26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T514,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious ReImageRepair.G potentially unwanted application Sample ec67e8947166… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ec67e8947166…. Malware family: ReImageRepair.G potentially unwanted application. Threat score 100/100. 4/28 AV engines flagged this file. 10 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ec67e8947166fd22f79c54588b11697513e9e0d79f42cf9f52b8e51ff8577f41","keywords":["Malicious","ReImageRepair.G potentially unwanted application","malware analysis","sandbox report","threat intelligence","ec67e8947166fd22f79c54588b11697513e9e0d79f42cf9f52b8e51ff8577f41"],"about":{"@type":"SoftwareApplication","name":"ReimageRepair.exe","applicationCategory":["peexe","executable"],"identifier":"ec67e8947166fd22f79c54588b11697513e9e0d79f42cf9f52b8e51ff8577f41","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"ReImageRepair.G potentially unwanted application","antivirusDetections":{"malicious":4,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T836,"SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0" "SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'" "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" "CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);" "CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));" "CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);" "CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);" "DELETE FROM sqlite_sequence;" "INSERT INTO sqlite_master(type,name,tbl_name,rootpage,sql)VALUES('table','%q','%q',0,'%q');" "CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, z" "UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;" "UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;" "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" "CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))" "UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');"28:T7a6,Antivirus vendors marked dropped file "LogEx.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "nsDialogs.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "sqlite3.exe" as clean (type is "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows"), Antivirus vendors marked dropped file "UserInfo.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "nsExec.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "Banner.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "System.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "stack.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "ExecDos.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "WmiInspector.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "xml.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "ns2030.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "ns50E8.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "ns9D36.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "ns1D5.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows")29:T8d9,"GET /includes/install_start.php?trackid=&tracking=&campaign=&minorsessionid=ba25f4a13ae54621a286c4561b&sessionid=868e1a12-a836-4c16-a31c-e36bac40d85d&t=CONSUMER&a=ENABLED&u=ENABLED&s=ENABLED HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: www.reimageplus.com Connection: Keep-Alive Cache-Control: no-cache" "GET /events4mem.php?version=GUI1511&SessionID=868e1a12-a836-4c16-a31c-e36bac40d85d&MinorSessionID=ba25f4a13ae54621a286c4561b&id=MDINF¶m=OS=7<*>AV=<*>Firewall=<*>GooglePing=47<*>nslookup=vip0x050.ssl.hwcdn.net<*>File=Exitst<*>path=C:\ReimageRepair.exe<*>md5=d729e0726f77304b299085afba059b5f<*>size=768512&trackutil= HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: www.reimageplus.com Connection: Keep-Alive Cache-Control: no-cache Cookie: X-Mapping-fjhppofk=706EA6CC82CA8F8D58B711711E2AC50D; PHPSESSID=ffme3qr3qht33k4r15ki0fk6h6; _trackid=6156757326; _trackid_6156757326=6156757326; _tracking=revenuewire; _tracking_revenuewire=revenuewire; _campaign=direct; _campaign_direct=direct; _adgroup=direct; _adgroup_direct=direct; _keyword=direct; _keyword_direct=direct; _ads=direct; _ads_direct=direct; _browser=IE; _browser_IE=IE; _country=United+States; _country_United%20States=United%20States" "GET /events4mem.php?version=GUI1511&SessionID=868e1a12-a836-4c16-a31c-e36bac40d85d&MinorSessionID=ba25f4a13ae54621a286c4561b&id=MDPRC¶m=taskhost*dwm*OSPPSVC*ReimageRepair*&trackutil= HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: www.reimageplus.com Connection: Keep-Alive Cache-Control: no-cache Cookie: X-Mapping-fjhppofk=706EA6CC82CA8F8D58B711711E2AC50D; PHPSESSID=ffme3qr3qht33k4r15ki0fk6h6; _trackid=6156757326; _trackid_6156757326=6156757326; _tracking=revenuewire; _tracking_revenuewire=revenuewire; _campaign=direct; _campaign_direct=direct; _adgroup=direct; _adgroup_direct=direct; _keyword=direct; _keyword_direct=direct; _ads=direct; _ads_direct=direct; _browser=IE; _browser_IE=IE; _country=United+States; _country_United%20States=United%20States" "GET /downloader_version.xml HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: cdnrep.reimage.com Connection: Keep-Alive Cache-Control: no-cache" "GET /rqj/ns/ReimageRepair.exe HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: cdnrep.reimage.com Connection: Keep-Alive Cache-Control: no-cache"2a:T857,"ReimageRepair.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "ReimageRepair.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "ReimageRepair.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "ReimageRepair.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "ReimageRepair.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "ReimageRepair.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "ReimageRepair.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "ReimageRepair.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "ReimageRepair.exe" touched "Search Gatherer Notification" (Path: "HKCU\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS") "ReimageRepair.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS") "ReimageRepair.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "ReimageRepair.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS") "tasklist.exe" touched "WbemStatusCode" (Path: "HKCU\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS") "regsvr32.exe" touched "JScript Language" (Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}") "regsvr32.exe" touched "JScript Language Authoring" (Path: "HKCU\CLSID\{F414C261-6AC0-11CF-B6D1-00AA00BBBB58}\INPROCSERVER") "regsvr32.exe" touched "JScript Language Encoding" (Path: "HKCU\CLSID\{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}\INPROCSERVER") "regsvr32.exe" touched "JScript Compact Profile (ECMA 327)" (Path: "HKCU\CLSID\{CC5BBEC3-DB4A-4BED-828D-08D78EE3E1ED}\INPROCSERVER")2b:T951,Spawned process "ns50E8.tmp" with commandline ""%TEMP%\FF.bat" > %TEMP%\FF.txt" (UID: 00106184-00002612) Spawned process "cmd.exe" with commandline "/c ""%TEMP%\FF.bat" > %TEMP%\FF.txt"" (UID: 00106277-00004184) Spawned process "sqlite3.exe" with commandline ""%APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\cookies.sql ..." (UID: 00106281-00002912), Spawned process "ns2030.tmp" with commandline ""%TEMP%\FF.bat" > %TEMP%\FF.txt" (UID: 00109580-00004044), Spawned process "cmd.exe" with commandline "/c ""%TEMP%\FF.bat" > %TEMP%\FF.txt"" (UID: 00109677-00000660), Spawned process "sqlite3.exe" with commandline ""%APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\cookies.sql ..." (UID: 00109681-00004348) Spawned process "ns33F.tmp" with commandline ""%TEMP%\FF.bat" > %TEMP%\FF.txt" (UID: 00113299-00003472) Spawned process "cmd.exe" with commandline "/c ""%TEMP%\FF.bat" > %TEMP%\FF.txt"" (UID: 00113394-00002928) Spawned process "sqlite3.exe" with commandline ""%APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\cookies.sql ..." (UID: 00113398-00001936), Spawned process "nsE97A.tmp" with commandline "cmd /C tasklist /FI "IMAGENAME eq Reimage.exe" > %TEMP%\IsProces ..." (UID: 00117072-00002212), Spawned process "cmd.exe" with commandline "cmd /C tasklist /FI "IMAGENAME eq Reimage.exe" > %TEMP%\IsProces ..." (UID: 00117171-00005036), Spawned process "tasklist.exe" with commandline "tasklist /FI "IMAGENAME eq Reimage.exe"" (UID: 00117175-00005032), Spawned process "ns1D5.tmp" with commandline "cmd /C tasklist /FI "IMAGENAME eq AVupdate.exe" > %TEMP%\IsProce ..." (UID: 00117500-00005088), Spawned process "cmd.exe" with commandline "cmd /C tasklist /FI "IMAGENAME eq AVupdate.exe" > %TEMP%\IsProce ..." (UID: 00117610-00005236), Spawned process "tasklist.exe" with commandline "tasklist /FI "IMAGENAME eq AVupdate.exe"" (UID: 00117613-00005332), Spawned process "PING.EXE" with commandline "-n 4 www.google.com" (UID: 00118007-00005480), Spawned process "nslookup.exe" with commandline "cdnrep.reimage.com" (UID: 00118253-00005156), Spawned process "tasklist.exe" (UID: 00118279-00004980), Spawned process "regsvr32.exe" with commandline "regsvr32 /s "%WINDIR%\system32\jscript.dll"" (UID: 00119752-00005960), Spawned process "ReimageRepair.exe" with commandline "/update=1 /Language=1033 /tracking=0 /campaign=0 /adgroup=0 /Ads ..." (UID: 00119832-00002708)2c:T951,Spawned process "ns50E8.tmp" with commandline ""%TEMP%\FF.bat" > %TEMP%\FF.txt" (UID: 00106184-00002612) Spawned process "cmd.exe" with commandline "/c ""%TEMP%\FF.bat" > %TEMP%\FF.txt"" (UID: 00106277-00004184) Spawned process "sqlite3.exe" with commandline ""%APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\cookies.sql ..." (UID: 00106281-00002912), Spawned process "ns2030.tmp" with commandline ""%TEMP%\FF.bat" > %TEMP%\FF.txt" (UID: 00109580-00004044), Spawned process "cmd.exe" with commandline "/c ""%TEMP%\FF.bat" > %TEMP%\FF.txt"" (UID: 00109677-00000660), Spawned process "sqlite3.exe" with commandline ""%APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\cookies.sql ..." (UID: 00109681-00004348) Spawned process "ns33F.tmp" with commandline ""%TEMP%\FF.bat" > %TEMP%\FF.txt" (UID: 00113299-00003472) Spawned process "cmd.exe" with commandline "/c ""%TEMP%\FF.bat" > %TEMP%\FF.txt"" (UID: 00113394-00002928) Spawned process "sqlite3.exe" with commandline ""%APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\cookies.sql ..." (UID: 00113398-00001936), Spawned process "nsE97A.tmp" with commandline "cmd /C tasklist /FI "IMAGENAME eq Reimage.exe" > %TEMP%\IsProces ..." (UID: 00117072-00002212), Spawned process "cmd.exe" with commandline "cmd /C tasklist /FI "IMAGENAME eq Reimage.exe" > %TEMP%\IsProces ..." (UID: 00117171-00005036), Spawned process "tasklist.exe" with commandline "tasklist /FI "IMAGENAME eq Reimage.exe"" (UID: 00117175-00005032), Spawned process "ns1D5.tmp" with commandline "cmd /C tasklist /FI "IMAGENAME eq AVupdate.exe" > %TEMP%\IsProce ..." (UID: 00117500-00005088), Spawned process "cmd.exe" with commandline "cmd /C tasklist /FI "IMAGENAME eq AVupdate.exe" > %TEMP%\IsProce ..." (UID: 00117610-00005236), Spawned process "tasklist.exe" with commandline "tasklist /FI "IMAGENAME eq AVupdate.exe"" (UID: 00117613-00005332), Spawned process "PING.EXE" with commandline "-n 4 www.google.com" (UID: 00118007-00005480), Spawned process "nslookup.exe" with commandline "cdnrep.reimage.com" (UID: 00118253-00005156), Spawned process "tasklist.exe" (UID: 00118279-00004980), Spawned process "regsvr32.exe" with commandline "regsvr32 /s "%WINDIR%\system32\jscript.dll"" (UID: 00119752-00005960), Spawned process "ReimageRepair.exe" with commandline "/update=1 /Language=1033 /tracking=0 /campaign=0 /adgroup=0 /Ads ..." (UID: 00119832-00002708)2d:T468,The input sample is signed with a certificate issued by "CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA" (SHA1: 6C:07:45:3F:FD:DA:08:B8:37:07:C0:9B:82:FB:3D:15:F3:53:36:B1; see report for more information) The input sample is signed with a certificate issued by "CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US" (SHA1: 65:43:99:29:B6:79:73:EB:19:2D:6F:F2:43:E6:76:7A:DF:08:34:E4; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa c10, OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: D8:6F:E9:52:35:2A:62:35:54:22:8B:27:41:EF:A3:CF:35:04:E9:F9; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="c 2006 VeriSign Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: 49:58:47:A9:31:87:CF:B8:C7:1F:84:0C:B7:B4:14:97:AD:95:C6:4F; see report for more information)2e:T534,"LogEx.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ReimageRepair_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "nsDialogs.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "FF.bat" has type "DOS batch file ASCII text with CRLF line terminators" "sqlite3.exe" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows" "UserInfo.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ReimageRepair.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "inetc.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "nsExec.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Banner.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "md5dll.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "stack.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ExecDos.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "WmiInspector.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "xml.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"2f:T730,"ReimageRepair.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "ReimageRepair.exe" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "ReimageRepair.exe" touched file "C:\Windows\Fonts\StaticCache.dat" "ReimageRepair.exe" touched file "C:\Windows\System32\rsaenh.dll" "ReimageRepair.exe" touched file "C:\Windows\System32\en-US\shell32.dll.mui" "ReimageRepair.exe" touched file "C:\Users\c43bQ3N\AppData\Local\Microsoft\Windows\Caches" "ReimageRepair.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "ReimageRepair.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001f.db" "ReimageRepair.exe" touched file "C:\Windows\Reimage.ini" "ReimageRepair.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "ReimageRepair.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\0GCX0MOZ.txt" "ReimageRepair.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\0K93Q13F.txt" "ReimageRepair.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\0L4X42T9.txt" "ReimageRepair.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\013SKKWU.txt" "ReimageRepair.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\01RLWRK4.txt" "ReimageRepair.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\02251G37.txt" "ReimageRepair.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\04C1GH32.txt" "ReimageRepair.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\04ZFG79Q.txt" "ReimageRepair.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\05DR3CFO.txt"30:T4a6,Pattern match: "http://ocsp.thawte.com0" Pattern match: "http://crl.thawte.com/ThawteTimestampingCA.crl0" Pattern match: "http://ts-ocsp.ws.symantec.com07" Pattern match: "http://ts-aia.ws.symantec.com/tss-ca-g2.cer0" Pattern match: "http://ts-crl.ws.symantec.com/tss-ca-g2.crl0" Pattern match: "https://www.verisign.com/rpa" Pattern match: "http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D" Pattern match: "https://www.verisign.com/rpa0" Pattern match: "http://ocsp.verisign.com0" Pattern match: "http://csc3-2010-aia.verisign.com/CSC3-2010.cer0" Pattern match: "https://www.verisign.com/cps0*" Pattern match: "http://logo.verisign.com/vslogo.gif04" Pattern match: "http://crl.verisign.com/pca3-g5.crl04" Pattern match: "www.reimageplus.com" Pattern match: "http://nsis.sf.net/NSIS_Error" Heuristic match: "cdnrep.reimage.com" Heuristic match: "8.8.8.8.in-addr.arpa" Heuristic match: "reimageplus.com" Pattern match: "www.google.com" Heuristic match: "Server: google-public-dns-a.google.com Address: 8.8.8.8 Name: vip0x050.ssl.hwcdn.net Address: 205.185.208.80 Aliases: cdnrep.reimage.com" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings"31:T4ea,"LogEx.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ReimageRepair_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "nsDialogs.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "sqlite3.exe" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows" "UserInfo.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ReimageRepair.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "inetc.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "nsExec.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Banner.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "md5dll.