24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T442,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample ef75252054db… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample ef75252054db…. Threat score 35/100. 0/3 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ef75252054db37365cb91d79f08e22883dc13cb008df2dc55c04e96b7bb224ad","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","ef75252054db37365cb91d79f08e22883dc13cb008df2dc55c04e96b7bb224ad"],"about":{"@type":"SoftwareApplication","name":"https://bittube.tv/post/45802f4c-c75e-416a-b1d5-415d957e6861","applicationCategory":["url"],"identifier":"ef75252054db37365cb91d79f08e22883dc13cb008df2dc55c04e96b7bb224ad","additionalType":"Suspicious sample"},"threatScore":35,"antivirusDetections":{"malicious":0,"total":3},"behavioralIndicators":{"malicious":0,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T484,"\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_2232" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\IsoScope_8b8_IE_EarlyTabStart_0xba4_Mutex" "\Sessions\1\BaseNamedObjects\IsoScope_8b8_ConnHashTable<2232>_HashTable_Mutex" "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "\Sessions\1\BaseNamedObjects\IsoScope_8b8_IESQMMUTEX_0_303" "\Sessions\1\BaseNamedObjects\IsoScope_8b8_IESQMMUTEX_0_331" "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "Local\InternetShortcutMutex" "{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "IsoScope_8b8_IE_EarlyTabStart_0xba4_Mutex" "Local\URLBLOCK_HASHFILESWITCH_MUTEX" "{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "Local\URLBLOCK_FILEMAPSWITCH_MUTEX_2232" "UpdatingNewTabPageData"26:T544,"urlblockindex_1_.bin" has type "data" "font-awesome.min_1_.css" has type "ASCII text with very long lines" "6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04" has type "data" "~DF7894FB4E3A8914C6.TMP" has type "data" "vendors_1_.js" has type "ASCII text with very long lines" "BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894" has type "data" "css_3_.css" has type "ASCII text" "CC197601BE0898B7B0FCC91FA15D8A69_F6B3190C3680C3E0B5B932C2525D14C7" has type "data" "en-US.3" has type "data" "main_1_.js" has type "UTF-8 Unicode text with very long lines with no line terminators" "favicon_2_.ico" has type "PNG image data 16 x 16 4-bit colormap non-interlaced" "~DF4F7555D88E0EDF5F.TMP" has type "data" "favicon_1_.ico" has type "PNG image data 94 x 94 8-bit colormap non-interlaced" "bittube_1_.xml" has type "ASCII text with no line terminators" "B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62" has type "data" "CC197601BE0898B7B0FCC91FA15D8A69_B692386BB395D0D1B54DEE15DF22E03C" has type "data" "css_2_.css" has type "ASCII text" "search__0633EE93-D776-472f-A0FF-E1416B8B2E3A_.ico" has type "PNG image data 16 x 16 4-bit colormap non-interlaced" "OLIE8QSI.txt" has type "ASCII text" "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data 4776 bytes 1 file"27:T2270,Pattern match: "https://bittube.tv/post/45802f4c-c75e-416a-b1d5-415d957e6861" Pattern match: "https://bittube.tv" Heuristic match: "o.ss2.us" Heuristic match: "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: o.ss2.us" Heuristic match: "ocsp.rootg2.amazontrust.com" Heuristic match: "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com" Heuristic match: "ocsp.rootca1.amazontrust.com" Heuristic match: "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com" Heuristic match: "bittube.tv" Heuristic match: "bittubeapp.com" Heuristic match: "certify-js.alexametrics.com" Heuristic match: "certify.alexametrics.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "isrg.trustid.ocsp.identrust.com" Heuristic match: "ocsp.int-x3.letsencrypt.org" Heuristic match: "use.fontawesome.com" Pattern match: "http://www.apache.org/licenses/LICENSE-2.0" Heuristic match: ".img-container .divPostText p a{color:#2895F1 !important}.row .column .img-container .liveMediaIconSmall{position:absolute;z-index:1;color:white;bottom:0px;background-color:black;height:25px;left:0px;opacity:1;text-align:center;margin:0 auto;padding-left:5" Pattern match: "http://feross.org" Pattern match: "http://fontawesome.io" Pattern match: "https://quilljs.com/" Pattern match: "http://momentjs.com/guides/#/warnings/min-max/" Pattern match: "http://momentjs.com/guides/#/warnings/dst-shifted/" Pattern match: "https://firebasestorage.googleapis.com/v0/b/bittube-airtime-extension.appspot.com/o/userprofiles%2FwhiteBanner.jpg?alt=media&token=2a7cab0d-d71d-4582-bf2c-aa68eb19e36a,https://firebasestorage.googleapis.com/v0/b/bittube-airtime-extension.appspot.com/o/us" Pattern match: "http://+" Pattern match: "https://streaming.bittubeapp.com,TUBE_DEFAULT_CHANNEL:live,IN_DEV:,BASE_URL:https://bittube.tv,SHARE_URL:https://bittube.tv,SEED_URL:https://webseed1.bittube.tv,GOOGLE_GEOLOCATION_KEY:AIzaSyCgC9a5R_ZjHpcYaX47RqSmPaZVFzQh9Eo,FIREBASE_KEY:AIzaS" Pattern match: "https://player.twitch.tv/+Z+.external" Pattern match: "https://firebasestorage.googleapis.com/v0/b/bittube" Pattern match: "moderation.nsfw/porn" Pattern match: "https://github.com/faisalman/ua-parser-js" Pattern match: "http://ionicons.com/" Pattern match: "https://accounts.google.com/o/oauth2/v2/auth,n.oauth2_token_url=https://www.googleapis.com/oauth2/v4/token,n.redirect_uri=m.BASE_URL+/connect-youtube,n.is_youtube_linked_url=/api/is-youtube-linked,n.save_youtube_tokens_url=/api/save-youtube-tokens" Heuristic match: "ateElement(p,{__source:{fileName:i,lineNumber:257}},t(settings.linkyoutube)),u.default.createElement(button,{type:button,className:googleButton,onClick:function(){return e.actionLink()},__source:{fileName:i,lineNumber:258}},u.default.createElemen" Pattern match: "chat-service-dot-bittube-social.appspot.com/chat-service,s" Pattern match: "https://bittubeapp.com/" Pattern match: "https://maps.googleapis.com/maps/api/geocode/json?latlng=+n+,+s+&key=+i.GOOGLE_GEOLOCATION_KEY" Pattern match: "https://www.