallHelper.exe","sha256":"12a42b86f896bf964900e3ed586643eb29830a0dbbc8e4e8213d35c53463cff6","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"YoudaoDictInstaller.exe","sha256":"65b12f8205f5ad156efd0f39fdaae751333147171a6d5ad68f3552dcf309d18a","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"YoudaoToolbar.exe","sha256":"29e32422ee601242a1cd9ab66b8713597f0c303ff0cd5373f39d60c5a1ca6296","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"YoudaoDictIcon.exe","sha256":"79c162bc84a6cb744378825b17b55fb9a082b1eafd63af6442f696295cc94cdb","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"TextExtractorImpl64.dll","sha256":"bd9121aba7d328e8e5f014ba6dcd3c3da78221a2c9fd06a32c3df4ddc29b6a58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"WordStrokeHelper64.dll","sha256":"c4e4a0bf60522e41f0838439f2218454d9292dd74d509d0b58329cb695a744b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"YoudaoCookieAssist.exe","sha256":"eaa1f6b0635a916a95d6fa9ba4d44aef2438b1f28fdf667252a90c2408255436","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"YoudaoEH.exe","sha256":"09e7dc5e966b26de0403e867fc4828d6bb1b39e6e0a96f2668eef1a59d24e6a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"libtiff.dll","sha256":"21e9a83c6f1e86a8e341b525b3b8d7b4faf93b15f1d82dbbea68eb14679cd63d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Acrobat2Dict.dll","sha256":"07151848a618be5a34d3b492e7279ebef06297eea4af99cc923b4e456b8d53c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"YoudaoGetWord64.dll","sha256":"5cd8723769d265971a1fc31f7e599d7e699e29dab4356e7bf926e664627df8f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"LockedList.dll","sha256":"0b1e46044b580121f30bedb2b5412d3170c6afaa7800d702ee71f7666904236d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"OP_ProgressBar.dll","sha256":"75b9c807487764b4196eee5310ed096f74dfe585ed8318e0dff0ace2ae054e26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"SkinBtn.dll","sha256":"e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"nsDialogs.dll","sha256":"416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"config.ini","sha256":"439f81d92dc2862591e0e3f89c1682401a2ef1bb2b444ce69662ab4d1b5d029e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"YoudaoDict.exe","sha256":"9cda2f12eb8d2cd7d9245115f6db53dbcc0b6aa70a6727e63ab6b5daea9abd75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"#U7f51#U6613#U6709#U9053#U8bcd#U5178.lnk","sha256":"0904053d863342e8320b5c947b94fb2e3f40a490b4b60dc38171d9408f070457","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"54621e727b664205064307f088e3120f_e47c61d2-1dae-480e-827a-ae8d797649df","sha256":"de73b996ebc46c2044e8ccd4c8006ddf980c52ac9ec82879b6aba4578297e315","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"yodaodictproxyuser","sha256":"c918adce928c29b62da0a75a1103d6981a10db9ed8bb1cacc107890b9d083e9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"default_config.ini","sha256":"542b73e9213cb4976de9c17c23d4f75840cf65219414778ded73f62b4329329c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"OcrInfo.xml","sha256":"537dae87377fd19ae6a8c8d533d45319c504e4f8b31c4a75f3f7b270a0b3e123","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"WordStrokeHelper32.dll","sha256":"5823a66c811a5260bf132117c900efde79af0a1855693524121a3a2d8c3a8b11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"YodaoDict7.api","sha256":"1b3c86f7136bf11a9f71871ad49e3b0e4f5f6c704e9f3df39a1ee2013b8f79bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"YoudaoDictPlugin.mxaddon","sha256":"3c1c85cb21599818460ca3777e97d55669d6d4912d08ac0c8ff716915c1a151f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"YoudaoIE.exe","sha256":"5cb057b8bde92f00430329ebce32f04cc46aea3f74fb81dbc5c2faf173c04d68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"YoudaoWSH.exe","sha256":"54cb415b6f09d9886acae880e2aa6d0cc1359858527daaec7fd1a11ae95bb162","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"d3dcompiler_43.dll","sha256":"ab682f6299cc0658ce16a8288bd96b91a5941bf6f00209fb40ac6a98fdeb7bbe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"icudt.dll","sha256":"28966d3f545f1063865a48411bde7fa47979a67bfec9cfb09a962ad81772b5e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"libEGL.dll","sha256":"75b83458a2bf31a1841a01bd198560edd6f29110dff00650b5e4cb0eabe12b74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"libcef.dll","sha256":"06bcdc88e238d4da925c6df6e84913d69dfa9959ffa30e78a405b21a3cd355ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"npswf32.dll","sha256":"d868fb581b040015fd16379b883c51400f382c43f99ddbd2aa3fefd467b330c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"voice.swf","sha256":"e416f584fd96cbe3c086dba5d81202c5db5a436c3277f2ed995154e7b8fd7746","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"OP_Logging.dll","sha256":"4a802d435fb605a78e74e5a481bf047e1017942537d0a5e526266316c1e85af4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"OP_WndProc.dll","sha256":"cc46ab0bf6b19a2601cd002b06769ad08baf4ed0b14e8728973f8af96bdee57e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"System.dll","sha256":"7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"nsisSlideshow.dll","sha256":"f8d353598129877a8aeb45821dbb9845fa5b347ad51c46c640f92a418dd3f174","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"#U5378#U8f7d#U7f51#U6613#U6709#U9053#U8bcd#U5178.lnk","sha256":"1b9daad8f75b09270f27ef1e5c886d7c19c4df045822e5027963fa1214fff298","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"#U542f#U52a8#U7f51#U6613#U6709#U9053#U8bcd#U5178.lnk","sha256":"1e0b6090441190def8ec74d2f61de18b33922ec0d257a80f3d60e0e36cd04425","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]}],"files_written":[{"path":"C:\\b7a1a5901b93f80a699fdac1ad2896bb8abf6cb98b51fcc9fb0408c5d48e141f.exe","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nsiC83D.tmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"C:\\Users\\jDJOPbh","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\YoudaoDictInstaller.exe","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\checkbox.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\checkbox_null.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\checkbox_license.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\checkbox_license_null.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\checkbox_bind.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\checkbox_bind_null.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\SkinBtn.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\btn_close.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\bg.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\bg_extend.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\btn_install.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\btn_custom1.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\btn_custom2.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\btn_browse.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\bg_license.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\btn_agree.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\btn_disagree.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\license.rtf","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\bar_empty.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\bar_full.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\slide1.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\slide2.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\slide3.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\bg_bind.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\btn_next.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\bg_finish.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\btn_godict.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\nsDialogs.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\LockedList.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\OP_WndProc.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Yodao","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Yodao\\DeskDict","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Yodao\\DeskDict\\config.db","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\installertest.dat","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\OP_Logging.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%TEMP%\\nscC852.tmp\\dict.7z","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\cef.pak","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\sw.zip","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\res","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\res\\swf","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\res\\swf\\voice.swf","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\1iDQ2f_loading.gif","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\res\\images","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\res\\images\\image-q1-2.gif","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\res\\images\\image-q3-11.gif","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\res\\images\\image-q3-21.gif","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\res\\images\\laba1.gif","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\images","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\images\\loading.gif","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\res\\images\\title_back.gif","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\assets","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\assets\\default_data","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\assets\\default_data\\1-1007453.