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "stack.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ExecDos.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "WmiInspector.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "xml.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"32:T5a2,"C:\ReimageRepair.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsd504B.tmp" for deletion "C:\ReimageRepair.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsd4B47.tmp" for deletion "C:\ReimageRepair.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsj4B68.tmp" for deletion "C:\ReimageRepair.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsj4B68.tmp\ns50E8.tmp" for deletion "C:\ReimageRepair.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\FF.bat" for deletion "C:\ReimageRepair.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\FF.txt" for deletion "%TEMP%\sqlite3.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\cookies.sqlite-shm" for deletion "%TEMP%\sqlite3.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\cookies.sqlite-wal" for deletion "%TEMP%\ReimageRepair.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsj9A17.tmp\ns9D36.tmp" for deletion "%TEMP%\ReimageRepair.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\FF.bat" for deletion "%TEMP%\ReimageRepair.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\FF.txt" for deletion "%TEMP%\ReimageRepair.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nst99B7.tmp" for deletion "%TEMP%\ReimageRepair.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsj9A17.tmp" for deletion "%TEMP%\ReimageRepair.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nse9C1B.tmp" for deletion33:T5e9,"ReimageRepair.exe" opened "C:\Users\c43bQ3N\AppData\Local\Temp\nsd504B.tmp" with delete access "ReimageRepair.exe" opened "C:\Users\c43bQ3N\AppData\Local\Temp\nsd4B47.tmp" with delete access "ReimageRepair.exe" opened "C:\Users\c43bQ3N\AppData\Local\Temp\nsj4B68.tmp" with delete access "ReimageRepair.exe" opened "C:\Users\c43bQ3N\AppData\Local\Temp\nsj4B68.tmp\ns50E8.tmp" with delete access "ReimageRepair.exe" opened "C:\Users\c43bQ3N\AppData\Local\Temp\FF.bat" with delete access "ReimageRepair.exe" opened "C:\Users\c43bQ3N\AppData\Local\Temp\FF.txt" with delete access "ReimageRepair.exe" opened "C:\Users\c43bQ3N\AppData\Local\Temp\nsp2001.tmp" with delete access "ReimageRepair.exe" opened "C:\Users\c43bQ3N\AppData\Local\Temp\nsj4B68.tmp\ns2030.tmp" with delete access "ReimageRepair.exe" opened "C:\Users\c43bQ3N\AppData\Local\Temp\nsl2E1.tmp" with delete access "ReimageRepair.exe" opened "C:\Users\c43bQ3N\AppData\Local\Temp\nsj4B68.tmp\ns33F.tmp" with delete access "ReimageRepair.exe" opened "C:\Users\c43bQ3N\AppData\Local\Temp\IsProcessActive.txt" with delete access "ReimageRepair.exe" opened "C:\Users\c43bQ3N\AppData\Local\Temp\nsj4B68.tmp\ns1D5.tmp" with delete access "ReimageRepair.exe" opened "C:\Users\c43bQ3N\AppData\Local\Temp\nsj4B68.tmp\nsE97A.tmp" with delete access "ReimageRepair.exe" opened "C:\Users\c43bQ3N\AppData\Local\Temp\nsy227E.tmp" with delete access "ReimageRepair.exe" opened "C:\Users\c43bQ3N\AppData\Local\Temp\InstallationPixel.txt" with delete access34:T448,RegCreateKeyExW RegCloseKey RegDeleteValueW RegEnumKeyW RegOpenKeyExW RegDeleteKeyW CopyFileW GetModuleFileNameW GetVersionExW GetFileAttributesW LoadLibraryA GetFileSize OpenProcess GetCommandLineW LoadLibraryExW CreateDirectoryW DeleteFileW GetProcAddress GetTempFileNameW GetModuleHandleA CreateThread LoadLibraryW FindNextFileW GetTempPathW FindFirstFileW GetModuleHandleW WriteFile CreateFileW CreateProcessW Sleep GetTickCount ShellExecuteW FindWindowExW GetVersionExA GetModuleFileNameA GetCommandLineA GetStartupInfoA TerminateProcess VirtualAlloc OutputDebugStringW GetFileAttributesA VirtualProtect DeleteFileA MapViewOfFile CreateFileMappingW GetTempPathA GetFileAttributesExW CreateFileA OutputDebugStringA OpenProcessToken GetUserNameW SleepEx HttpQueryInfoW InternetOpenW InternetConnectW InternetWriteFile HttpSendRequestExW InternetCloseHandle InternetCrackUrlW InternetQueryOptionW HttpSendRequestW InternetReadFile FtpOpenFileW SetSecurityDescriptorDacl GetStartupInfoW UnhandledExceptionFilter IsDebuggerPresent35:Ta2e,"ReimageRepair.exe" wrote bytes "48127f75" to virtual address "0x758083C0" (part of module "SSPICLI.DLL") "ReimageRepair.exe" wrote bytes "f8117f75" to virtual address "0x758083E0" (part of module "SSPICLI.DLL") "ReimageRepair.exe" wrote bytes "48120000" to virtual address "0x757F139C" (part of module "SSPICLI.DLL") "ReimageRepair.exe" wrote bytes "48120000" to virtual address "0x757F12DC" (part of module "SSPICLI.DLL") "ReimageRepair.exe" wrote bytes "f8117f75" to virtual address "0x758083C4" (part of module "SSPICLI.DLL") "ReimageRepair.exe" wrote bytes "48127f75" to virtual address "0x75808364" (part of module "SSPICLI.DLL") "ReimageRepair.exe" wrote bytes "68130000" to virtual address "0x76A51680" (part of module "WS2_32.DLL") "ReimageRepair.exe" wrote bytes "b8c0155d73ffe0" to virtual address "0x757F11F8" (part of module "SSPICLI.DLL") "ReimageRepair.exe" wrote bytes "48127f75" to virtual address "0x75808348" (part of module "SSPICLI.DLL") "ReimageRepair.exe" wrote bytes "f8117f75" to virtual address "0x75808368" (part of module "SSPICLI.DLL") "ReimageRepair.exe" wrote bytes "c04ea9772054aa77e065aa77b538ab770000000000d0c17700000000c5eac1770000000088eac17700000000e968c4758228ab77ee29ab7700000000d269c475000000007dbbc1770000000009bec47500000000ba18c17700000000" to virtual address "0x75EB1000" (part of module "NSI.DLL") "ReimageRepair.exe" wrote bytes "f8117f75" to virtual address "0x7580834C" (part of module "SSPICLI.DLL") "ReimageRepair.exe" wrote bytes "b830125d73ffe0" to virtual address "0x76A51368" (part of module "WS2_32.DLL") "ReimageRepair.exe" wrote bytes "e739a777e1a6ab772e71ab77ee29ab7785e2a6776da0ab779064aa773ad5b17726e4a677d16dab77003da977804ba97700000000ad37a5768b2da576b641a57600000000" to virtual address "0x75321000" (part of module "WSHIP6.DLL") "ReimageRepair.exe" wrote bytes "f8110000" to virtual address "0x757F12CC" (part of module "SSPICLI.DLL") "ReimageRepair.exe" wrote bytes "f8110000" to virtual address "0x757F1408" (part of module "SSPICLI.DLL") "ReimageRepair.exe" wrote bytes "b840135d73ffe0" to virtual address "0x757F1248" (part of module "SSPICLI.DLL") "ReimageRepair.exe" wrote bytes "60125d73" to virtual address "0x763CE324" (part of module "WININET.DLL") "ReimageRepair.exe" wrote bytes "7da3c17795a3c1772d2dc1770fa8c177f990c077dba3c1778aa2c17781a8c1778da4c17700000000733b9b76173f99763c449b7632299a76dc289a764e449b76f8219a765c5599762b3b9e766486987628ad98768b429b76c8cf9c7600000000" to virtual address "0x02393000" "ReimageRepair.exe" wrote bytes "48127f75" to virtual address "0x758083DC" (part of module "SSPICLI.DLL")36:Tcdc,"ReimageRepair.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj4B68.tmp\ns50E8.tmp" (Handle: 568) "ReimageRepair.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj4B68.tmp\ns50E8.tmp" (Handle: 568) "ReimageRepair.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj4B68.tmp\ns50E8.tmp" (Handle: 568) "ReimageRepair.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj4B68.tmp\ns2030.tmp" (Handle: 3708) "ReimageRepair.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj4B68.tmp\ns2030.tmp" (Handle: 3708) "ReimageRepair.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj4B68.tmp\ns2030.tmp" (Handle: 3708) "ReimageRepair.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj4B68.tmp\ns33F.tmp" (Handle: 6828) "ReimageRepair.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj4B68.tmp\ns33F.tmp" (Handle: 6828) "ReimageRepair.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj4B68.tmp\ns33F.tmp" (Handle: 6828) "ReimageRepair.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj4B68.tmp\ns1D5.tmp" (Handle: 9948) "ReimageRepair.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj4B68.tmp\ns1D5.tmp" (Handle: 9948) "ReimageRepair.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj4B68.tmp\ns1D5.tmp" (Handle: 9948) "ReimageRepair.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj4B68.tmp\nsE97A.tmp" (Handle: 9952) "ReimageRepair.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj4B68.tmp\nsE97A.tmp" (Handle: 9952) "ReimageRepair.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj4B68.tmp\nsE97A.tmp" (Handle: 9952) "ReimageRepair.exe" wrote 32 bytes to a remote process "C:\Windows\System32\PING.EXE" (Handle: 10352) "ReimageRepair.exe" wrote 52 bytes to a remote process "C:\Windows\System32\PING.EXE" (Handle: 10352) "ReimageRepair.exe" wrote 4 bytes to a remote process "C:\Windows\System32\PING.EXE" (Handle: 10352) "cmd.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\sqlite3.exe" (Handle: 96) "cmd.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\sqlite3.exe" (Handle: 96) "cmd.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\sqlite3.exe" (Handle: 96) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\tasklist.exe" (Handle: 88) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\tasklist.exe" (Handle: 88) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\tasklist.exe" (Handle: 88) "ReimageRepair.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj9A17.tmp\ns9D36.tmp" (Handle: 508) "ReimageRepair.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj9A17.tmp\ns9D36.tmp" (Handle: 508) "ReimageRepair.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsj9A17.tmp\ns9D36.tmp" (Handle: 508)37:Tfef,Found malicious artifacts related to "161.47.7.14": ... URL: http://www.reimageplus.com/includes/install_start.php?trackid=&tracking=&campaign=&minorsessionid=db4a10972f0a4165a64da75f6f&sessionid=5a0fa606-5362-4e5d-9573-ac7c61c83e9d&t=consumer&a=disabled&u=disabled&s=disabled&c=disabled&v=1529 (AV positives: 1/69 scanned on 03/30/2019 02:35:46) URL: http://reimageplus.com/ (AV positives: 1/69 scanned on 03/29/2019 09:29:32) URL: http://www.reimageplus.com/ (AV positives: 1/66 scanned on 03/29/2019 05:43:28) URL: http://www.reimageplus.com/includes/install_start.php?trackid=6111186514&tracking=NewCo2&campaign=dnetc_cleanmypc&minorsessionid=39179fb7ad244ac08b27b794f5&sessionid=704ad63c-fe5a-48a9-af67-1940dcda9645&t=CONSUMER&a=ENABLED&u=ENABLED&s=${AVG_SEAL}&c=DISABLED&v=1539 (AV positives: 1/69 scanned on 03/29/2019 05:33:42) URL: http://www.reimageplus.com/includes/install_start.php?trackid=&tracking=&campaign=&minorsessionid=cd92adbe2a99401ea2226156ab&sessionid=696bfbbd-cf6c-4edb-aaf5-8d9b6763fec9&t=consumer&a=disabled&u=disabled&s=disabled (AV positives: 1/69 scanned on 03/29/2019 02:28:52) File SHA256: a9351e522ac3d86324dfb455617bfa01da737d1b93fe0f16ba5e614e0e904c56 (AV positives: 7/72 scanned on 03/30/2019 01:49:18) File SHA256: d34a44ebabb2138f839efce907d9a883780a571ea9e2e289f062ee1594055720 (Date: 03/26/2019 01:04:12) File SHA256: ed26f4cf393f092519be0ae81c0088a5ee4b70345ef8aae38d4d25c04f03936a (Date: 03/26/2019 01:01:28) File SHA256: b956119b9d021a08a683cadcc3e278da90a713a76487f8ba6185e73b4eda4d33 (Date: 03/22/2019 05:40:17) File SHA256: 9cda0d00a4f2113e61be24bdf98a31a3a8a125e3eae669261a7fe0fc796f2360 (Date: 03/22/2019 05:37:39) File SHA256: 07d1a2301fc6ba2f733a1e98c7bff0cb4d7d8998139389947c0308f8d88c9434 (Date: 03/21/2019 21:17:40) File SHA256: 60d209807c347c62ef22de7276e4b0529220a016fe0f34042b6d0c895835658c (AV positives: 4/69 scanned on 03/14/2019 01:11:29) File SHA256: bf2ccda116ad4e50f4068091345e9400e4391a4492c8de0c3e0ea07239993db0 (AV positives: 16/64 scanned on 03/07/2019 10:02:51) File SHA256: 9bad4fab860ac283b9be15ab1e23a6437a62647058c875170962db2f73e3c9c9 (AV positives: 5/68 scanned on 03/06/2019 15:08:32) File SHA256: 5a43003b3bd230953cbd8f29a0374cfc9283c3e94889858e6965b3632c36ddd5 (AV positives: 5/69 scanned on 03/06/2019 14:48:28) Found malicious artifacts related to "205.185.208.80": ... URL: http://cdnrep.reimage.com/ver/ReimagePackage1849x64b.exe (AV positives: 2/69 scanned on 03/30/2019 18:43:02) URL: http://cdnrep.reimage.com/rpq/nt/reimagerepair.exe (AV positives: 2/69 scanned on 03/30/2019 17:54:03) URL: http://cdnrep.reimage.com/download/uus/ReimageRepair.exe (AV positives: 3/66 scanned on 03/30/2019 17:52:05) URL: http://cdnrep.reimage.com/download (AV positives: 1/66 scanned on 03/30/2019 17:51:58) URL: http://cdnrep.reimageplus.com/ (AV positives: 1/69 scanned on 03/30/2019 15:54:52) File SHA256: 161763979870aa132f00026c66376adf059f6f5e49237f24044384d15103b145 (AV positives: 11/68 scanned on 03/30/2019 02:21:26) File SHA256: 71d8d5dc1d5d412e7ce04993caccbb693a6828160416dd9ea16bf352b00ee4dc (AV positives: 13/65 scanned on 03/30/2019 17:52:10) File SHA256: a9351e522ac3d86324dfb455617bfa01da737d1b93fe0f16ba5e614e0e904c56 (AV positives: 7/72 scanned on 03/30/2019 01:49:17) File SHA256: 225cb8d31ca5a9a432d14b3063a9441b551874d2ec5d4ef8aa1c212e29272846 (AV positives: 3/63 scanned on 03/29/2019 05:42:31) File SHA256: d395979c7476334523cc930f66db8f3cce5fde31a4dc2807153b7fc4babcebe8 (AV positives: 4/65 scanned on 03/29/2019 05:40:29) File SHA256: ed26f4cf393f092519be0ae81c0088a5ee4b70345ef8aae38d4d25c04f03936a (Date: 03/26/2019 01:01:28) File SHA256: b956119b9d021a08a683cadcc3e278da90a713a76487f8ba6185e73b4eda4d33 (Date: 03/22/2019 05:40:17) File SHA256: 9cda0d00a4f2113e61be24bdf98a31a3a8a125e3eae669261a7fe0fc796f2360 (Date: 03/22/2019 05:37:39) File SHA256: 07d1a2301fc6ba2f733a1e98c7bff0cb4d7d8998139389947c0308f8d88c9434 (Date: 03/21/2019 21:17:40) File SHA256: 2be5af0c3fb3ba62a8ed1cae87ca3b371455acb50e4171e32bcbcc7389b72ccf (Date: 03/19/2019 05:18:31)38:Tfef,Found malicious artifacts related to "161.47.7.14": ... URL: http://www.reimageplus.com/includes/install_start.php?trackid=&tracking=&campaign=&minorsessionid=db4a10972f0a4165a64da75f6f&sessionid=5a0fa606-5362-4e5d-9573-ac7c61c83e9d&t=consumer&a=disabled&u=disabled&s=disabled&c=disabled&v=1529 (AV positives: 1/69 scanned on 03/30/2019 02:35:46) URL: http://reimageplus.com/ (AV positives: 1/69 scanned on 03/29/2019 09:29:32) URL: http://www.reimageplus.com/ (AV positives: 1/66 scanned on 03/29/2019 05:43:28) URL: http://www.reimageplus.com/includes/install_start.php?trackid=6111186514&tracking=NewCo2&campaign=dnetc_cleanmypc&minorsessionid=39179fb7ad244ac08b27b794f5&sessionid=704ad63c-fe5a-48a9-af67-1940dcda9645&t=CONSUMER&a=ENABLED&u=ENABLED&s=${AVG_SEAL}&c=DISABLED&v=1539 (AV positives: 1/69 scanned on 03/29/2019 05:33:42) URL: http://www.reimageplus.com/includes/install_start.php?trackid=&tracking=&campaign=&minorsessionid=cd92adbe2a99401ea2226156ab&sessionid=696bfbbd-cf6c-4edb-aaf5-8d9b6763fec9&t=consumer&a=disabled&u=disabled&s=disabled (AV positives: 1/69 scanned on 03/29/2019 02:28:52) File SHA256: a9351e522ac3d86324dfb455617bfa01da737d1b93fe0f16ba5e614e0e904c56 (AV positives: 7/72 scanned on 03/30/2019 01:49:18) File SHA256: d34a44ebabb2138f839efce907d9a883780a571ea9e2e289f062ee1594055720 (Date: 03/26/2019 01:04:12) File SHA256: ed26f4cf393f092519be0ae81c0088a5ee4b70345ef8aae38d4d25c04f03936a (Date: 03/26/2019 01:01:28) File SHA256: b956119b9d021a08a683cadcc3e278da90a713a76487f8ba6185e73b4eda4d33 (Date: 03/22/2019 05:40:17) File SHA256: 9cda0d00a4f2113e61be24bdf98a31a3a8a125e3eae669261a7fe0fc796f2360 (Date: 03/22/2019 05:37:39) File SHA256: 07d1a2301fc6ba2f733a1e98c7bff0cb4d7d8998139389947c0308f8d88c9434 (Date: 03/21/2019 21:17:40) File SHA256: 60d209807c347c62ef22de7276e4b0529220a016fe0f34042b6d0c895835658c (AV positives: 4/69 scanned on 03/14/2019 01:11:29) File SHA256: bf2ccda116ad4e50f4068091345e9400e4391a4492c8de0c3e0ea07239993db0 (AV positives: 16/64 scanned on 03/07/2019 10:02:51) File SHA256: 9bad4fab860ac283b9be15ab1e23a6437a62647058c875170962db2f73e3c9c9 (AV positives: 5/68 scanned on 03/06/2019 15:08:32) File SHA256: 5a43003b3bd230953cbd8f29a0374cfc9283c3e94889858e6965b3632c36ddd5 (AV positives: 5/69 scanned on 03/06/2019 14:48:28) Found malicious artifacts related to "205.185.208.80": ... URL: http://cdnrep.reimage.com/ver/ReimagePackage1849x64b.exe (AV positives: 2/69 scanned on 03/30/2019 18:43:02) URL: http://cdnrep.reimage.com/rpq/nt/reimagerepair.exe (AV positives: 2/69 scanned on 03/30/2019 17:54:03) URL: http://cdnrep.reimage.com/download/uus/ReimageRepair.exe (AV positives: 3/66 scanned on 03/30/2019 17:52:05) URL: http://cdnrep.reimage.com/download (AV positives: 1/66 scanned on 03/30/2019 17:51:58) URL: http://cdnrep.reimageplus.com/ (AV positives: 1/69 scanned on 03/30/2019 15:54:52) File SHA256: 161763979870aa132f00026c66376adf059f6f5e49237f24044384d15103b145 (AV positives: 11/68 scanned on 03/30/2019 02:21:26) File SHA256: 71d8d5dc1d5d412e7ce04993caccbb693a6828160416dd9ea16bf352b00ee4dc (AV positives: 13/65 scanned on 03/30/2019 17:52:10) File SHA256: a9351e522ac3d86324dfb455617bfa01da737d1b93fe0f16ba5e614e0e904c56 (AV positives: 7/72 scanned on 03/30/2019 01:49:17) File SHA256: 225cb8d31ca5a9a432d14b3063a9441b551874d2ec5d4ef8aa1c212e29272846 (AV positives: 3/63 scanned on 03/29/2019 05:42:31) File SHA256: d395979c7476334523cc930f66db8f3cce5fde31a4dc2807153b7fc4babcebe8 (AV positives: 4/65 scanned on 03/29/2019 05:40:29) File SHA256: ed26f4cf393f092519be0ae81c0088a5ee4b70345ef8aae38d4d25c04f03936a (Date: 03/26/2019 01:01:28) File SHA256: b956119b9d021a08a683cadcc3e278da90a713a76487f8ba6185e73b4eda4d33 (Date: 03/22/2019 05:40:17) File SHA256: 9cda0d00a4f2113e61be24bdf98a31a3a8a125e3eae669261a7fe0fc796f2360 (Date: 03/22/2019 05:37:39) File SHA256: 07d1a2301fc6ba2f733a1e98c7bff0cb4d7d8998139389947c0308f8d88c9434 (Date: 03/21/2019 21:17:40) File SHA256: 2be5af0c3fb3ba62a8ed1cae87ca3b371455acb50e4171e32bcbcc7389b72ccf (Date: 03/19/2019 05:18:31)39:Tce6,Spawned process "ReimageRepair.exe" (UID: 00105965-00002096) Spawned process "ns50E8.tmp" with commandline ""%TEMP%\FF.bat" > %TEMP%\FF.txt" (UID: 00106184-00002612) Spawned process "cmd.exe" with commandline "/c ""%TEMP%\FF.bat" > %TEMP%\FF.txt"" (UID: 00106277-00004184) Spawned process "sqlite3.exe" with commandline ""%APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\cookies.sqlite" "select value expiry from moz_cookies where baseDomain like 'reimageplus.com' and name='_trackid';"" (UID: 00106281-00002912) Spawned process "ns2030.tmp" with commandline ""%TEMP%\FF.bat" > %TEMP%\FF.txt" (UID: 00109580-00004044) Spawned process "cmd.exe" with commandline "/c ""%TEMP%\FF.bat" > %TEMP%\FF.txt"" (UID: 00109677-00000660) Spawned process "sqlite3.exe" with commandline ""%APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\cookies.sqlite" "select value expiry from moz_cookies where baseDomain like 'reimageplus.com' and name='_tracking';"" (UID: 00109681-00004348) Spawned process "ns33F.tmp" with commandline ""%TEMP%\FF.bat" > %TEMP%\FF.txt" (UID: 00113299-00003472) Spawned process "cmd.exe" with commandline "/c ""%TEMP%\FF.bat" > %TEMP%\FF.txt"" (UID: 00113394-00002928) Spawned process "sqlite3.exe" with commandline ""%APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\cookies.sqlite" "select value expiry from moz_cookies where baseDomain like 'reimageplus.com' and name='_campaign';"" (UID: 00113398-00001936) Spawned process "nsE97A.tmp" with commandline "cmd /C tasklist /FI "IMAGENAME eq Reimage.exe" > %TEMP%\IsProcessActive.txt" (UID: 00117072-00002212) Spawned process "cmd.exe" with commandline "cmd /C tasklist /FI "IMAGENAME eq Reimage.exe" > %TEMP%\IsProcessActive.txt" (UID: 00117171-00005036) Spawned process "tasklist.exe" with commandline "tasklist /FI "IMAGENAME eq Reimage.exe"" (UID: 00117175-00005032) Spawned process "ns1D5.tmp" with commandline "cmd /C tasklist /FI "IMAGENAME eq AVupdate.exe" > %TEMP%\IsProcessActive.txt" (UID: 00117500-00005088) Spawned process "cmd.exe" with commandline "cmd /C tasklist /FI "IMAGENAME eq AVupdate.exe" > %TEMP%\IsProcessActive.txt" (UID: 00117610-00005236) Spawned process "tasklist.exe" with commandline "tasklist /FI "IMAGENAME eq AVupdate.exe"" (UID: 00117613-00005332) Spawned process "PING.EXE" with commandline "-n 4 www.google.com" (UID: 00118007-00005480) Spawned process "nslookup.exe" with commandline "cdnrep.reimage.com" (UID: 00118253-00005156) Spawned process "tasklist.exe" (UID: 00118279-00004980) Spawned process "regsvr32.exe" with commandline "regsvr32 /s "%WINDIR%\system32\jscript.dll"" (UID: 00119752-00005960) Spawned process "ReimageRepair.exe" with commandline "/update=1 /Language=1033 /tracking=0 /campaign=0 /adgroup=0 /Ads_Name=0 /Keyword=0 /ResumeInstall=2 /RunSilent=false /pxkp=Delete" (UID: 00119832-00002708) Spawned process "ns9D36.tmp" with commandline ""%TEMP%\FF.bat" > %TEMP%\FF.txt" (UID: 00120017-00005304) Spawned process "cmd.exe" with commandline "/c ""%TEMP%\FF.bat" > %TEMP%\FF.txt"" (UID: 00120111-00006132) Spawned process "sqlite3.exe" with commandline ""%APPDATA%\Mozilla\Firefox\Profiles\g4h7miqt.default\cookies.sqlite" "select value expiry from moz_cookies where baseDomain like 'reimageplus.com' and name='_trackid';"" (UID: 00120117-00002248)3a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8Ad3d3d3d3d3d3d3d3d3d3d4iIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiP/////////////////////////////////////////////4j//////4iIiP////////93/////4d3d3eP////////d/////d3d3d3d3///////wD///9wAHj/dwAH//////8A////AH////+HAP//////AP///wD//////wf//////wD///cA//////////////8A///wAHd3d3d3d4//////AI//8AAAAAAAAAB//////wCP//cAAAAAAAAAf/////8Af//4AP/////4AP//////AA///wB/////9wD//////wAA//9wAI//+AAI//////93d3h/93d3iHd3f///////d3d3d/+Hd3d3eP///////3f4d3j//4d3eP//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"ec67e8947166fd22f79c54588b11697513e9e0d79f42cf9f52b8e51ff8577f41","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790308015151,"unified_at":"2026-09-25T03:46:55.151Z","metadata":{"hashes":{"sha256":"ec67e8947166fd22f79c54588b11697513e9e0d79f42cf9f52b8e51ff8577f41","sha1":"45e7449f1a82158b429be44611ae49bcefdab6e1","md5":"d729e0726f77304b299085afba059b5f","sha512":"c02e66fad7187abba46fbbb61386023166fb2d8b83c443bc78e7f7bf2ea28fe7bd3d2a2ddf1c501cd26e42d78eecba99b19b64ca541e653eedd1d9db07ae2f8a","ssdeep":"12288:C0gAtLIDB0gPZb73RT7E9Yzewxnl9+pqNTO0gcCre50ET3cfE/KyZ2welOq8W:NztLcBNZbbhE0pnl/X0EwfE/P28W","ssdeep_chunks":["12288:C0gAtLI","12288:0gAtLID","12288:gAtLIDB","12288:AtLIDB0","12288:tLIDB0g","12288:LIDB0gP","12288:IDB0gPZ","12288:DB0gPZb","12288:B0gPZb7","12288:0gPZb73","12288:gPZb73R","12288:PZb73RT","12288:Zb73RT7","12288:b73RT7E","12288:73RT7E9","12288:3RT7E9Y","12288:RT7E9Yz","12288:T7E9Yze","12288:7E9Yzew","12288:E9Yzewx","12288:9Yzewxn","12288:Yzewxnl","12288:zewxnl9","12288:ewxnl9+","12288:wxnl9+p","12288:xnl9+pq","12288:nl9+pqN","12288:l9+pqNT","12288:9+pqNTO","12288:+pqNTO0","12288:pqNTO0g","12288:qNTO0gc","12288:NTO0gcC","12288:TO0gcCr","12288:O0gcCre","12288:0gcCre5","12288:gcCre50","12288:cCre50E","12288:Cre50ET","12288:re50ET3","12288:e50ET3c","12288:50ET3cf","12288:0ET3cfE","12288:ET3cfE/","12288:T3cfE/K","12288:3cfE/Ky","12288:cfE/KyZ","12288:fE/KyZ2","12288:E/KyZ2w","12288:/KyZ2we","12288:KyZ2wel","12288:yZ2welO","12288:Z2welOq","12288:2welOq8","12288:welOq8W","24576:C0gAtLI","24576:0gAtLID","24576:gAtLIDB","24576:AtLIDB0","24576:tLIDB0g","24576:LIDB0gP","24576:IDB0gPZ","24576:DB0gPZb","24576:B0gPZb7","24576:0gPZb73","24576:gPZb73R","24576:PZb73RT","24576:Zb73RT7","24576:b73RT7E","24576:73RT7E9","24576:3RT7E9Y","24576:RT7E9Yz","24576:T7E9Yze","24576:7E9Yzew","24576:E9Yzewx","24576:9Yzewxn","24576:Yzewxnl","24576:zewxnl9","24576:ewxnl9+","24576:wxnl9+p","24576:xnl9+pq","24576:nl9+pqN","24576:l9+pqNT","24576:9+pqNTO","24576:+pqNTO0","24576:pqNTO0g","24576:qNTO0gc","24576:NTO0gcC","24576:TO0gcCr","24576:O0gcCre","24576:0gcCre5","24576:gcCre50","24576:cCre50E","24576:Cre50ET","24576:re50ET3","24576:e50ET3c","24576:50ET3cf","24576:0ET3cfE","24576:ET3cfE/","24576:T3cfE/K","24576:3cfE/Ky","24576:cfE/KyZ","24576:fE/KyZ2","24576:E/KyZ2w","24576:/KyZ2we","24576:KyZ2wel","24576:yZ2welO","24576:Z2welOq","24576:2welOq8","24576:welOq8W","12288:NztLcBN","12288:ztLcBNZ","12288:tLcBNZb","12288:LcBNZbb","12288:cBNZbbh","12288:BNZbbhE","12288:NZbbhE0","12288:ZbbhE0p","12288:bbhE0pn","12288:bhE0pnl","12288:hE0pnl/","12288:E0pnl/X","12288:0pnl/X0","12288:pnl/X0E","12288:nl/X0Ew","12288:l/X0Ewf","12288:/X0EwfE","12288:X0EwfE/","12288:0EwfE/P","12288:EwfE/P2","12288:wfE/P28","12288:fE/P28W"],"imphash":"be41bf7b8cc010b614bd36bbca606973"},"file_info":{"file_name":"ReimageRepair.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":768512,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1529389518000,"last_seen":1679314823000,"last_multi_scan":1679314823000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["bladabindi","chir","madang","mkar","neshta","njrat","parite","rat","reimagerepair","evasive"]},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":17},"sandbox_signatures":{"informative_count":29,"suspicious_count":25,"malicious_count":10,"total":64},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/grayware_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/ReImageRepair.G potentially unwanted application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Adware/Reimage.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Crossrider","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"ReImageRepair.G potentially unwanted application","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1056","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to query CPU information"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1063","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1063","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1115","identifiers":[{"type":"suspicious","value":"Contains ability to open the clipboard"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1132","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00106281-00002912-8696-2-00401000\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00109681-00004348-21036-2-00401000","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero\n Raw size of \".data\" is zero\n Raw size of \".bss\" is zero\n Raw size of \"UPX0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00105965-00002096-61738-15-00406831\n GetVersionExW@KERNEL32.DLL at 00105965-00002096-61738-59-004063D8\n GetVersion@KERNEL32.DLL at 00105965-00002096-64281-15-00406831\n GetVersion@KERNEL32.DLL at 00105965-00002096-3672-15-00406831\n GetVersionExW@KERNEL32.DLL at 00106184-00002612-5799-7-0F2B12E7\n GetVersionExW@KERNEL32.DLL at 00109580-00004044-18223-7-0F4F12E7\n GetVersionExW@KERNEL32.DLL at 00113299-00003472-16580-7-0FD212E7\n GetVersionExW@KERNEL32.DLL at 00117072-00002212-19130-7-0F2312E7\n GetVersionExW@KERNEL32.DLL at 00117500-00005088-20979-7-0F6712E7\n GetVersion@KERNEL32.DLL at 00119832-00002708-25909-15-00406966\n GetVersionExW@KERNEL32.DLL at 00119832-00002708-25909-60-0040650D\n GetVersionExW@KERNEL32.DLL at 00120017-00005304-20896-7-0F7C12E7","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00105965-00002096-61738-87-004044D1\n GetDiskFreeSpaceW@KERNEL32.DLL at 00105965-00002096-64281-87-004044D1\n GetDiskFreeSpaceW@KERNEL32.DLL at 00105965-00002096-3672-87-004044D1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-00000240h], 02h\" and \"jne 0F2B1622h\" at 00106184-00002612-5799-7-0F2B12E7\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-00000240h], 02h\" and \"jne 0F4F1622h\" at 00109580-00004044-18223-7-0F4F12E7\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-00000240h], 02h\" and \"jne 0FD21622h\" at 00113299-00003472-16580-7-0FD212E7\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-00000240h], 02h\" and \"jne 0F231622h\" at 00117072-00002212-19130-7-0F2312E7\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-00000240h], 02h\" and \"jne 0F671622h\" at 00117500-00005088-20979-7-0F6712E7\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-00000240h], 02h\" and \"jne 0F7C1622h\" at 00120017-00005304-20896-7-0F7C12E7","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"ReimageRepair.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\REIMAGE REPAIR\")\n \"ReimageRepair.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\EFIX PRO\")\n \"ReimageRepair.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\REIMAGE EXPRESS\")\n \"ReimageRepair.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\EFIX EXPRESS\")\n \"ReimageRepair.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\ANTITOOLBAR\")\n \"ReimageRepair.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\WINFIX PRO\")\n \"ReimageRepair.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\REIMAGEREPAIR.EXE\")\n \"ReimageRepair.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\REIMAGEREPAIR.EXE\")\n \"ReimageRepair.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\REIMAGE BROWSER\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA HTTP Host header invalid\" (SID: 2221028, Rev: 1, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.reimageplus.com\"\n \"cdnrep.reimage.com\"\n \"8.8.8.8.in-addr.arpa\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"161.47.7.14:80\"\n \"205.185.208.80:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\sources\\NSISplugins\\WmiInspector\\Release\\WmiInspector.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$27","origin":"File/Memory","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"ReimageRepair.exe\" created file \"%TEMP%\\nsj4B68.tmp\\LogEx.dll\"\n \"ReimageRepair.exe\" created file \"%TEMP%\\nsj4B68.tmp\\System.dll\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$28","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$29","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"ReimageRepair.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 71B00000","origin":"Loaded Module","mitre_attack_id":"T1179","id":"module-2","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2a","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c \"\"%TEMP%\\FF.bat\" > %TEMP%\\FF.txt\"\" on 2019-3-30.20:45:26.499\n \"/c \"\"%TEMP%\\FF.bat\" > %TEMP%\\FF.txt\"\" on 2019-3-30.20:48:59.608\n \"/c \"\"%TEMP%\\FF.bat\" > %TEMP%\\FF.txt\"\" on 2019-3-30.20:53:17.671\n \"cmd /C tasklist /FI \"IMAGENAME eq Reimage.exe\" > %TEMP%\\IsProcessActive.txt\" on 2019-3-30.20:56:16.718\n \"cmd /C tasklist /FI \"IMAGENAME eq AVupdate.exe\" > %TEMP%\\IsProcessActive.txt\" on 2019-3-30.20:57:43.561\n \"/c \"\"%TEMP%\\FF.bat\" > %TEMP%\\FF.txt\"\" on 2019-3-30.21:02:22.608","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$2b","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$2c","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$2d","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"ReimageRepair.exe\" connecting to \"\\ThemeApiPort\"\n \"regsvr32.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$2e","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2f","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$30","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"qj('\"\n \"mko:sz\"\n \"vkzk}\\{~i4w]\"\n \"vkzk}\\{~i4w]\"\n \"2)'*'\"\n \"mko:sz\"\n \"vkzk}\\{~i4w]\"\n \"2)'*'\"\n \"mko:sz\"\n \"$-wHT$^fy\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"ReimageRepair.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")\n \"PING.EXE\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")\n \"nslookup.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"ReimageRepair.exe\" opened \"\\Device\\KsecDD\"\n \"tasklist.exe\" opened \"\\Device\\KsecDD\"\n \"regsvr32.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"ec67e8947166fd22f79c54588b11697513e9e0d79f42cf9f52b8e51ff8577f41.bin\" was detected as \"Nullsoft PiMP Stub -> SFX\"\n \"LogEx.dll\" was detected as \"Armadillo v1.xx - v2.xx\"\n \"ReimageRepair_1_.exe\" was detected as \"Nullsoft PiMP Stub -> SFX\"\n \"inetc.dll\" was detected as \"Microsoft visual C++ 6.0 DLL\"\n \"md5dll.dll\" was detected as \"ACProtect v1.3x - v1.4x DLL -> Risco Software Inc.\"\n \"WmiInspector.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"xml.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1 with unusual entropies 7.50862627373","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"md5dll.dll\" has a section named \"UPX0\"\n \"md5dll.dll\" has a section named \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00106281-00002912-8696-351-00468290\n cpuid at 00109681-00004348-21036-351-00468290\n cpuid at 27180-656-00468290","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Win32_ComputerSystem\" (Indicator: \"win32_computersystem\"; File: \"WmiInspector.dll.3585716165\")\n \"Win32_Processor\" (Indicator: \"win32_process\"; File: \"WmiInspector.dll.3585716165\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"ReimageRepair.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"nslookup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"regsvr32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"ReimageRepair.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"tasklist.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"ReimageRepair.exe\" read file \"%APPDATA%\\Mozilla\\Firefox\\profiles.ini\"\n \"ReimageRepair.exe\" read file \"C:\\Users\\desktop.ini\"\n \"ReimageRepair.exe\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"ReimageRepair.exe\" read file \"%WINDIR%\\Reimage.