+m:https://+m" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "https://github.com/jonschlinkert/is-plain-object" Pattern match: "https://www.youtube.com/iframe_api,d,onYouTubeIframeAPIReady" Pattern match: "https://w.soundcloud.com/player/api.js,SC" Pattern match: "https://firebasestorage.googleapis.com/v0/b/bittube-airtime-extension.appspot.com/o/posts%2Faudio__bg.png?alt=media&token=296a77a1-53d9-422f-afa3-671bb7c569a9;a&&(n=a.poster),r&&(n=r.firstChild.src);var" Pattern match: "https://github.com/MrRio/jsPDF" Pattern match: "https://github.com/BiggA94" Pattern match: "Math.PI/2,u=r?-1:1,c=t,f=Math.min(i,Math.abs(a-o));1e-5" Pattern match: "this.progress.val/this.progress.state,this},S.prototype.updateProgress=function(e,t,n,r){return" Pattern match: "http://jspdf.default.namespaceuri/,ue=e,this.internal.events.subscribe" Pattern match: "http://www.w3.org/1999/xhtml,a" Pattern match: "https://xkeshi.github.io/image-compressor" Pattern match: "Math.PI/180" Pattern match: "connect.facebook.net/en_US/sdk.js,f=/facebook\.com\/([^/?].+\/)?video(s|\.php)[/?].*$/,d=facebook-player-,h=t.Facebook=function(e){function" Pattern match: "https://cdnjs.cloudflare.com/ajax/libs/hls.js/VERSION/hls.min.js.replace(VERSION,r),Hls" Pattern match: "a.bw/8:1e3*a.loaded/l" Heuristic match: "******************!*\ !*** ./src/demux/id3.js ***! \**************************/ /*! no static exports found */ /*! ModuleConcatenation bailout: Module is not an ECMAScript module */function(e,t,n){use strict;Object.defineProperty(t,__esModule,{valu" Pattern match: "http://jqueryui.com" Heuristic match: "(null===u)return null;if(0===g)return u;var m,_;if(object!=typeof u)return u;if(e(u,n))m=new n;else if(e(u,r))m=new r;else if(e(u,i))m=new i((function(e,t){u.then((function(t){e(a(t,g-1))}),(function(e){t(a(e,g-1))}))}));else if(o.__isArray(u))m=[];else " Pattern match: "www.youtube.com/embed/+t[2]+?showinfo=0" Pattern match: "https://quilljs.com" Pattern match: "http://www.w3.org/2000/svg,a=document.createElementNS(o,svg),s=document.createElementNS(o,foreignObject);return" Pattern match: "http://fb.me/use-check-prop-types" Pattern match: "https://firebase.google.com/pricing/" Pattern match: "https://reactjs.org/docs/error-decoder.html?invariant=+e,r=0;r" Pattern match: "http://www.w3.org/1999/xlink" Pattern match: "http://www.w3.org/1999/xhtml,mathml:http://www.w3.org/1998/Math/MathML,svg:http://www.w3.org/2000/svg};function" Pattern match: "https://fb.me/react-polyfills" Pattern match: "https://feross.org" Pattern match: "https://github.com/jonschlinkert/isobject" Pattern match: "http://localhost,t.scrollbars=!0" Pattern match: "https://www.googleapis.com/identitytoolkit/v3/relyingparty/,jb:https://securetoken.googleapis.com/v1/token,id:p},dd:{bb:https://staging-www.sandbox.googleapis.com/identitytoolkit/v3/relyingparty/,jb:https://staging-securetoken.sandbox.googleapis.co" Pattern match: "https://securetoken.googleapis.com/v1/token,this.o=e.secureTokenTimeout||Aa,this.f=ie(e.secureTokenHeaders||ya),this.g=e.firebaseEndpoint||https://www.googleapis.com/identitytoolkit/v3/relyingparty/,this.h=e.firebaseTimeout||va,this.a=ie(e.firebaseHeade" Pattern match: "https://apis.google.com/js/api.js?onload=%{onload" Pattern match: "http://localhost" Pattern match: "https://noembed.com/embed?url=+n" Pattern match: "https://stackoverflow.com/a/9422689" Pattern match: "https://github.com/zenoamaro/react-quill#upgrading-to-react-quill-v1-0-0" Pattern match: "http://www.w3.org/1999/xhtml===n?ee(e):http://www.w3.org/2000/svg===n&&foreignObject===e?http://www.w3.org/1999/xhtml:n,this.stack.push({domNamespace:n,type:a,children:s,childIndex:0,context:t,footer:l}),this.previousWasTextNode=!1,v},e}(),Ae={rende" Pattern match: "https://+e" Pattern match: "https://mths.be/utf8js" Pattern match: "https://mths.be/punycode" Pattern match: "Math.PI/2,t" Pattern match: "Math.PI/200*n;caserad:return" Pattern match: "http://www.w3.org/2000/svg,viewBox:0" Pattern match: "https://airshare.bittubeapp.com/#magnet:?xt=urn:btih:+n+&tr=udp%3A%2F%2Fexplodie.org%3A6969&tr=udp%3A%2F%2Ftracker.coppersurfer.tk%3A6969&tr=udp%3A%2F%2Ftracker.empire-js.us%3A1337&tr=udp%3A%2F%2Ftracker.leechers-paradise.org%3A6969&tr=udp%3A%2F%2Ftracke" Pattern match: "http://$2\" Pattern match: "https://www.+e:https://+e:e}},{key:render,value:function(){var" Pattern match: "https://us-central1-bittube-airtime-extension.cloudfunctions.net/getCoinData?currency=USD" Pattern match: "https://bittubeapp.com/,rel:noopener" Pattern match: "https://medium.com/@Bit.Tube/bit-tube-or-the-story-of-the-ipbc-rebrand-deda61db890,rel:noopener" Pattern match: "https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences,rel:noopener" Pattern match: "https://support.microsoft.com/es-es/help/17442/windows-internet-explorer-delete-manage-cookies,rel:noopener" Pattern match: "https://github.com/ipbc-dev/bittubers-translate,rel:noopener" Pattern match: "https://beta.bittubers.com" Pattern match: "https://firebasestorage.googleapis.com/v0/b/bittube-airtime-extension.appspot.com/o/userprofiles%2Favatar.jpg?alt=media&token=fd33a5ad-e444-46a5-8942-109512b6a6be"28:T7e9,"iexplore.exe" wrote