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\assets\\default_data\\1.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\assets\\default_data\\10-1186646.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\1HEO2D_say1.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\assets\\default_data\\2-1011621.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\assets\\default_data\\2.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\2ncraS_lazy-load-small.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\assets\\default_data\\3-1025416.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\assets\\default_data\\3.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\3_Id9G_say2.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\assets\\default_data\\4-1115146.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\assets\\default_data\\4.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\assets\\default_data\\5-1137302.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\assets\\default_data\\5.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\5_eUMA_say3.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\assets\\default_data\\6-1005831.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\assets\\default_data\\7-1013797.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\assets\\default_data\\8-1175872.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\assets\\default_data\\9-1063288.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\bg-win7.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\iGSrxd_lazy-load-big.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\simisent","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\simisent\\css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\simisent\\css\\OffLine.jpg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\1AHqnT_VIP1.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\1ajQoM_payment_alipay.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\imgs","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\imgs\\1d86jw_moment.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\1d86jw_quan.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\1GvVfO_bg.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\1If_qv_VIP3.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\1ijjf4_VIP2.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\imgs\\1Ioti6_disagree_icon_normal.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\1nJXzA_VIP5.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\1p3H_S_360.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\imgs\\1rw-cQ_weixin.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\imgs\\1snx0__weixin_timeline.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\imgs\\1XxiCw_audio_pause.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\1zU_hZ_vip_gray_big.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\imgs\\1_OMWz_style_arrow.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\2B9in0_chrome.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\2Bnkr7_VIP6.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\imgs\\2FoPGF_404.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\2G-Cwp_bg_adtag.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\2kt_eR_empty.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\2KUSye_selected.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\imgs\\2MU-m3_arrow-down.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\2SRe2i_VIP4.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\imgs\\2vdqaJ_error.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\33JDvT_sogou.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\33Mw3z_vip_gray_small.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\3a5-x3_tag_recommend.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\3AFEKD_tag_vip.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\imgs\\3B9ZTX_sina.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\3B9ZTX_weibo.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\3MF19t_defaultPic.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\3O5qP9_banner_bg.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\3Oo90L_tag_new.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\3SzlQh_pdf.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\imgs\\3VwfuQ_video_play_btn.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\3wzV1-_empty.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\3YZk4n_payment_wechat.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\9iZukW_vip_big.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\simisent\\css\\bg.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\check-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\check.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\checked.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\close-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\close.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\default-portrait.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\dict-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\dict.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\drop.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\e-ZjE2_star.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\imgs\\E5vLeT_disagree_icon_select.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\example-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\example.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\simisent\\images","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\simisent\\images\\fangfa1.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\simisent\\images\\fangfa2.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\feedback.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\imgs\\Fsyukm_audio_play.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\headportrait.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\history-clear-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\history-clear.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\history-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\history-to-wb-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\history-to-wb.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\history.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\Loading","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\Loading\\IMG0000.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\Loading\\IMG0001.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\Loading\\IMG0002.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\Loading\\IMG0003.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\Loading\\IMG0004.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\Loading\\IMG0005.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\Loading\\IMG0006.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\Loading\\IMG0007.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\Loading\\IMG0008.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\Loading\\IMG0009.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\Loading\\IMG0010.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\Loading\\IMG0011.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\input-left.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\input-right.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\imgs\\Jr9fJm_wechat.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\Jr9fJm_weixin.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\kJchA5_empty.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\lang_bl.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\lang_br.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\lang_tl.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\lang_tr.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\login-button-down.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\login-button-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\login-button.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\login-close.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\login-drop.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\login-input-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\login-input.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\login-logo.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\login-register-down.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\login-register-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\login-register.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\loginurl-close-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\loginurl-close.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\logo.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\mainWnd_shadow.