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"$31","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"8.8.8.8.in-addr.arpa\"\n \"3.7.14.1\"\n Heuristic match: \"Pinging www.google.com [216.58.192.196] with 32 bytes of data:\"\n Heuristic match: \"Reply from 216.58.192.196: bytes=32 time=47ms TTL=52\"\n Heuristic match: \"Reply from 216.58.192.196: bytes=32 time=48ms TTL=52\"\n Heuristic match: \"Reply from 216.58.192.196: bytes=32 time=47ms TTL=52\n\nPing statistics for 216.58.192.196:\n Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),\nApproximate round trip times in milli-seconds:\n Minimum = 47ms, Maximum = 48ms, Average = 47ms\"\n Heuristic match: \"Pinging www.google.com [216.58.192.196]\"\n Heuristic match: \"Reply from 216.58.192.196:\"\n Heuristic match: \"Ping statistics for 216.58.192.196:\n Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),\"\n Heuristic match: \"Server: google-public-dns-a.google.com\nAddress: 8.8.8.8\n\nName: vip0x050.ssl.hwcdn.net\nAddress: 205.185.208.80\nAliases: cdnrep.reimage.com\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 161.47.7.14 on port 80 is sent without HTTP header\n TCP traffic to 205.185.208.80 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): NSIS_Inetc (Mozilla)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\")\n \"%WINDIR%\\system32\\wbem\\wmiprvse.exe\" (Indicator: \"wmiprvse.exe\")\n \"Win32_UserAccount\" (Indicator: \"win32_useraccount\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"ns50E8.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"sqlite3.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"ns2030.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"ns33F.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"nsE97A.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"ns1D5.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"ns9D36.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00105965-00002096-61738-92-004050F9\n OpenClipboard@USER32.DLL at 00105965-00002096-64281-92-004050F9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetAsyncKeyState@USER32.DLL at 00105965-00002096-61738-87-004044D1\n GetAsyncKeyState@USER32.DLL at 00105965-00002096-64281-87-004044D1\n GetAsyncKeyState@USER32.DLL at 00105965-00002096-3672-87-004044D1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$32","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$33","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetSecurityDescriptorDacl@ADVAPI32.DLL at 00106184-00002612-5799-7-0F2B12E7\n SetSecurityDescriptorDacl@ADVAPI32.DLL at 00109580-00004044-18223-7-0F4F12E7\n SetSecurityDescriptorDacl@ADVAPI32.DLL at 00113299-00003472-16580-7-0FD212E7\n SetSecurityDescriptorDacl@ADVAPI32.DLL at 00117072-00002212-19130-7-0F2312E7\n SetSecurityDescriptorDacl@ADVAPI32.DLL at 00117500-00005088-20979-7-0F6712E7\n SetSecurityDescriptorDacl@ADVAPI32.DLL at 00120017-00005304-20896-7-0F7C12E7","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"ReimageRepair.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"ReimageRepair.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"ReimageRepair.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"ReimageRepair.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"ReimageRepair.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"ReimageRepair.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"LogEx.dll\" claimed CRC 0 while the actual is CRC 787385\n \"ReimageRepair_1_.exe\" claimed CRC 611043 while the actual is CRC 69534\n \"sqlite3.exe\" claimed CRC 491563 while the actual is CRC 16010\n \"WmiInspector.dll\" claimed CRC 122260 while the actual is CRC 22041","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"md5dll.dll\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$34","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$35","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"ReimageRepair.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"12/69 Antivirus vendors marked sample as malicious (17% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"8/35 Antivirus vendors marked sample as malicious (22% detection rate)\n 12/69 Antivirus vendors marked sample as malicious (17% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"5/94 Antivirus vendors marked dropped file \"ReimageRepair_1_.exe\" as malicious (classified as \"AdwareSig [Adw]\" with 5% detection rate)\n 5/94 Antivirus vendors marked dropped file \"ReimageRepair.exe\" as malicious (classified as \"AdwareSig [Adw]\" with 5% detection rate)\n 1/88 Antivirus vendors marked dropped file \"inetc.dll\" as malicious (classified as \"Suspicious\" with 1% detection rate)\n 1/89 Antivirus vendors marked dropped file \"md5dll.dll\" as malicious (classified as \"Suspicious\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"5/94 Antivirus vendors marked spawned process \"ReimageRepair.exe\" (PID: 2708) as malicious (classified as \"AdwareSig [Adw]\" with 5% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"ReimageRepair.exe\" allocated memory in \"%APPDATA%\\Microsoft\\Windows\\Cookies\\04C1GH32.txt\"\n \"ReimageRepair.exe\" allocated memory in \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\nsj4B68.tmp\\md5dll.dll\"\n \"ns50E8.tmp\" allocated memory in \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"cmd.exe\" allocated memory in \"\\Device\\MountPointManager\"\n \"ns2030.tmp\" allocated memory in \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"ns33F.tmp\" allocated memory in \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"ns9D36.tmp\" allocated memory in \"%WINDIR%\\AppPatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$36","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$37","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$38","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00105965-00002096-61738-1-004038AF\n ExitWindowsEx@USER32.DLL at 00105965-00002096-64281-1-004038AF\n ExitWindowsEx@USER32.DLL at 00105965-00002096-1302-1-004038AF\n ExitWindowsEx@USER32.DLL at 00105965-00002096-3672-1-004038AF\n ExitWindowsEx@USER32.DLL at 00119832-00002708-25909-1-004039E3","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$39","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"Spyware","details_count":3,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]}]},"activity":{"stats":{"process_count":24,"spawned_processes_count":24,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":115,"dropped_files_count":0,"extracted_files_count":35,"files_written_count":835,"files_deleted_count":0,"registry_keys_created_count":35,"registry_keys_modified_count":0,"registry_keys_deleted_count":52,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":87,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":3,"contacted_urls_count":5,"http_requests_count":5},"behavior_tags":["bladabindi","chir","madang","mkar","neshta","njrat","parite","rat","reimagerepair","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5c9fc90f0288380a63c716c0","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"PUA.Agent","contacted_countries":["USA"],"submit_name":"ReimageRepair.exe","analysis_start_time":"2019-03-30T19:43:28+00:00","indicators_count":{"informative":29,"suspicious":36,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"557ec8c88690b88561fbbf17","environment_id":1,"state":"ERROR","error_type":"Failed to save report to webservice","verdict":"undetected","submit_name":"ReimageRepair.exe","analysis_start_time":"2015-06-15T12:44:56+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"556cde9e8690b8494fce51db","environment_id":2,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":82,"malware_family":"W32.HfsAdware","contacted_countries":["USA"],"submit_name":"ReimageRepair.exe","analysis_start_time":"2015-06-02T00:37:25+00:00","indicators_count":{"informative":11,"suspicious":17,"malicious":10},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"161.47.7.14","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"address":"205.185.208.80","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]}],"dns_resolutions":[{"domain":"8.8.8.8.in-addr.arpa","ttl":13916,"country":"-","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"domain":"cdnrep.reimage.com","address":"205.185.208.80","ttl":214,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"domain":"www.reimageplus.com","address":"161.47.7.14","ttl":130,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]}],"http_requests":[{"host":"www.reimageplus.com","host_ip":"161.47.7.14:80","url":"/includes/install_start.php?trackid=&tracking=&campaign=&minorsessionid=ba25f4a13ae54621a286c4561b&sessionid=868e1a12-a836-4c16-a31c-e36bac40d85d&t=CONSUMER&a=ENABLED&u=ENABLED&s=ENABLED","method":"GET","header":"GET /includes/install_start.php?trackid=&tracking=&campaign=&minorsessionid=ba25f4a13ae54621a286c4561b&sessionid=868e1a12-a836-4c16-a31c-e36bac40d85d&t=CONSUMER&a=ENABLED&u=ENABLED&s=ENABLED HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: www.reimageplus.com\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"host":"www.reimageplus.com","host_ip":"161.47.7.14:80","url":"/events4mem.php?version=GUI1511&SessionID=868e1a12-a836-4c16-a31c-e36bac40d85d&MinorSessionID=ba25f4a13ae54621a286c4561b&id=MDINF¶m=OS=7<*>AV=<*>Firewall=<*>GooglePing=47<*>nslookup=vip0x050.ssl.hwcdn.net<*>File=Exitst<*>path=C:\\ReimageRepair.exe<*>md5=d729e0726f77304b299085afba059b5f<*>size=768512&trackutil=","method":"GET","header":"GET /events4mem.php?version=GUI1511&SessionID=868e1a12-a836-4c16-a31c-e36bac40d85d&MinorSessionID=ba25f4a13ae54621a286c4561b&id=MDINF¶m=OS=7<*>AV=<*>Firewall=<*>GooglePing=47<*>nslookup=vip0x050.ssl.hwcdn.net<*>File=Exitst<*>path=C:\\ReimageRepair.exe<*>md5=d729e0726f77304b299085afba059b5f<*>size=768512&trackutil= HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: www.reimageplus.com\nConnection: Keep-Alive\nCache-Control: no-cache\nCookie: X-Mapping-fjhppofk=706EA6CC82CA8F8D58B711711E2AC50D; PHPSESSID=ffme3qr3qht33k4r15ki0fk6h6; _trackid=6156757326; _trackid_6156757326=6156757326; _tracking=revenuewire; _tracking_revenuewire=revenuewire; _campaign=direct; _campaign_direct=direct; _adgroup=direct; _adgroup_direct=direct; _keyword=direct; _keyword_direct=direct; _ads=direct; _ads_direct=direct; _browser=IE; _browser_IE=IE; _country=United+States; _country_United%20States=United%20States","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"host":"www.reimageplus.com","host_ip":"161.47.7.14:80","url":"/events4mem.php?version=GUI1511&SessionID=868e1a12-a836-4c16-a31c-e36bac40d85d&MinorSessionID=ba25f4a13ae54621a286c4561b&id=MDPRC¶m=taskhost*dwm*OSPPSVC*ReimageRepair*&trackutil=","method":"GET","header":"GET /events4mem.php?version=GUI1511&SessionID=868e1a12-a836-4c16-a31c-e36bac40d85d&MinorSessionID=ba25f4a13ae54621a286c4561b&id=MDPRC¶m=taskhost*dwm*OSPPSVC*ReimageRepair*&trackutil= HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: www.reimageplus.com\nConnection: Keep-Alive\nCache-Control: no-cache\nCookie: X-Mapping-fjhppofk=706EA6CC82CA8F8D58B711711E2AC50D; PHPSESSID=ffme3qr3qht33k4r15ki0fk6h6; _trackid=6156757326; _trackid_6156757326=6156757326; _tracking=revenuewire; _tracking_revenuewire=revenuewire; _campaign=direct; _campaign_direct=direct; _adgroup=direct; _adgroup_direct=direct; _keyword=direct; _keyword_direct=direct; _ads=direct; _ads_direct=direct; _browser=IE; _browser_IE=IE; _country=United+States; _country_United%20States=United%20States","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"host":"cdnrep.reimage.com","host_ip":"205.185.208.80:80","url":"/downloader_version.xml","method":"GET","header":"GET /downloader_version.xml HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: cdnrep.reimage.com\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"host":"cdnrep.reimage.com","host_ip":"205.185.208.80:80","url":"/rqj/ns/ReimageRepair.exe","method":"GET","header":"GET /rqj/ns/ReimageRepair.exe HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: cdnrep.reimage.com\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}],"processes":[{"pid":2096,"ppid":0,"name":"ReimageRepair.exe","command_line":"","sha256":"ec67e8947166fd22f79c54588b11697513e9e0d79f42cf9f52b8e51ff8577f41","normalized_path":"C:\\ReimageRepair.exe","uid":"00105965-00002096","icon":"$3a"},{"pid":2612,"ppid":2096,"name":"ns50E8.tmp","command_line":"\"%TEMP%\\FF.bat\" > %TEMP%\\FF.txt","sha256":"8f0f0e254113725b386ff4c6c2967d556ed4d568245fc8af6f2dbea697ba56bf","normalized_path":"%TEMP%\\nsj4B68.tmp\\ns50E8.tmp","parent_uid":"00105965-00002096","uid":"00106184-00002612"},{"pid":4184,"ppid":2612,"name":"cmd.exe","command_line":"/c \"\"%TEMP%\\FF.bat\" > %TEMP%\\FF.txt\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00106184-00002612","uid":"00106277-00004184"},{"pid":2912,"ppid":4184,"name":"sqlite3.exe","command_line":"\"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\cookies.sqlite\" \"select value, expiry from moz_cookies where baseDomain like 'reimageplus.com' and name='_trackid';\"","sha256":"ca4c0f1ec0ccbc9988ea3f43ff73fe84228ffb4d76baddc386051dffe7ddd8c2","normalized_path":"%TEMP%\\sqlite3.exe","parent_uid":"00106277-00004184","uid":"00106281-00002912"},{"pid":4044,"ppid":2096,"name":"ns2030.tmp","command_line":"\"%TEMP%\\FF.bat\" > %TEMP%\\FF.txt","sha256":"8f0f0e254113725b386ff4c6c2967d556ed4d568245fc8af6f2dbea697ba56bf","normalized_path":"%TEMP%\\nsj4B68.tmp\\ns2030.tmp","parent_uid":"00105965-00002096","uid":"00109580-00004044"},{"pid":660,"ppid":4044,"name":"cmd.exe","command_line":"/c \"\"%TEMP%\\FF.bat\" > %TEMP%\\FF.txt\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00109580-00004044","uid":"00109677-00000660"},{"pid":4348,"ppid":660,"name":"sqlite3.exe","command_line":"\"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\cookies.sqlite\" \"select value, expiry from moz_cookies where baseDomain like 'reimageplus.com' and name='_tracking';\"","sha256":"ca4c0f1ec0ccbc9988ea3f43ff73fe84228ffb4d76baddc386051dffe7ddd8c2","normalized_path":"%TEMP%\\sqlite3.exe","parent_uid":"00109677-00000660","uid":"00109681-00004348"},{"pid":3472,"ppid":2096,"name":"ns33F.tmp","command_line":"\"%TEMP%\\FF.bat\" > %TEMP%\\FF.txt","sha256":"8f0f0e254113725b386ff4c6c2967d556ed4d568245fc8af6f2dbea697ba56bf","normalized_path":"%TEMP%\\nsj4B68.tmp\\ns33F.tmp","parent_uid":"00105965-00002096","uid":"00113299-00003472"},{"pid":2928,"ppid":3472,"name":"cmd.exe","command_line":"/c \"\"%TEMP%\\FF.bat\" > %TEMP%\\FF.txt\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00113299-00003472","uid":"00113394-00002928"},{"pid":1936,"ppid":2928,"name":"sqlite3.exe","command_line":"\"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\cookies.sqlite\" \"select value, expiry from moz_cookies where baseDomain like 'reimageplus.com' and name='_campaign';\"","sha256":"ca4c0f1ec0ccbc9988ea3f43ff73fe84228ffb4d76baddc386051dffe7ddd8c2","normalized_path":"%TEMP%\\sqlite3.exe","parent_uid":"00113394-00002928","uid":"00113398-00001936"},{"pid":2212,"ppid":2096,"name":"nsE97A.tmp","command_line":"cmd /C tasklist /FI \"IMAGENAME eq Reimage.exe\" > %TEMP%\\IsProcessActive.txt","sha256":"8f0f0e254113725b386ff4c6c2967d556ed4d568245fc8af6f2dbea697ba56bf","normalized_path":"%TEMP%\\nsj4B68.tmp\\nsE97A.tmp","parent_uid":"00105965-00002096","uid":"00117072-00002212"},{"pid":5036,"ppid":2212,"name":"cmd.exe","command_line":"cmd /C tasklist /FI \"IMAGENAME eq Reimage.exe\" > %TEMP%\\IsProcessActive.txt","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00117072-00002212","uid":"00117171-00005036"},{"pid":5032,"ppid":5036,"name":"tasklist.exe","command_line":"tasklist /FI \"IMAGENAME eq Reimage.exe\"","sha256":"ad3e811249da750d80f2762c3aeb403780c1b69d05911e3c9950a7daed9e6670","normalized_path":"%WINDIR%\\System32\\tasklist.exe","parent_uid":"00117171-00005036","uid":"00117175-00005032"},{"pid":5088,"ppid":2096,"name":"ns1D5.tmp","command_line":"cmd /C tasklist /FI \"IMAGENAME eq AVupdate.exe\" > %TEMP%\\IsProcessActive.txt","sha256":"8f0f0e254113725b386ff4c6c2967d556ed4d568245fc8af6f2dbea697ba56bf","normalized_path":"%TEMP%\\nsj4B68.tmp\\ns1D5.tmp","parent_uid":"00105965-00002096","uid":"00117500-00005088"},{"pid":5236,"ppid":5088,"name":"cmd.exe","command_line":"cmd /C tasklist /FI \"IMAGENAME eq AVupdate.exe\" > %TEMP%\\IsProcessActive.txt","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00117500-00005088","uid":"00117610-00005236"},{"pid":5332,"ppid":5236,"name":"tasklist.exe","command_line":"tasklist /FI \"IMAGENAME eq AVupdate.exe\"","sha256":"ad3e811249da750d80f2762c3aeb403780c1b69d05911e3c9950a7daed9e6670","normalized_path":"%WINDIR%\\System32\\tasklist.exe","parent_uid":"00117610-00005236","uid":"00117613-00005332"},{"pid":5480,"ppid":2096,"name":"PING.EXE","command_line":"-n 4 www.google.com","sha256":"4ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d","normalized_path":"%WINDIR%\\System32\\PING.EXE","parent_uid":"00105965-00002096","uid":"00118007-00005480"},{"pid":5156,"ppid":2096,"name":"nslookup.exe","command_line":"cdnrep.reimage.com","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00105965-00002096","uid":"00118253-00005156"},{"pid":4980,"ppid":2096,"name":"tasklist.exe","command_line":"","sha256":"ad3e811249da750d80f2762c3aeb403780c1b69d05911e3c9950a7daed9e6670","normalized_path":"%WINDIR%\\System32\\tasklist.exe","parent_uid":"00105965-00002096","uid":"00118279-00004980"},{"pid":5960,"ppid":2096,"name":"regsvr32.exe","command_line":"regsvr32 /s \"%WINDIR%\\system32\\jscript.dll\"","sha256":"890c1734ed1ef6b2422a9b21d6205cf91e014add8a7f41aa5a294fcf60631a7b","normalized_path":"%WINDIR%\\System32\\regsvr32.exe","parent_uid":"00105965-00002096","uid":"00119752-00005960"},{"pid":2708,"ppid":2096,"name":"ReimageRepair.exe","command_line":"/update=1 /Language=1033 /tracking=0 /campaign=0 /adgroup=0 /Ads_Name=0 /Keyword=0 /ResumeInstall=2 /RunSilent=false /pxkp=Delete","sha256":"a9351e522ac3d86324dfb455617bfa01da737d1b93fe0f16ba5e614e0e904c56","normalized_path":"%TEMP%\\ReimageRepair.exe","parent_uid":"00105965-00002096","uid":"00119832-00002708"},{"pid":5304,"ppid":2708,"name":"ns9D36.tmp","command_line":"\"%TEMP%\\FF.bat\" > %TEMP%\\FF.txt","sha256":"8f0f0e254113725b386ff4c6c2967d556ed4d568245fc8af6f2dbea697ba56bf","normalized_path":"%TEMP%\\nsj9A17.tmp\\ns9D36.tmp","parent_uid":"00119832-00002708","uid":"00120017-00005304"},{"pid":6132,"ppid":5304,"name":"cmd.exe","command_line":"/c \"\"%TEMP%\\FF.bat\" > %TEMP%\\FF.txt\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00120017-00005304","uid":"00120111-00006132"},{"pid":2248,"ppid":6132,"name":"sqlite3.exe","command_line":"\"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\cookies.sqlite\" \"select value, expiry from moz_cookies where baseDomain like 'reimageplus.com' and name='_trackid';\"","sha256":"ca4c0f1ec0ccbc9988ea3f43ff73fe84228ffb4d76baddc386051dffe7ddd8c2","normalized_path":"%TEMP%\\sqlite3.exe","parent_uid":"00120111-00006132","uid":"00120117-00002248"}],"all_imported_dlls":["shfolder.dll","rpcss.dll","urlmon.dll","rasadhlp.dll","xml.dll","wtsapi32.dll","dnsapi.