bytes "60cd2a6e" to virtual address "0x770C130C" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "c03a276e" to virtual address "0x76321FB0" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "b033276e" to virtual address "0x75A21164" (part of module "USP10.DLL") "iexplore.exe" wrote bytes "b033276e" to virtual address "0x73971250" (part of module "UXTHEME.DLL") "iexplore.exe" wrote bytes "b033276e" to virtual address "0x743F1038" (part of module "VERSION.DLL") "iexplore.exe" wrote bytes "b033276e" to virtual address "0x6D27F6A0" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "b033276e" to virtual address "0x752A14E0" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "a035276e" to virtual address "0x7397139C" (part of module "UXTHEME.DLL") "iexplore.exe" wrote bytes "b033276e" to virtual address "0x760B1100" (part of module "MSCTF.DLL") "iexplore.exe" wrote bytes "3030276e" to virtual address "0x770C1380" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "60d22a6e" to virtual address "0x76321D7C" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "a035276e" to virtual address "0x770C131C" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "a035276e" to virtual address "0x75371064" (part of module "IMM32.DLL") "iexplore.exe" wrote bytes "a035276e" to virtual address "0x760B1298" (part of module "MSCTF.DLL") "iexplore.exe" wrote bytes "a035276e" to virtual address "0x7559B0CC" (part of module "IERTUTIL.DLL") "iexplore.exe" wrote bytes "a035276e" to virtual address "0x77121144" (part of module "LPK.DLL") "iexplore.exe" wrote bytes "b033276e" to virtual address "0x752511BC" (part of module "GDI32.DLL") "iexplore.exe" wrote bytes "c0bf286e" to virtual address "0x76321F68" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "b033276e" to virtual address "0x759717CC" (part of module "ADVAPI32.DLL") "iexplore.exe" wrote bytes "70cc2a6e" to virtual address "0x770C1310" (part of module "SHLWAPI.DLL")29:T15d6,Found malicious artifacts related to "205.185.216.42": ... URL: http://a.realsrv.com/iframe.php?idzone=3949740&size=728x90&sub=6 (AV positives: 1/79 scanned on 09/30/2020 06:29:46) URL: https://apk.droidapk.xyz/d11/PUSHSM10M-MHN-DOWNLOADER-PROXY/ (AV positives: 3/79 scanned on 09/30/2020 06:23:32) URL: https://servedby.flashtalking.com/imp/1/135075;4949469;208;xml;MediamathStarsGroup;PCUKiOSALWAYSONGVODMediaMathMediamathOpenMarketRONALLALLCASINONO18908657VOD20LANPX/?gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_78}&gdpr_pd=${GDPR_PD}&us_privacy=${US_PRIVACY}&cachebuster=7638303563170363392 (AV positives: 1/79 scanned on 09/30/2020 06:17:31) URL: https://apk.droidapk.xyz/d8/PUSHSM10M-MHN-BESTPLAYER/ (AV positives: 3/79 scanned on 09/30/2020 03:23:39) URL: https://s3.ddistr.xyz/d1/10m01/ (AV positives: 3/79 scanned on 09/30/2020 01:24:00) File SHA256: ea7765263add5a055bf7f90fb092f9c2e144a39de5d424fd8fe37c188ad94458 (AV positives: 2/74 scanned on 09/29/2020 15:49:44) File SHA256: cbecb7e20426c9476b2f191a8696d64345bc73b3d60f5061e070f0f92a63d6c5 (Date: 09/28/2020 06:10:37) File SHA256: 64299317cbe2a5d57b3f2af9acccc1035379d9ec81921330865a63571d54e8fa (Date: 09/28/2020 00:59:59) File SHA256: 56f57be25309239447a823ecb5c9c57a26fd612b03f3c24bcea3a8fa2a97725c (Date: 09/28/2020 00:57:37) File SHA256: 3859bda169be4de795d55b1f5495d421816af01b2825065e27f855eecbdc8e3a (Date: 09/21/2020 07:35:54) File SHA256: a4c6d305120df9378edd8aac96036a955e7c778b604d8f0015ad00651527444f (Date: 09/15/2020 15:03:33) File SHA256: 5b41c8259bc1249d031c1ae5802b99941a0e9248a94a0ca63ddea7185557a4a3 (AV positives: 2/74 scanned on 09/13/2020 14:57:24) File SHA256: 171554fc14d1215721bcfd851e471841923398a60ac8db84e4a33131f02df0e9 (AV positives: 1/73 scanned on 09/11/2020 12:52:32) File SHA256: af417a8613897e71486a80cc2288c92c7e52e5e78dda0c079142afeca21558bb (AV positives: 9/73 scanned on 09/10/2020 19:32:05) File SHA256: eb229def332789b5db8edf04a89fa50fb9c406b93d427837e7cce1e8b489afbc (AV positives: 34/73 scanned on 09/09/2020 13:32:59) Found malicious artifacts related to "23.111.9.35": ... URL: https://use.fontawesome.com/releases/v5.0.6/css/all.css (AV positives: 1/79 scanned on 09/30/2020 05:50:30) URL: https://download.getshoppingassistant.com/cartripple/3.2.2/ (AV positives: 2/79 scanned on 09/30/2020 01:24:12) URL: http://use.fontawesome.com/releases/v5.0.6/css/all.css (AV positives: 1/79 scanned on 09/24/2020 09:12:24) URL: https://use.fontawesome.com/releases/v5.8.1/css/all.css (AV positives: 1/79 scanned on 09/24/2020 09:09:21) URL: https://use.fontawesome.com/releases/v5.0.13/css/all.css?ver=4.9.15 (AV positives: 1/79 scanned on 09/19/2020 00:28:37) File SHA256: 8674f74490fe8598cacdca012e1f61cacc34e25096ff1777a566bdbc6ea51daa (Date: 09/30/2020 02:29:39) File SHA256: 0d2faaeb1e7dc27e12a6e4ad4f99c9135bd378f915e6fdb624044a532b7d1aa9 (Date: 09/29/2020 22:11:09) File SHA256: cedd7745c4bb6acae26084848e5815cf84cc086434d293ac391c9162886b8d5c (Date: 09/29/2020 20:16:07) File SHA256: 73e6e2ee824b365e4ac7523d710917d4fec433c59ae8ffe994497e114235230d (Date: 09/29/2020 20:00:33) File SHA256: fa94a9b4be2920b2b99a22a75cca46030ffd14598b08ca0e7465795eefaed3fa (Date: 09/29/2020 17:41:22) File SHA256: 0f0c379dd3fafc393f5d874c519bc8b979c44008bfbf9b1d4db708ce47758dc6 (AV positives: 21/73 scanned on 08/26/2020 22:09:19) File SHA256: 8bfc70bad0529d77ca79ff0eacb68a42a01aad26593313c921a8058a64006027 (AV positives: 24/75 scanned on 08/17/2020 17:26:09) File SHA256: 6d28d9ecc9bd68d97ea3e4319754f38d9283713d8dbc72e4f3d4d10c77508c71 (AV