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\manual-trans-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\manual-trans.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\maximum-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\maximum.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\mb-btn-active.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\mb-btn-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\mb-btn.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\mb-close-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\mb-close.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\mini-drop-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\mini-drop.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\mini-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\mini.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\minimum-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\minimum.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\simisent\\css\\nav.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\simisent\\css\\new-sprite.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\next-disabled.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\next-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\next.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\imgs\\O67tk2_agree_icon_normal.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\prev-disabled.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\prev-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\prev.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\qcadv.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\qcclose-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\qcclose.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\qcconfig-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\qcconfig.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\qccopy-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\qccopy.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\qcdrop.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\qcfix-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\qcfix.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\qclogo.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\qcsound-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\qcsound.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\qcsprig-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\qcsprig.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\qcstore-clicked.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\qcstore-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\qcstore.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\qq-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\qq.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\QualityCourse-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\QualityCourse.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\restore-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\restore.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\simisent\\css\\s-search-2.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\simisent\\css\\s-search.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\school-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\school.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\search.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\settings-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\settings.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\imgs\\SSwGNf_agree_icon_select.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\Loading\\stroke.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\survey-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\survey.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\toast-success.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\trans-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\trans.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\tray-menu-off.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\tray-menu-on.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\vip-expire-tip.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\vip-tag-expire.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\vip-tag.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\weibo-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\weibo.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\weixin-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\weixin.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\wiki-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\wiki.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\wordbook-hover.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons\\wordbook.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\wUB-Jr_vip_small.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\yIniy5_pic_oxford.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs\\Zdtqo5_time.png","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\simisent\\simisent.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\wb.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\xp-default.bmp","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\fonts","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\fonts\\iconfont.svg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\fonts","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\fonts\\iconfont.svg","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\Stable\\extensions","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\Stable\\extensions\\firefox","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\Stable\\extensions\\firefox\\chrome.manifest","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\compactversions.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\res\\fan.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\fullversions.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\history_wnd_layout.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\lang_select_layout.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\lang_select_layout_save.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\login_info_layout.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\login_layout.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\login_wnd_layout.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\main_layout.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\mb_layout.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\mini_wnd_layout.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\OcrInfo.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\pop_wnd_layout.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\strings.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\stroke_wnd_layout.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\tray_icon_menu.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\versions.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\vip_tip_layout.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\wordbook_editwnd_layout.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\xp-default.xml","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\res\\updater.xsl","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\dialog","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\dialog\\word","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\dialog\\word\\add.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\dialog\\category.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\popup","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\popup\\corner.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\daily.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\baike","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\baike\\detail.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\dialog\\word\\edit.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\edit.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\editword.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\simisent\\example-similar.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\dict","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\dict\\example.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\dialog\\export.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\fanyi.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\res\\faq.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\feedback.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\feeds.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\help.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\dict\\huaci.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\error","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\error\\index.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\index.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\setting","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\setting\\index.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\vip","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\vip\\index.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\index.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\lexicon.