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","mswsock.dll","comdlg32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","rsaenh.dll","LogEx.dll","ntdsapi.dll","cscapi.dll","usp10.dll","comctl32.dll","cryptsp.dll","msctf.dll","cfgmgr32.dll","imm32.dll","nsExec.dll","IPHLPAPI.DLL","normaliz.dll","ExecDos.dll","nsDialogs.dll","version.dll","FWPUCLNT.DLL","msvcrt.dll","wkscli.dll","jscript.dll","wbemprox.dll","apphelp.dll","framedynos.dll","sfc.dll","setupapi.dll","api-ms-win-downlevel-user32-l1-1-0.dll","uxtheme.dll","WSHTCPIP.DLL","user32.dll","ntmarta.dll","samcli.dll","ole32.dll","dhcpcsvc6.dll","wship6.dll","npmproxy.dll","linkinfo.dll","slc.dll","sechost.dll","shlwapi.dll","dhcpcsvc.dll","dwmapi.dll","fastprox.dll","winhttp.dll","KernelBase.dll","shell32.dll","advapi32.dll","wsock32.dll","wmiutils.dll","rpcrt4.dll","RpcRtRemote.dll","cryptbase.dll","wbemsvc.dll","api-ms-win-downlevel-version-l1-1-0.dll","iertutil.dll","netutils.dll","winmm.dll","WmiInspector.dll","winnsi.dll","bcrypt.dll","bcryptprimitives.dll","wininet.dll","netprofm.dll","gdi32.dll","winsta.dll","winrnr.dll","ws2_32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","wshqos.dll","NapiNSP.dll","sfc_os.dll","dbghelp.dll","oleaut32.dll","profapi.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","nlaapi.dll","AcGenral.dll","ntdll.dll","sspicli.dll","inetc.dll","clbcatq.dll","Wldap32.dll","webio.dll","pnrpnsp.dll","msacm32.dll","ntshrui.dll","netapi32.dll","Banner.dll","nsi.dll","riched20.dll","devobj.dll","System.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","userenv.dll","wbemcomn.dll","winbrand.dll","secur32.dll","propsys.dll","srvcli.dll","msvcr100.dll","stack.dll","kernel32.dll","lpk.dll","mpr.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ReimageRepair.exe","sha256":"a9351e522ac3d86324dfb455617bfa01da737d1b93fe0f16ba5e614e0e904c56","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"inetc.dll","sha256":"9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"md5dll.dll","sha256":"32c3d36f38e7e8a8bafd4a53663203ef24a10431bda16af9e353c7d5d108610f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"ReimageRepair_1_.exe","sha256":"a9351e522ac3d86324dfb455617bfa01da737d1b93fe0f16ba5e614e0e904c56","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"ExecDos.dll","sha256":"720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"WmiInspector.dll","sha256":"fe268b2259429b6d5efdae9a5dfe621214b2e2c22f03087b2f5f7132596f9f8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"Banner.dll","sha256":"501b5935fe8e17516b324e3c1da89773e689359c12263e9782f95836dbab8b63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"LogEx.dll","sha256":"57ede354532937e38c4ae9da3710ee295705ea9770c402dfb3a5c56a32fd4314","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"System.dll","sha256":"7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"UserInfo.dll","sha256":"6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"nsExec.dll","sha256":"d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"sqlite3.exe","sha256":"ca4c0f1ec0ccbc9988ea3f43ff73fe84228ffb4d76baddc386051dffe7ddd8c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"nsDialogs.dll","sha256":"416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"stack.dll","sha256":"732164fb36f46dd23dafb6d7621531e70f1f81e2967b3053727ec7b5492d0ae9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"xml.dll","sha256":"d1aaacc0aaf477b6b9f084697adcb444fc2333b32e8d99d224dca89516e762a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"FF.bat","sha256":"65a5626c852856d8445148d7595e686ec38c5847430178c9f9050c25f06e8b4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"IsProcessActive.txt","sha256":"943b315e065238b7073b033f534ef954b6b6461fb3f03a3f5b8555b11bc4c0a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"0KY2LLI7.txt","sha256":"fa5a42b089b83780fa9df2c78ff47d64d5cad2e94d15d17aab9396c79acdc708","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"2MY834IZ.txt","sha256":"e9da21a4fd1399d8de83a6569507d5a5ca97961423a13c7bb06b7c5c0552ac12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"4ASB3OJ7.txt","sha256":"9bba2c2262db145eae1ff39008b293aeeaa820099a43556645956fe6e98a7e36","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"B5S35C7Y.txt","sha256":"ae71ccbb5f43ddcb554334f118040ec303401f74920c54f84a9bc74bcdcb047f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"CUR07Q2U.txt","sha256":"1c6df9d646dc17c1278dd4f7a1b42c9ae5eca5c10061604da049c47408cc6642","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"FE2XJA8Z.txt","sha256":"af49f04104aa08b593878b8ce7427e12754a68207895ed8778130a92f4027c52","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"H5H4ZB0T.txt","sha256":"e8eee2c22a18494664c059599f465a8e5d66cbe5ead1a8e4647d24ea63aaeea1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"RJRL537S.txt","sha256":"74dacf5b08fba29f7c153d95a9fb8d4977d328db3f22546f9b1bbfc610fa2ed5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"S0DG49TI.txt","sha256":"8046b1e7f37e5e762b786c325266442cf4c27593bf2b95bd16317d6e84aa7a49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"SRE8JDYH.txt","sha256":"6aef40147df99efa1ecc9c3bcaeff084d523994b29b82c2df827814c100a921b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"VT48UV7F.txt","sha256":"a93abe19f7e3db8f2c2d6cb7e27e2c203fde3e1e071148d9a461cb3920ebd0a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"W7FND462.txt","sha256":"1fc7d558141424db35d8345e6cc186726ed71d95c2e92f6fcbc4285e5647ad50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"X0ZT8MAS.txt","sha256":"4d55cec8e65cf8d26872818c23817246f09d7945894b6811588669af8959b554","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"X92NECP0.txt","sha256":"6b7bf0b6baa16b00d1d8581064a2c856a687cac121167b787b7a77ae00c31977","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"Z4IJICBD.txt","sha256":"b73528aad85823041b77b2e4d8df59cb97b2d676a2848334e53f7107965e3dd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"ZAP2U1ZO.txt","sha256":"228c2f77f1239cfd15bf518eb6659a2684756af8606d347082566235d8576bdb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"InstallationPixel.txt","sha256":"254dd361be5f5bc184bc0a22896824163e12a36db1576915a6b2c7ca161ecb3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"Resume Reimage Repair Installation.lnk","sha256":"f0efc3c6da4341e00db0384ecde813fb6f3d6f80d346755f7703c1e9a2972365","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]}],"files_written":[{"path":"C:\\ReimageRepair.exe","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%TEMP%\\nsj4B68.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%TEMP%\\nsj4B68.tmp\\LogEx.dll","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\M4WV59EK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\M52QF5C9.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\MH9I1XL2.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\MJ10J49P.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\MKL36YWS.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\MLMDTSVO.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\MMJ8ZSWF.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\MOVPEM6I.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\MSYA8AE9.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\LW3NQK8P.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\LW56E0QX.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\O6K6PLMM.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\LWTCTS7Z.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\LYWOTXDE.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ORP5GCAY.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\M01Q6LLD.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\M03O4QH0.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\M18HUH6H.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\M1G0BCWJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\M4JFV55X.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\P0AOUH26.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\M68E68LO.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\M7GN79UH.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\M8Y0I0FU.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\MA0Z9XER.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\MBFZM0QZ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\MDQTYSJ1.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\PINJMUQD.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\MTL2UJF7.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\MU2VFQ77.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\PKXUWU21.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\MUOB6MI8.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\MVI0BUXA.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\MX11C1IJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\MY4Y43HR.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\MYAI8V7A.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\MYDUOBHO.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\N2U6DGMC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\N3IUR4XY.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\N40A6DU5.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\PYER2P4T.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\N5M0OHAT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Q131X7O7.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\N8UE3V4F.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\N9FEGLMJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\NAL6OODV.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Q28E8U6M.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\NEQF7WWG.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\NES27REN.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\NF87Q0LY.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\NHPZ332I.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\NNJ9MMQH.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\NNT3FDHT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\NQ3Y0TUI.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\NQUASX4O.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\NRPSPEKY.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\NTQ01M15.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\NW2AXEWT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\O0UL4XQ0.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\O0YJCVGT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\O3OP5L5T.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\O8RSPUFP.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ODIBK18F.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\OED99Y0T.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\OJU2035K.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\OPAYQ1ZG.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\OQY8LS8I.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\OR3JHZXT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\QJ97IDE4.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\OVHFHYDC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\OZD7BASV.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\P097YVCB.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\P1GJI666.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\P23TOUTS.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\P2FWC30N.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\P9D42UGW.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\PDSE03KC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\PDVKLJX7.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\PHD6XSRS.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\PHMEXVYQ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\PJ7625QG.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\R6GHEDVE.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\POEMXS4Z.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\PP7TD6TL.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\PQHWPJ5D.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\PTZ1LR7Y.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RC9ABRAT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\PWT4AKNK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RD52GZ12.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\PXIJHW39.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\PY9HSWFT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\PYEAH6IM.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\PYHTQU01.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RKWOKIGV.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RN1WXXA1.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Q27AZWQ5.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Q2IZENR8.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Q3JP60NG.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Q4FYVX8F.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Q4Z9Y3MG.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Q5D5EE51.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Q765PXJP.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Q8C6Z1I5.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\QC74LP1Q.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\QE6SCH22.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\QEAE9RRP.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\QG23O46V.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\QGVG79K3.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\QJ920GCU.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\QKBFCM95.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\QMKW1DZS.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\QPA4O1MC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\QUABOCS7.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\QUZOXG47.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\QVXA74WM.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\R18DD8RJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\R20DHMSH.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SZ6E3UFC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\R20NRKJF.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\R21160E8.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\R2J3W505.