positives: 22/76 scanned on 08/02/2020 16:38:52) File SHA256: 8d484ca44615db60a5d0f81853cad4884f11efaa29da501df147097f23ca7781 (AV positives: 22/75 scanned on 07/28/2020 00:16:01) File SHA256: 81d2fa7642f133819ed54a8ce0b41995f05d760e9a3a24341821fe31f27de148 (AV positives: 17/76 scanned on 07/20/2020 06:40:03) Found malicious artifacts related to "151.101.65.195": ... URL: https://ybtnlahjfa.web.app/ (AV positives: 16/79 scanned on 09/30/2020 09:02:07) URL: http://outlook356-da698.firebaseapp.com/ (AV positives: 5/79 scanned on 09/30/2020 08:27:53) URL: https://owa-redirect.web.app/ (AV positives: 15/79 scanned on 09/30/2020 08:19:24) URL: http://viasozxia.firebaseapp.com/tru (AV positives: 8/79 scanned on 09/30/2020 08:13:02) URL: http://vc4c6t8d.firebaseapp.com/ (AV positives: 5/79 scanned on 09/30/2020 08:02:03) File SHA256: ccf1c6e05570f374131a7f0bad868342ad71881f708d362115f742b2c5a68d04 (AV positives: 1/75 scanned on 09/29/2020 19:09:08) File SHA256: f6320280fabb194d13499c150dc456009e10b3118fe5fc1fd3484d431521919c (AV positives: 1/74 scanned on 09/28/2020 09:57:59) File SHA256: d1fd956d56daf91aa2b1f61dde25bcf780a51d9b5474629b91b7e4483637258b (AV positives: 5/75 scanned on 09/25/2020 02:40:28) File SHA256: 132fd192446f8932f2d09c8382a523fc6b9cd765fa568ecc3022e41ad470eb14 (AV positives: 3/74 scanned on 09/20/2020 19:15:22) File SHA256: dded5165138c7f65c60e2287a9c22e63ff9f33c7efc075fbaa4e2533085001ee (AV positives: 3/73 scanned on 09/19/2020 06:17:31) File SHA256: c5e22834649fa4b4e04263651ec7416a9caec25ecaf4c69430aeeeaba4196958 (Date: 08/16/2020 04:09:36) File SHA256: 5d5bddd95b75beed23b2ab36a1fe313bf22cf68c8d618b4e2ae89169e94717c8 (Date: 08/16/2020 04:09:29) File SHA256: ecae9d416ed775f3a82c324cdb77a687c8e4123873e7ec34558054271852a018 (Date: 08/13/2020 20:47:08) File SHA256: e81094f20cee0aff8d96bcd3e913877625227801a78f1ad015c656eb0a38e6b3 (Date: 07/29/2020 17:09:32) File SHA256: cd9a53e129e704c45c5766b1b9a1b8395cbda65bc85a2880e7353c67f239284d (Date: 07/05/2020 07:21:44)2a:T4026,"78],[6,30,56,82],[6,30,58,86],[6,34,62,90],[6,28,50,72,94],[6,26,50,74,98],[6,30,54,78,102],[6,28,54,80,106],[6,32,58,84,110],[6,30,58,86,114],[6,34,62,90,118],[6,26,50,74,98,122],[6,30,54,78,102,126],[6,26,52,78,104,130],[6,30,56,82,108,134],[6,34,60,86,112,138],[6,30,58,86,114,142],[6,34,62,90,118,146],[6,30,54,78,102,126,150],[6,24,50,76,102,128,154],[6,28,54,80,106,132,158],[6,32,58,84,110,136,162],[6,26,54,82,110,138,166],[6,30,58,86,114,142,170]],G15:1335,G18:7973,G15_MASK:21522,getBCHTypeInfo:function(e){for(var t=e<<10;p.getBCHDigit(t)-p.getBCHDigit(p.G15)>=0;)t^=p.G15<=0;)t^=p.G18<>>=1;return t},getPatternPosition:function(e){return p.PATTERN_POSITION_TABLE[e-1]},getMask:function(e,t,n){switch(e){case a:return(t+n)%2==0;case s:return t%2==0;case l:return n%3==0;case u:return(t+n)%3==0;case c:return(Math.floor(t/2)+Math.floor(n/3))%2==0;case f:return t*n%2+t*n%3==0;case d:return(t*n%2+t*n%3)%2==0;case h:return(t*n%3+(t+n)%2)%2==0;default:throw new Error("bad maskPattern:"+e)}},getErrorCorrectPolynomial:function(e){for(var t=new i([1],0),n=0;n5&&(n+=3+o-5)}for(r=0;rs)&&void 0===e.nsecs&&(g=0),g>=1e4)throw new Error("uuid.v1(): Can't create more than 10M uuids/sec");s=p,l=g,i=d;var _=(1e4*(268435455&(p+=122192928e5))+g)%4294967296;c[u++]=_>>>24&255,c[u++]=_>>>16&255,c[u++]=_>>>8&255,c[u++]=255&_;var A=p/4294967296*1e4&268435455;c[u++]=A>>>8&255,c[u++]=255&A,c[u++]=A>>>24&15|16,c[u++]=A>>>16&255,c[u++]=d>>>8|128,c[u++]=255&d;for(var y=0;y<6;++y)c[u+y]=f[y];return t||a(c)}},function(e,t,n){var r=n(846),i=n(847);e.exports=function(e,t,n){var o=t&&n||0;"string"==typeof e&&(t="binary"===e?new Array(16):null,e=null);var a=(e=e||{}).random||(e.rng||r)();if(a[6]=15&a[6]|64,a[8]=63&a[8]|128,t)for(var s=0;s<16;++s)t[o+s]=a[s];return t||i(a)}},,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,function(e,t,n){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var r,i=(r=n(1))&&"object"==typeof r&&"default"in r?r.default:r,o=n(0),a=function(e){var t=o.useRef(e);o.useEffect((function(){t.current=e}),[e]),o.useEffect((function(){var e=function(e){var n;if(t.current&&(n=t.current(e)),"string"==typeof n)return e.returnValue=n,n};return window.addEventListener("beforeunload",e),function(){window.removeEventListener("beforeunload",e)}}),[])},s=function(e){var t=e.children,n=void 0===t?null:t,r=e.onBeforeunload;return a(r),n};s.propTypes={children:i.any,onBeforeunload:i.func.isRequired},t.Beforeunload=s,t.default=s,t.useBeforeunload=a},,,,,,,,function(e,t,n){"use strict";n.r(t);var r=n(101),i=n.n(r),o=n(11),a=n.n(o),s=n(332),l=n.n(s),u=n(2),c=n.n(u),f=n(3),d=n.n(f),h=n(4),p=n.n(h),g=n(5),m=n.n(g),_=n(0),A=n.n(_),y=n(1),v=n.n(y),b=n(18),w=n.n(b),F=function(e){function t(e){c()(this,t);var n=p()(this,(t.__proto__||l()(t)).call(this,e));return n._isMounted=!1,n.state={count:0},n}return m()(t,e),d()(t,[{key:"componentDidMount",value:function(){this._isMounted=!0,this.updateCount(this.props.url)}},{key:"componentWillReceiveProps",value:function(e){e.url!==this.props.url&&this.updateCount(e.url)}},{key:"componentWillUnmount",value:function(){this._isMounted=!1}},{key:"updateCount",value:function(e){var t=this;this.props.getCount&&(this.setState({isLoading:!0}),this.props.getCount(e,(function(e){t._isMounted&&t.setState({count:e,isLoading:!1})})))}},{key:"render",value:function(){var e=this.state,t=e.count,n=e.isLoading,r=this.props,i=r.children,o=r.className;return A.a.createElement("div",{className:w()("SocialMediaShareCount",o)},!n&&i(t||0))}}]),t}(_.Component);function k(e){return function(t){return A.a.createElement(F,a()({getCount:e},t))}}F.propTypes={children:v.a.func,className:v.a.string,getCount:v.a.func,url:v.a.string.isRequired},F.defaultProps={children:function(e){return e}};var E=k((function(e,t){var n="https://graph.facebook.com/?id="+e;i()(n,(function(e,n){t(!e&&n&&n.share&&n.share.share_count?n.share.share_count:void 0)}))})),x=n(333),S=n.n(x);function C(e){return"?"