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\mini.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\setting\\dialog","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\setting\\dialog\\ocr.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\vip\\dialog","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\vip\\dialog\\openvip.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\pc.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\dict\\quick.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\dict\\result.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\review.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\right.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\dialog\\setting.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\dict\\suggest.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\survey.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\userinfo.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\ydk.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\proxy","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\proxy\\_feeds.html","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\dialog\\word\\add.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\dialog\\category.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\popup\\corner.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\daily.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\defaultWin7.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\baike\\detail.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\simisent\\css\\dict.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\dialog\\word\\edit.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\edit.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\editword.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\dict\\example.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\dialog\\export.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\fanyi.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\feedback.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\help","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\help\\components","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\help\\components\\feedback.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\feeds.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\res\\style","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\res\\style\\global.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\help.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\dict\\huaci.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\iconfont.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\iconfont.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\error\\index.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\index.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\setting\\index.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\vip\\index.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\index.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\lexicon.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\mini.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\setting\\dialog\\ocr.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\vip\\dialog\\openvip.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\pc.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\dict\\quick.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\dict\\result.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\review.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\right.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\dialog\\setting.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\simisent\\css\\similar.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\dict\\suggest.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\survey.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\res\\style\\updater.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\userinfo.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\ydk.css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\dialog\\word\\add.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\dialog\\category.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\popup\\corner.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\daily.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\simisent\\default.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\baike\\detail.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\dialog\\word\\edit.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\edit.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\editword.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\dict\\example.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\dialog\\export.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\fanyi.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\feedback.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\help\\components\\feedback.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\feeds.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\Stable\\extensions\\firefox\\chrome","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\Stable\\extensions\\firefox\\chrome\\content","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\Stable\\extensions\\firefox\\chrome\\content\\getword.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\inject","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\inject\\getword.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\help.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\dict\\huaci.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\error\\index.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\index.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\setting\\index.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\vip\\index.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\index.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\simisent\\jquery.min.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\lexicon.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\libs.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\mini.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\setting\\dialog\\ocr.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\vip\\dialog\\openvip.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\pc.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\dict\\quick.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\dict\\result.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\review.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\right.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\dialog\\setting.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\dict\\suggest.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\survey.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\userinfo.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\weblibs.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\ydk.js","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\default_config.ini","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\fonts\\iconfont.ttf","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\fonts\\iconfont.ttf","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\localdicts","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\localdicts\\dictde.db","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\localdicts\\dicten.db","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\localdicts\\dictes.db","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\localdicts\\dictfr.db","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\localdicts\\dictja.db","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\localdicts\\dictko.db","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\localdicts\\dictpt.db","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\localdicts\\dictru.db","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\YodaoDict.api","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\YodaoDict7.api","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\Stable\\text_extractor_host_manifest.json","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\YoudaoDictPlugin.mxaddon","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\Stable\\extensions\\firefox\\install.rdf","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\doc.tpl","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\tessdata","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\tessdata\\eng.traineddata","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\fonts\\iconfont.woff","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\fonts\\iconfont.woff","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\Stable\\extensions\\firefox\\chrome\\content\\main.xul","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\Monitor.exe","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\Stable\\text_extractor_host.exe","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\YoudaoCookieAssist.exe","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\YoudaoDictHelper.exe","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\YoudaoEH.exe","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\YoudaoIE.exe","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\YoudaoOcr.exe","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\YoudaoWSH.exe","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\Stable\\Acrobat2Dict.