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\R3XRG71U.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\R8Y3O0WI.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\R9TNJI3Z.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RBS6C4JB.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RBZAV52C.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RF3MO83J.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RFZL12IC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RKNEQEGT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RNNPPAQM.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RPFZW1QA.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TK1CXJFU.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RQ2314YB.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RRY2UU1J.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RT2DMBBL.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RTI8H929.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RUYXBTVM.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RWMC384S.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\RZHJCKRG.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\S31J4UEJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\S72MUU39.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\S9WNZLXD.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SA8SG1GY.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SADH3ZKD.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SBQU4KSG.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SCQFJPVH.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SFYJ7WZS.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SFZJR217.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SGOKMG50.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SHWY0F78.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SMKP0CHX.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SNSGL6C4.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SO8VBCTY.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SQRUJR4I.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SRAYK61D.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\STAXPDTD.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\STPPQQL6.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\STRE6335.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SUCE9DFT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SURXAJU1.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UY3KEL7M.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SWOC3U2C.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SXPY5VRE.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SY1ZHZ4O.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SYOWX991.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SZ9ZXSX8.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\T2WZ7CPV.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\T3326YKP.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\T6TP7BJD.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\V7JC7KYP.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\T7QD8T7X.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TA3ULE9K.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TARS2ASX.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TBP2HH18.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TC5J7C22.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TCCK2GZW.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TGLZOB2I.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TJ830E0K.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\VVGYB4TC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\VVNCVQUB.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TJZIYP3H.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\W1PZJ11R.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\W3F37XYG.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TK1OX1F3.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TMUN27NK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TN837HJA.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TOSUHSPT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TR303ORS.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TVSHZ68V.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TWT0E83W.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TZ1RT2M5.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\U0LUYXQP.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\U4MCWFKO.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\U581PND6.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\U8K96OZ5.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UAOYDGXG.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UC03NY2X.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UDVSWEZ0.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UE318OQT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\WX4K1CIF.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UEVVU232.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UFK2NTGP.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\X0787ZIQ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UFVG60G2.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UGJBXHD8.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UKID4BVZ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UNQAFUNH.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UNS002ER.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UOUM2LL0.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UQL2QHOM.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UQOBSEK1.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UQZ5SDKU.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\URWWZSI2.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UTB90UM1.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UXD8UU2Z.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UYLTR4OO.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UZ8S43SB.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\V0SU1VEH.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\V17QTD7A.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\V27OU2VF.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\V2WLP1Y7.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\V61HIQL5.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\XZO6QKEU.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Y0BKUAS2.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\V91RWN6L.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\VAW7MV86.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Y0HO67HN.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\VFS58JH1.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Y0TMQN68.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Y6A66GJK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Y9ACOSVF.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YCFOSGDT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YJ28AXUT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\VG8BU31O.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\VGO1ICYI.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\VGW7SHHX.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\VIG24O8F.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\VQT656YD.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\VS80HBG1.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\VYWEV1X0.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\W0O02PTC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\W0O9DJSL.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\W1JHKY69.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\W3GNZNIF.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\W3UFQ43L.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\W56J4HEV.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\W6192RE2.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\W7L1L0T8.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\WINX7TMB.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\WJQHKB3M.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YY0ORI7J.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\WOPDNSYZ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\WPDS8QIC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\WRW0OY9Q.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\WT1EEJVU.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\WTUVPV0H.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\WUK9CBQ0.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\WVJP4FCA.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\WWPO5Q9Z.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZDSD3AC1.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZDUVJ7SJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZGUF7OP6.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZH0K2F0U.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\X0NE58AH.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\X25X1YWW.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\X2L53FGD.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\X34HY9N3.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\X3V4WOK5.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\X43EXFN4.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\X46QHW5O.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\X8FGLAIV.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\X8VW6IE7.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\X9K1U7OS.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\XD183BLN.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\XD1PRFQ1.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\XEN1V148.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\XJA8FC58.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\XJF0V77J.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\XP5QPRIE.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\XV17Z9GM.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\XVEIWLSI.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\XYA0X9N9.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\XZ1B4FAY.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YRHQSPCB.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YSUSG75A.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YTFSGZNR.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YTQ5NYJL.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YWY474LQ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YX4VX51O.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YXG69G7O.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YZNGQHEC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Z0UZO146.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Z31D82MK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Z5KXTS08.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Z5L0RPYV.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Z6I2ALQ1.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Z7FLPC1M.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Z8II9K5M.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZC4XWSHK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZDGUCG6X.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZJF43MYX.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZMCLLDB1.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZMZDJ8XQ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZN1CVVJS.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZQAB1ENK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZV175VY9.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZYVGHHF7.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%TEMP%\\nsj4B68.tmp\\nsExec.dll","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%WINDIR%\\System32\\tasklist.exe","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%TEMP%\\InstallationPixel.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%TEMP%\\nsj4B68.tmp\\WmiInspector.dll","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%TEMP%\\IsProcessActive.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%TEMP%\\nsj3192.tmp","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%TEMP%\\nsj4B68.tmp\\ExecDos.dll","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%WINDIR%\\System32\\en-US\\nslookup.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%WINDIR%\\System32\\en-US\\tasklist.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\wmiutils.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%WINDIR%\\System32\\en-US\\ping.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%WINDIR%\\System32\\en-US\\regsvr32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001f.db","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%WINDIR%\\Reimage.ini","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%TEMP%\\FF.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%TEMP%\\FF.bat","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"C:\\Users\\c43bQ3N","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%TEMP%\\sqlite3.exe","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%WINDIR%\\System32\\regsvr32.exe","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.dll","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0DEAJOR6.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%TEMP%\\ReimageRepair.exe","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%TEMP%\\nso99E7.tmp","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%TEMP%\\downloader log.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%TEMP%\\nsj9A17.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%TEMP%\\nsj9A17.tmp\\LogEx.dll","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\10C02Z83.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\16215H2K.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\1LUB8WF5.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\1QLEFO60.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\1UAPZ106.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\1VWCDN42.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2R8EW0H6.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2SFOEJKI.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2SHFHYAN.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2SM7L33C.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2TWZDGAB.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2ZHB7W15.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\310B2E1Y.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\cookies.sqlite","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%USERPROFILE%\\.sqliterc","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4F7NV88N.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4HCU4XAS.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4INBF33D.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4JMVUU7K.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4KG7RANH.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4R8K4TXJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5G1XK2AB.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5GSH63GR.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5HMRUNH7.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5WG27NHJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5XO7BFYT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5YNOA1KG.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\6145P1Q8.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\61K47WWL.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\6860D43Y.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\013SKKWU.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\01RLWRK4.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\02251G37.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\04C1GH32.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\04ZFG79Q.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\05DR3CFO.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\06NUD4Y2.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\07N0EWO6.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\09BAA8W6.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0BLUACH0.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\7B1F2GY0.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\7CYHXFBH.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\7EOXJDTX.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0GCX0MOZ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0K93Q13F.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0L4X42T9.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\7KBAKSFW.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0LRUA0MV.