+S()(e).filter((function(t){return!!e[t]})).map((function(t){return t+"="+encodeURIComponent(e[t])})).join("&")}var T=k((function(e,t){return i()("https://api.pinterest.com/v1/urls/count.json"+C({url:e}),(function(e,n){t(n?n.count:void 0)}))}));var D=k((function(e,t){window.VK||(window.VK={Share:{count:function(e,t){return window.VK.callbacks[e](t)}},callbacks:[]});var n=window.VK.callbacks.length;return window.VK.callbacks.push(t),i()("https://vk.com/share.php"+C({act:"count",index:n,url:e}))}));var L=k((function(e,t){window.OK||(window.OK={Share:{count:function(e,t){return window.OK.callbacks[e](t)}},callbacks:[]});var n=window.OK.callbacks.length;return window.ODKL={updateCount:function(e,t){window.OK.callbacks[n](t)}},window.OK.callbacks.push(t),i()("https://connect.ok.ru/dk"+C({"st.cmd":"extLike",uid:"odklcnt0",ref:e}))}));var B=k((function(e,t){var n="https://www.reddit.com/api/info.json?limit=1&url="+e;i()(n,{param:"jsonp"},(function(e,n){t(!e&&n&&n.data&&n.data.children.length>0&&n.data.children[0].data.score?n.data.children[0].data.score:void 0)}))}));var M=k((function(e,t){return i()("https://api.tumblr.com/v2/share/stats"+C({url:e}),(function(e,n){t(n?n.note_count:void 0)}))})),O=n(34),j=n.n(O),P=n(73),N=n.n(P),I=n(99),R=n.n(I),U=function(e){return!!e&&("object"===(void 0===e?"undefined":R()(e))||"function"==typeof e)&&"function"==typeof e.then},H=function(e,t){return{left:window.outerWidth/2+(window.screenX||window.screenLeft||0)-e/2,top:window.outerHeight/2+(window.screenY||window.screenTop||0)-t/2}},q=function(e,t){return{top:(window.screen.height-t)/2,left:(window.screen.width-e)/2}};var Y=function(e){function t(){var e,n,r,i;c()(this,t);for(var o=arguments.length,s=Array(o),u=0;u2&&void 0!==arguments[2]?arguments[2]:function(){return{}},r=arguments[3],i=arguments.length>4&&void 0!==arguments[4]?arguments[4]:{},o=function(r){return A.a.createElement(Y,a()({},r,{network:e,networkLink:t,opts:n(r)}))};return o.propTypes=r,o.defaultProps=i,o};var z=Q("facebook",(function(e,t){var n=t.quote,r=t.hashtag;return j()(e,"facebook.url"),"https://www.facebook.com/sharer/sharer.php"+C({u:e,quote:n,hashtag:r})}),(function(e){return e.picture&&console.warn("FacebookShareButton warning: picture is a deprecated prop."),e.title&&console.warn('FacebookShareButton warning: title is a deprecated prop. Use "quote" instead.'),e.description&&console.warn('FacebookShareButton warning: description is a deprecated prop.\n Use "quote" instead.') {quote:e.quote hashtag:e.hashtag}}) {quote:v.a.string hashtag:v.a.string} {windowWidth:550 windowHeight:400});var W=Q("linkedin",(function(e){return j()(e,"linkedin.url") "https://linkedin.com/shareArticle"+C({url:e})}) void 0 void 0 {windowWidth:750 windowHeight:600});var V=Q("twitter",(function(e,t){var n=t.title r=t.via i=t.hashtags o=void 0===i?[]:i;return j()(e,"twitter.url") j()(Array.isArray(o) "twitter.hashtags is not an array") "https://twitter.com/share"+C({url:e,text:n,via:r,hashtags:o.join(",")})}) (function(e){return{hashtags:e.hashtags title:e.title via:e.via}}) {hashtags:v.a.arrayOf(v.a.string) title:v.a.string via:v.a.string} {windowWidth:550 windowHeight:400});var K=Q("pinterest",(function(e,t){var n=t.media r=t.description;return j()(e,"pinterest.url") j()(n,"pinterest.media") "https://pinterest.com/pin/create/button/"+C({url:e,media:n,description:r})}) (function(e){return{media:e.media description:e.description}}) {media:v.a.string.isRequired description:v.a.string} {windowWidth:1e3 windowHeight:730});var G=Q("vk",(function(e,t){var n=t.title r=t.description i=t.image;return j()(e,"vk.url") "https://vk.com/share.php"+C({url:e,title:n,description:r,image:i})}) (function(e){return{title:e.title description:e.description image:e.image}}) {title:v.a.string description:v.a.string image:v.a.string} {windowWidth:660 windowHeight:460});var X=Q("ok",(function(e,t){var n=t.title r=t.description i=t.image;return j()(e,"ok.url") "https://connect.ok.ru/offer"+C({url:e,title:n,description:r,imageUrl:i})}) (function(e){return{title:e.title description:e.description image:e.image}}) {title:v.a.string description:v.a.string image:v.a.string} {windowWidth:588 windowHeight:480 windowPosition:"screenCenter"});var J=Q("telegram",(function(e,t){var n=t.title;return j()(e,"telegram.url") "https://telegram.me/share/"+C({url:e,text:n})}) (function(e){return{title:e.title via:e.via}}) {title:v.a.string via:v.a.string} {windowWidth:550 windowHeight:400});var $=Q("whatsapp",(function(e,t){var n=t.title r=t.separator;return j()(e,"whatsapp.url") "https://"+(/(android|iphone|ipad|mobile)/i.test(navigator.userAgent)?"api":"web")+".whatsapp.com/send"+C({text:n?n+r+e:e})}) (function(e){return{title:e.title separator:e.separator}}) {title:v.a.string separator:v.a.string} {separator:" " windowWidth:550 windowHeight:400});var Z=Q("reddit",(function(e,t){var n=t.title;return j()(e,"reddit.url") "https://www.reddit.com/submit"+C({url:e,title:n})}) (function(e){return{title:e.title}}) {title:v.a.string} {windowWidth:660 windowHeight:460});var ee=Q("email",(function(e,t){var n=t.subject r=t.body