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\CrashRpt.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\d3dcompiler_43.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\d3dcompiler_46.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\ffmpegsumo.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\icudt.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\leptonica.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\libcef.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\libEGL.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\libGLESv2.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\libjpeg.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\libpng.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\libtiff.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\libzplay.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\npswf32.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\tessdll.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\TextExtractorImpl32.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\TextExtractorImpl64.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\WordStrokeHelper32.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\WordStrokeHelper64.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\XDLL.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\Stable\\extensions\\firefox\\YDFFMiddleware.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\Stable\\YoudaoGetWord32.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\Stable\\YoudaoGetWord64.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict\\Application\\install_7.5.2.0\\7.5.2.0\\zlib1.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\tessdata","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\Loading","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\images","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins\\icons","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\skins","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\dialog\\word","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook\\dialog","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\wordbook","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\vip\\dialog","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\vip","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\imgs","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw\\fonts","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\sw","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\setting\\dialog","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\setting","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\proxy","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\popup","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\inject","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\imgs","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\help\\components","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\help","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\fonts","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\error","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\dict","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\baike","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\assets\\default_data","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui\\assets","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\resultui","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\res\\swf","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\res\\style","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\res\\images","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\res","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\simisent\\images","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\simisent\\css","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins\\simisent","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\otherskins","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0\\localdicts","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\install_7.5.2.0\\7.5.2.0","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\youdao\\dict","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\guid.dat","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%LOCALAPPDATA%\\Youdao\\Dict\\Application\\vendor.dat","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\YOUDAO\\DICT\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKLM\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKLM\\SOFTWARE\\YOUDAO\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\YOUDAODICTINSTALLER_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\YOUDAOGETWORD32.CONNECT.1\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\YOUDAOGETWORD32.CONNECT.1\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\YOUDAOGETWORD32.CONNECT\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\YOUDAOGETWORD32.CONNECT\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\YOUDAOGETWORD32.CONNECT\\CURVER\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\\PROGID\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\\VERSIONINDEPENDENTPROGID\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\\PROGRAMMABLE\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{BB241B94-028A-441D-B9EB-B9AD3FDF2D9A}\\TYPELIB\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\TYPELIB\\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\TYPELIB\\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\\1.0\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\TYPELIB\\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\\1.0\\FLAGS\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\TYPELIB\\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\\1.0\\0\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\TYPELIB\\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\\1.0\\0\\WIN32\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\TYPELIB\\{7659C504-025E-4FB5-A9EC-8D2A42C9B2AF}\\1.0\\HELPDIR\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!PrivacIE!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Local\\!PrivacIE!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{3480CE0E-C867-4657-8B39-F679E6CF90BA}","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{4A856E36-7472-47EB-818F-36F1BD90FDF6}","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"{4A856E36-7472-47EB-818F-36F1BD90FDF6}","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"{3480CE0E-C867-4657-8B39-F679E6CF90BA}","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BEDEFA07-CF3E-4770-8118-5C21666CAF0F}b4ceb07d6785d7b8b129d4c7e3ac1548","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"{BEDEFA07-CF3E-4770-8118-5C21666CAF0F}b4ceb07d6785d7b8b129d4c7e3ac1548","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\YoudaoDictInstaller_install_7b4f328c5fa2a82b036014eca13a918d_full_0","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!jdjopbh!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!jdjopbh!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!jdjopbh!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!jdjopbh!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Local\\c:!users!jdjopbh!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Local\\c:!users!jdjopbh!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"YoudaoDictInstaller_install_7b4f328c5fa2a82b036014eca13a918d_full_0","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Local\\c:!users!jdjopbh!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"Local\\c:!users!jdjopbh!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5a68c3f07ca3e171a359f473"}]}]}},"report_ids":{"sandbox_job_ids":["5a68c3f07ca3e171a359f473"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Adware.MobogenieCRTD Sample b7a1a5901b93… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b7a1a5901b93…. Malware family: Adware.MobogenieCRTD. Threat score 100/100. 2/28 AV engines flagged this file. 9 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b7a1a5901b93f80a699fdac1ad2896bb8abf6cb98b51fcc9fb0408c5d48e141f"}],["$","meta","4",{"property":"og:title","content":"Malicious Adware.MobogenieCRTD Sample b7a1a5901b93… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b7a1a5901b93…. Malware family: Adware.MobogenieCRTD. Threat score 100/100. 2/28 AV engines flagged this file. 9 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b7a1a5901b93f80a699fdac1ad2896bb8abf6cb98b51fcc9fb0408c5d48e141f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Adware.MobogenieCRTD Sample b7a1a5901b93… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b7a1a5901b93…. Malware family: Adware.MobogenieCRTD. Threat score 100/100. 2/28 AV engines flagged this file. 9 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3d","11",{}]]