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0MYAT1N3.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0OBTYDGS.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0PN4NSUQ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\8KSJFTIA.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\8MAU4Z9Y.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0QJ5TC37.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0S10SYKB.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0UJVY412.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0UT1Z46B.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0VKSPGO0.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0WADNNR9.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0WW5EB2S.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0XGX6FYI.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\19GTZQZZ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\19RIRH0Y.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\1D3GUNWO.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\1ESZ120A.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\1G15GMUT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\1GFNR5CP.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\1IQJPSHK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\1LMFO54P.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\9JWGQ2LE.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\1WQOCIZG.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\221WOL3A.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\230Y2DXP.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\23BHJLHS.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\23TZ4C41.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\27T0G6FE.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2ASN9ZFJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2AYSNF73.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2AZ4YJF2.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2E8G701Q.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2GICE76P.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2GM80UBQ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2IKL0V3W.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2IUXOXPF.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2KROEWGU.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2KTGZAK9.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\AVNGK9XL.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2Q1JPPOS.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2SID68SA.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\31G5X0FP.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\324HCTEV.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\32ALEBD1.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\32WAKFWK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\339OUP0A.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\36S64XSJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\385UJPQB.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\38T8GEM0.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BWPS167Y.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BWTLUPMK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3E754NAJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BX8AZBNI.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3GCO4IC6.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3IQ1JVTO.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3PXSHL20.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3R6FVOUK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3RY3ZKPE.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3S9Q96YC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3T7OSXRU.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3T9SFXV9.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3TALQNSD.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3UFSXBZN.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3URUEPPV.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3VKDSCYJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3WE9P32V.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\404HCFVH.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\405XVMKT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\40CP9X6Z.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\43WE71VL.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\43WU2GJM.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\454LE7N0.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\45RKLALH.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\CA2UOKMA.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\46IBQU6X.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4EGB3V4H.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\CHAUNNB1.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\CJ53Q6CC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4FNSL9JX.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4K672PF0.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4KEO5OP1.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4LXHKV4X.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\CJOQWP79.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4MHUIOAJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\CLOVKGT4.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\COTGT0NQ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\CT2VZ6EG.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4RCVZDED.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4S29DBEW.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4TM2AL5G.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4TOPRDV2.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4UYRHNFO.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4V9DPS1F.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4XD8W14A.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4ZF3700Z.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4ZJKUZYT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\51NZY7LR.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\51UMV1TD.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\535SA7XK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5564U8ZR.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\557KL2WF.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5709KGFY.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\DEATXCIP.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\DG4755JJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\586VP2IU.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\58UDWIQP.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\59JDWDOT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5CYF3WN0.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\DKY861BK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5E7Q4O4D.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\DL8G4R2I.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5EMNIV5X.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5ENEGGQL.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5FH705TQ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5FZO8VEX.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\DMT6IPLI.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\DNVL5VVX.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5IUU2LLS.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5KM0IP1M.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5ND6VTN0.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5O335U41.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5OP8JZOW.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5SSY9BS4.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5U79IPE4.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5UMHG6OC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5UNAAB11.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\5UXNIF1H.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\66KUI2L4.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\68GKW6CZ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\68KPW6T8.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\6CUCCV61.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\6EEINFTU.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\6EGF0VEQ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\6G9MNF0X.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\6NDG7VVY.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\6OHRY6JZ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\6PVO0Z2D.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\6TZSSPY7.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\6U8CRMHQ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\6WA644VW.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\73T92V3V.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\75EER6O6.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\76MBVR56.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\77I3XLE1.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\77KRIE44.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\77YTTLB6.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\78XR3IBM.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\7C6N2ZIC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\7HL6915E.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\7HUMXJVF.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\FW38JJY7.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\G6PP1OIH.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\G7N0DDRP.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\7LR228YE.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\7MGUHXME.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\7N4RVANK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\7SB3GQSO.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\7WEYCOC9.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\7WQY6NYF.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\7ZTHQ0TD.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\80YA6J4B.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\82HTV1I0.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\83SC4SVU.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\84U45E5J.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\8AW81I5B.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\8C4S2TAB.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\8MB6PW14.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\8ORR48RI.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\8SR0RZ8S.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\8TX65I3H.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\8W06FIXJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\8WDKE33C.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\8YA38V3D.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\8YN60N3P.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\8Z2519VC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\91WSNDQW.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\91Y5PODI.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\96WSSSUT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\98BPD9H4.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\997KD8QR.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\9B9G7L2I.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\9D4P0RO9.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\9EF1YA3V.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\9FUM217Q.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\9IO3RXXP.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\9M2Q14XJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\9RNN67IT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ICDFOK4O.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\9S1L8RR8.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\9SU46K5Y.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\9SWVP8MQ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\IEWURUWP.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\IFUGM3LE.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\9U7JOM7O.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\9VV77FEK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\IGCKB2FS.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\IJHCG2BT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\9WHA3VHC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\INCDJHCA.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\9WN7O6V0.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\9XF43GJS.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\A06WSKZF.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\A1PVK38K.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\A1U2HBI8.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\A4CBMRKK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\IONCNQZY.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\A5AQD0PY.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\IQ5P0QV3.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\A5M9XLOM.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\AEDD88EP.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\AHV4QFIV.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\AI5E1J2S.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\AJGQSKWT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\AMA7XDDV.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\IR2M64HQ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ANR24PVM.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\IR43M8J4.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ISV2CW9J.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\AONJLIHR.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\IWG6QAX4.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\APQCCL1C.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ASEOAR02.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\AUJEKFNS.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\IWHX7DU8.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\IWOKB0WE.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\AV8VCUFA.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\IXI6T9WT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\IZ4IBGAP.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\J0L7U6UH.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\AYKC4XF0.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\J1STPYTK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\AYND2QOU.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\J9SAKFQB.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\AYXLKKWH.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\AZHNRXZJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\B038QLA8.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JA5UIE6S.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\B0DVB9HC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\B0GJXIL8.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\B4KO4RYQ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JB53R38P.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JBDBH796.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\B5ZJ32W3.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JCLPBLKO.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\B77H6FFJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BA0KXJ2E.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BA3XWAZG.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BAO38TQG.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BBRYI3C3.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BCGMC3XK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BDKDXZG2.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BJG9CUKD.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BL040IC1.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BMPAYBB5.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BN2NNT78.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BU3SJ9CN.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BUPBRUNT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KBJV220Q.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KC4C4N52.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KE53L2X5.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BZAQ6YZD.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\C0O6T1SK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\C2S1T5RV.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KEPX1ISW.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\C3C840FK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KGTYZ2E9.