i=t.separator;return"mailto:"+C({subject:n,body:r?r+i+e:e})}) (function(e){return{subject:e.subject body:e.body separator:e.separator}}) {subject:v.a.string body:v.a.string separator:v.a.string} {separator:" " openWindow:!1 onClick:function(e){window.location.href=e}});var te=Q("tumblr",(function(e,t){var n=t.title r=t.caption i=t.tags o=t.posttype;return j()(e,"tumblr.url") "https://www.tumblr.com/widgets/share/tool"+C({canonicalUrl:e,title:n,caption:r,tags:i,posttype:o})}) (function(e){return{title:e.title tags:e.tags.join(",") caption:e.caption posttype:e.posttype}}) {title:v.a.string caption:v.a.string posttype:v.a.string tags:v.a.arrayOf(v.a.string)} {tags:[] posttype:"link" windowWidth:660 windowHeight:460});var ne=Q("livejournal",(function(e,t){var n=t.title r=t.description;return j()(e,"livejournal.url") "https://www.livejournal.com/update.bml"+C({subject:n,event:r})}) (function(e){return{title:e.title description:e.description}}) {title:v.a.string description:v.a.string} {windowWidth:660 windowHeight:460});var re=Q("mailru",(function(e,t){var n=t.title r=t.description i=t.image;return j()(e,"mailru.url") "https://connect.mail.ru/share"+C({url:e,title:n,description:r,imageurl:i})}) (function(e){return{title:e.title description:e.description image:e.image}}) {title:v.a.string description:v.a.string image:v.a.string} {windowWidth:660 windowHeight:460});var ie=Q("viber",(function(e,t){var n=t.title r=t.separator;return j()(e,"viber.url") "viber://forward"+C({text:n?n+r+e:e})}) (function(e){return{title:e.title separator:e.separator}}) {title:v.a.string separator:v.a.string} {separator:" " windowWidth:660 windowHeight:460});var oe=Q("workplace",(function(e,t){var n=t.quote r=t.hashtag;return j()(e,"workplace.url") "https://work.facebook.com/sharer.php"+C({u:e,quote:n,hashtag:r})}) (function(e){return{quote:e.quote hashtag:e.hashtag}}) {quote:v.a.string hashtag:v.a.string} {windowWidth:550 windowHeight:400});var ae=Q("line",(function(e,t){var n=t.title;return j()(e,"line.url") "https://social-plugins.line.me/lineit/share"+C({url:e,text:n})}) (function(e){return{title:e.title}}) {title:v.a.string} {windowWidth:500 windowHeight:500});var se=Q("weibo",(function(e,t){var n=t.title r=t.image;return j()(e,"weibo.url") "http://service.weibo.com/share/share.php"+C({url:e,title:n,pic:r})}) (function(e){return{title:e.title image:e.image}}) {title:v.a.string image:v.a.string} {windowWidth:650 windowHeight:350 windowPosition:"screenCenter"});var le=Q("pocket",(function(e,t){var n=t.title;return j()(e,"pocket.url") "https://getpocket.com/save"+C({url:e,title:n})}) (function(e){return{title:e.title}}) {title:v.a.string} {windowWidth:500 windowHeight:500});var ue=Q("instapaper",(function(e,t){var n=t.title r=t.description;return j()(e,"instapaper.url") "htt" (Indicator: "line.me"; File: "SSL")2b:T564,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD0klEQVR42u2XS2hTWRjHg7Nw4TADYqcdxFbFMqtZjjOzUgdFRWtbEjuPMgu3wygoCqXooKIoVGiNaZuWLtsunIdTmG4GN4VQZmBaLPRlKK0P0iZ9JJmYx03u4+/3nZs0zTX39jZx2Q/+5EHO+f++75zznRuHYzu2wxBTU1NYWlrC8vIygsGgTem/DwQCGB0dRX19PUoGmJ6ehqZpKCVkWQaPZwin04mSAdLptJiQQTRNhaqaSYGi5MUxNzcHv9+PyclJNDY2okwAc2OjeQ7gxYsFLC4uis8TExNobm5GyQB2ss5LFmM4+/n5efE+EonA5/PB5XJhSwCSJJkCmJnnAGZmZjA42E8axMDAAIaGhjA8PPy+AMzNeQOychEKhQTM2NiYgCgTQDE1zxnnlUEmkyk4SbOzs+UAbJ71RvMcgC6eR0MikSgVoBzztBADRKPRrQKkRAk3L7nRNG/MJ4nF80Sjka0BpFJGALkk83RaEr3EEuCni5dx9eq1kuT2dL1jngeQ7AHwRG9opVaokYUyQJIno+z5QBWXJsTBY63McwDckCwBlsn8ZQxYSgB3+v/BruMPUHXOjUPf9qD2O++6Pm3woJa+U8QdoWUBjGXPA/Bm5pMUiYStAVZUYCGi4jVBxGnQn6MLONDUhap6N6qd3ah2dZK6sOdMB2oa3JDVQgCjcc5cB1A2B1glgJcE8CoKBGJpQX2bKrH7dDtqzndjf1YVBHDI2VFQAStzPk22AV5R9lyBJA18OhHAgfNe1Ljy5vubvPhEADwsAiAZAFLrsgUQhm4ep9fxuVV89kMv9jk7ydgrzPc1erC34RFVoB21BLBxCcwy3wgQDm8CEOHLIwW8oUqcvfYbKurcONjULcpfVdeBytNttPYd2HXsHg42tBsqUNyYxf2E+0c4vGYN8D8B0AHAyFQIlXUPaQN61813fHUTv4/M4L/nQTi+/AWVJ+8XAJgZ60raA+A+QMnD8+QZPj7VLgC45B98fRPux/9mH800DPme46MjtwuWwGiuAyTXZQsgnr023X88w4cnHtDm68LOI3fR0vlUGEmsrOlfPr+hAsWy3yJAItvl/h4PYOc3bbQMblTRuq/EJGEUl1XqkCokRTc2AzCa2wbgyzdKbZj2IY7+3A/H56344kKvMJFJSQJIkSRSWlENS5BEMslKFFUmI2N1dcUagG/ttZRehWA4ju+v/wrH4Rv48dYTjPlDIDZQAQgGlL2+X3J3gd2wBOBQsj+MxWKIx+PiKcZKXG4e29vbU1Q9Pbr6+vrg8XjMAS5eulLyddzS2opy/wq+BTgoCRlpZOGDAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"ef75252054db37365cb91d79f08e22883dc13cb008df2dc55c04e96b7bb224ad","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":35,"unified_at_epoch_ms":1790454661423,"unified_at":"2026-09-26T20:31:01.423Z","metadata":{"hashes":{"sha256":"ef75252054db37365cb91d79f08e22883dc13cb008df2dc55c04e96b7bb224ad","sha1":"9e7b1328ca9bdb0d5c0003d4e1e801c4fbeae083","md5":"cf5b3f7b5ea9ca4d6e26f30bd01dd788","sha512":"ad500fd4f93a1d289d61f36940da0102b8e3624a31f6e6ce32d25aaad24c83690c40a2cf87ab236f3210b7255a8b4a78b9763d020166734b94e8efdae1978a5d","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"https://bittube.tv/post/45802f4c-c75e-416a-b1d5-415d957e6861","file_type":["url"],"file_type_id":"url","file_size":0,"is_container_sample":false,"url_analysis":true},"submissions":{"first_seen":1601456224000,"last_seen":1679053131000,"last_multi_scan":1679053131000}},"detections":{"summary":{"verdict":"suspicious","score":35,"tags":["redirector"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":3},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":2},"sandbox_signatures":{"informative_count":14,"suspicious_count":4,"malicious_count":0,"total":18},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"cleandns":{"name":"CleanDNS","success":true,"verdict":"undetected","status":"no-result","progress":100,"data_source":"CleanDNS","permalink":"https://www.cleandns.com/","extra_fields":[{"name":"domain","value":"bittube.tv"},{"name":"percent","value":0},{"name":"reports_count","value":0}]},"scamadviser":{"name":"ScamAdviser","success":true,"verdict":"undetected","status":"no-result","progress":100,"data_source":"ScamAdviser","permalink":"https://www.scamadviser.com/?utm_source=hybridanalysis"},"urlscanio":{"name":"urlscan.io","success":true,"verdict":"undetected","status":"no-classification","progress":100,"data_source":"urlscan.io","permalink":"https://urlscan.io/","report_link":"https://urlscan.io/result/6e8c71c6-7c5b-4298-bf29-18dad08b701b/","extra_fields":[{"name":"percent","value":0}]}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"tactic":"Command and Control","technique":"Commonly Used Port","attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"iexplore.exe\" is protecting 8192 bytes with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.pki.goog\"\n \"o.ss2.us\"\n \"ocsp.rootg2.amazontrust.com\"\n \"ocsp.rootca1.amazontrust.com\"\n \"bittube.tv\"\n \"bittubeapp.com\"\n \"certify-js.alexametrics.com\"\n \"certify.alexametrics.com\"\n \"fonts.googleapis.com\"\n \"fonts.gstatic.com\"\n \"isrg.trustid.ocsp.identrust.com\"\n \"ocsp.int-x3.letsencrypt.org\"\n \"use.fontawesome.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"54.37.94.172:443\"\n \"205.185.216.42:80\"\n \"23.111.9.35:443\"\n \"172.217.164.138:443\"\n \"151.101.65.195:443\"\n \"142.250.73.227:80\"\n \"13.226.184.96:443\"\n \"172.217.2.99:443\"\n \"13.226.189.142:80\"\n \"13.226.189.177:80\"\n \"13.226.189.138:80\"\n \"13.226.184.62:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$25","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlblockindex_1_.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00064172-00002232) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" with commandline \"https://bittube.tv/post/45802f4c-c75e-416a-b1d5-415d957e6861\" (UID: 00064172-00002232)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2232 CREDAT:275457 /prefetch:2\" (UID: 00064205-00003672)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"iexplore.exe\" with commandline \"https://bittube.tv/post/45802f4c-c75e-416a-b1d5-415d957e6861\" (UID: 00064172-00002232)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2232 CREDAT:275457 /prefetch:2\" (UID: 00064205-00003672)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates new processes","description":"\"iexplore.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 896)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$26","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data 4776 bytes 1 file\"","origin":"Binary File","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$28","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/79 reputation engines marked \"http://o.ss2.us\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"level":"suspicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$29","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 54.37.94.172 on port 443 is sent without HTTP header\n TCP traffic to 205.185.216.42 on port 80 is sent without HTTP header\n TCP traffic to 23.111.9.35 on port 443 is sent without HTTP header\n TCP traffic to 172.217.164.138 on port 443 is sent without HTTP header\n TCP traffic to 151.101.65.195 on port 443 is sent without HTTP header\n TCP traffic to 142.250.73.227 on port 80 is sent without HTTP header\n TCP traffic to 13.226.184.96 on port 443 is sent without HTTP header\n TCP traffic to 172.217.2.99 on port 443 is sent without HTTP header\n TCP traffic to 13.226.189.142 on port 80 is sent without HTTP header\n TCP traffic to 13.226.189.177 on port 80 is sent without HTTP header\n TCP traffic to 13.226.189.138 on port 80 is sent without HTTP header\n TCP traffic to 13.226.184.62 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1043","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"$2a","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 3, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 3, Severity: 3) categorized as \"Unknown Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 13 domains and 13 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":68,"imported_dlls_count":133,"dropped_files_count":0,"extracted_files_count":88,"files_written_count":323,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":19,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":19,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":19,"dns_resolutions_count":13,"contacted_urls_count":8,"http_requests_count":8},"behavior_tags":["redirector"],"sample_flags":["Network Traffic","Extracted Files","User Comment","Decrypted SSL traffic"],"sandbox_reports":[{"id":"5f744863003f680a684e706e","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"contacted_countries":["FRA","GBR","USA"],"submit_name":"ef75252054db37365cb91d79f08e22883dc13cb008df2dc55c04e96b7bb224ad.url","analysis_start_time":"2020-09-30T08:57:17+00:00","indicators_count":{"informative":13,"suspicious":4,"malicious":0},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5f7448605b99bd30cc774754","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"suspicious","threat_score":35,"contacted_countries":["FRA","USA"],"submit_name":"ef75252054db37365cb91d79f08e22883dc13cb008df2dc55c04e96b7bb224ad.url","analysis_start_time":"2020-09-30T08:57:17+00:00","indicators_count":{"informative":13,"suspicious":5,"malicious":0},"tags":["Network