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KIZIQJGD.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KK660GX2.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KK724HDY.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\C3CG1Q8Q.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KLBT3VD4.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KP21JIQN.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KPKJ5820.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\C6A8IDYO.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\C86Q6NCQ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KQRMV8R8.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\C9OZZOGC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\C9WTA3HM.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\L1833CZC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\L2IY7WMX.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\L5NHDZUQ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\L6W45OEV.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\CTCZEQ5A.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\L8DC4A47.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\L8V9RV16.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\L95LWQPM.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\CUNQWOR4.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\CXMCXA3K.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\LA6GEDYH.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\LBEDIY9J.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\CYOIE8B1.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\CYWWAARX.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\D0QL52XR.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\D2VM7GM4.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\LRCTX333.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\D3G70Y6C.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\D3Q9TF2C.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\LSG5ZAKX.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\D4SU0Q1Y.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\D5QUY1SJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\LTPX41VG.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\D81CETKA.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\DD7E4C1K.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\DE4O148X.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\DOUX56PV.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\DRKW117O.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\DTX67EFT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\DV7OR04E.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\DVFX56FS.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\DYBRXUFE.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\DZ8W0RNO.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\E2MA61ZG.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\E3K7V3RJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\E59EKDHL.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\E6BQ653F.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\E6SI7R5K.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\E99SM18R.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\EAH0WAJY.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\EB19HU9F.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\EBOHPPOY.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ECWMK291.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\EHQPJXMT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\EJFQQYWA.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\EOML20XX.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\EQG2JF8U.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\EQHOR8QT.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\EQIBU18E.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\EQNO0XTH.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ERV9N2EC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\EV0P3E9R.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\EVR7UQO6.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\EXFY08X6.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\EY1S0BHW.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\F0IHR1QW.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\F3E8FKJH.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\F3EATH7P.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\FA6U29G9.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\FACNTKJX.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\FAK1EWIV.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\FBE9Q5WV.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\FE7PLVTZ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\FFL0BLJZ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\FH6T9SX6.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\FLNQ3VVL.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\FN7CXJFC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\FN8E6MXK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\FR9FYY9V.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\FRTT3KR3.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\FUP75WJK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\FVG0F44Z.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\G9RCZIPL.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\GDY86RGU.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\GEDI3OQD.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\GEY1DRRQ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\GG3UVGKJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\GGGEH140.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\GL3784LY.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\GQ82X18L.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\GRNZPSDK.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\GS96H9Y7.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\GTS1VNZ8.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\GWBTHDFX.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\GYOT8W2J.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\H090URCE.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\H0GUJSAG.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\H0HMY6SF.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\H0KL86HW.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\H1DLG3UG.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\H1FQQXXX.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\H4NWGEGC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\H8XWSV0W.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\H9G0IQ8B.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HBXE6AOC.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HCV90UR2.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HG00O08L.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HKRJ0QO3.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HM9DGIBM.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HNPTURCM.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HOI17G02.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HOQ0X51V.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HQ6EI340.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HQOYZKJF.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HTXQW2SJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HTYQEA4B.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HU36IGM5.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HUER35OJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HV0FILDS.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HV357N9V.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HXSJ9CMV.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HYAYS0J2.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\I2QH9ZJ4.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\I6OV373A.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\I88H097X.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\IBSVDCQU.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JDXQX5DA.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JFMLH81C.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JG3XUQRV.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JJ0PM589.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JKR7M6W4.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JKXOAR58.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JO9N2K9B.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JP1FT924.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JQLKBQOX.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JRP3VDW8.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JS11S8H2.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JSD1L5RH.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JVA9GESD.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JX53Y0B9.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\K441MBLS.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\K478D572.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\K4GNOP07.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\K4QTM1YQ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\K7DTZRFS.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KRDZT123.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KRFXMOQE.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KSPFQAJW.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KVCJ23AF.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KVWY5PRY.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\LCP14KHR.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\LGDQUSTD.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\LHIEYQ2E.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\LI6LKW2L.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\LLQ6EYZJ.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\LN07Y3UR.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\LR7GLS2B.txt","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCU\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JSCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JSCRIPT\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JSCRIPT\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\LIVESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\LIVESCRIPT\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\LIVESCRIPT\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.1\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.1\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.1\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.2\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.2\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.2\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.3\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.3\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.3\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\ECMASCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\ECMASCRIPT\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\ECMASCRIPT\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\\PROGID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\COMPONENT CATEGORIES\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\COMPONENT CATEGORIES\\{F0B7A1A1-9847-11CF-8F20-00805F2CD064}\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\\IMPLEMENTED CATEGORIES\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\\IMPLEMENTED CATEGORIES\\{F0B7A1A1-9847-11CF-8F20-00805F2CD064}\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\COMPONENT CATEGORIES\\{F0B7A1A2-9847-11CF-8F20-00805F2CD064}\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\\IMPLEMENTED CATEGORIES\\{F0B7A1A2-9847-11CF-8F20-00805F2CD064}\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKLM\\SOFTWARE\\REIMAGE\\REIMAGE REPAIR\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\\IMPLEMENTED CATEGORIES\\{F0B7A1A1-9847-11CF-8F20-00805F2CD064}\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\\IMPLEMENTED CATEGORIES\\{F0B7A1A2-9847-11CF-8F20-00805F2CD064}\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JSCRIPT\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JSCRIPT\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JSCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\LIVESCRIPT\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\LIVESCRIPT\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\LIVESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.1\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.1\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.1\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.2\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.2\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.2\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.3\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.3\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.3\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\ECMASCRIPT\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\ECMASCRIPT\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\ECMASCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\\PROGID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\\IMPLEMENTED CATEGORIES\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F414C261-6AC0-11CF-B6D1-00AA00BBBB58}\\IMPLEMENTED CATEGORIES\\{0AEE2A92-BCBB-11D0-8C72-00C04FC2B085}\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JSCRIPT AUTHOR\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JSCRIPT AUTHOR\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JSCRIPT AUTHOR\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JSCRIPT.COMPACT AUTHOR\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JSCRIPT.COMPACT AUTHOR\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JSCRIPT.COMPACT AUTHOR\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\LIVESCRIPT AUTHOR\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\LIVESCRIPT AUTHOR\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\LIVESCRIPT AUTHOR\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT AUTHOR\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT AUTHOR\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT AUTHOR\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.1 AUTHOR\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.1 AUTHOR\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\JAVASCRIPT1.1 AUTHOR\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\ECMASCRIPT AUTHOR\\CLSID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\ECMASCRIPT AUTHOR\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\ECMASCRIPT AUTHOR\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F414C261-6AC0-11CF-B6D1-00AA00BBBB58}\\PROGID\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F414C261-6AC0-11CF-B6D1-00AA00BBBB58}\\OLESCRIPT\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F414C261-6AC0-11CF-B6D1-00AA00BBBB58}\\IMPLEMENTED CATEGORIES\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F414C261-6AC0-11CF-B6D1-00AA00BBBB58}\\INPROCSERVER32\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{F414C261-6AC0-11CF-B6D1-00AA00BBBB58}\\","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c9fc90f0288380a63c716c0"}]}]}},"report_ids":{"sandbox_job_ids":["5c9fc90f0288380a63c716c0","556cde9e8690b8494fce51db"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious ReImageRepair.G potentially unwanted application Sample ec67e8947166… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ec67e8947166…. Malware family: ReImageRepair.G potentially unwanted application. Threat score 100/100. 4/28 AV engines flagged this file. 10 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ec67e8947166fd22f79c54588b11697513e9e0d79f42cf9f52b8e51ff8577f41"}],["$","meta","4",{"property":"og:title","content":"Malicious ReImageRepair.G potentially unwanted application Sample ec67e8947166… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ec67e8947166…. Malware family: ReImageRepair.G potentially unwanted application. Threat score 100/100. 4/28 AV engines flagged this file. 10 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ec67e8947166fd22f79c54588b11697513e9e0d79f42cf9f52b8e51ff8577f41"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious ReImageRepair.G potentially unwanted application Sample ec67e8947166… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ec67e8947166…. Malware family: ReImageRepair.G potentially unwanted application. Threat score 100/100. 4/28 AV engines flagged this file. 10 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3b","11",{}]]