Traffic","Extracted Files","User Comment","Decrypted SSL traffic"],"is_in_unified_schema":true},{"id":"5f74485fe6f42617d922166c","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"contacted_countries":["FRA","USA"],"submit_name":"ef75252054db37365cb91d79f08e22883dc13cb008df2dc55c04e96b7bb224ad.url","analysis_start_time":"2020-09-30T08:57:06+00:00","indicators_count":{"informative":12,"suspicious":5,"malicious":0},"tags":["Network Traffic","Extracted Files","User Comment","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"54.37.94.172","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"address":"205.185.216.42","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"address":"23.111.9.35","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"address":"172.217.164.138","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"address":"151.101.65.195","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"address":"142.250.73.227","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"address":"13.226.184.96","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"address":"172.217.2.99","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"address":"13.226.189.142","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"address":"13.226.189.177","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"address":"13.226.189.138","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"address":"13.226.184.62","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"address":"8.249.181.254","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"address":"23.63.75.193","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"address":"13.226.184.9","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"address":"13.226.189.120","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"address":"13.226.189.201","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"address":"51.143.111.81","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"address":"23.45.46.123","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]}],"dns_resolutions":[{"domain":"bittube.tv","address":"54.37.94.172","ttl":275,"country":"France","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"domain":"bittubeapp.com","address":"151.101.65.195","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"domain":"certify-js.alexametrics.com","address":"13.226.184.98","ttl":59,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"domain":"certify.alexametrics.com","address":"13.226.184.44","ttl":59,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"domain":"fonts.googleapis.com","address":"142.250.68.170","ttl":295,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"2005-01-25T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"domain":"fonts.gstatic.com","address":"172.217.1.131","ttl":126,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"2008-02-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"domain":"isrg.trustid.ocsp.identrust.com","address":"23.52.14.154","ttl":10,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"domain":"o.ss2.us","address":"13.226.189.142","ttl":59,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"domain":"ocsp.int-x3.letsencrypt.org","address":"23.52.14.137","ttl":4152,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"domain":"ocsp.pki.goog","address":"142.250.73.227","ttl":264,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"domain":"ocsp.rootca1.amazontrust.com","address":"13.226.189.138","ttl":38,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"domain":"ocsp.rootg2.amazontrust.com","address":"13.226.189.177","ttl":38,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"domain":"use.fontawesome.com","address":"23.111.9.35","ttl":689,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]}],"http_requests":[{"host":"ocsp.pki.goog","host_ip":"142.250.73.227:80","url":"/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D","method":"GET","header":"GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"host":"ocsp.pki.goog","host_ip":"142.250.73.227:80","url":"/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDqXuNQ97mPtAIAAAAAektt","method":"GET","header":"GET /gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDqXuNQ97mPtAIAAAAAektt HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"host":"o.ss2.us","host_ip":"13.226.189.142:80","url":"//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D","method":"GET","header":"GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: o.ss2.us","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"host":"ocsp.pki.goog","host_ip":"142.250.73.227:80","url":"/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEDM8p7YwCDvUCAAAAABXoPk%3D","method":"GET","header":"GET /gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEDM8p7YwCDvUCAAAAABXoPk%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"host":"ocsp.rootg2.amazontrust.com","host_ip":"13.226.189.177:80","url":"/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D","method":"GET","header":"GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.rootg2.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"host":"ocsp.rootca1.amazontrust.com","host_ip":"13.226.189.138:80","url":"/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D","method":"GET","header":"GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.rootca1.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"host":"ocsp.int-x3.letsencrypt.org","host_ip":"23.63.75.193:80","url":"/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgRIpoTtcV%2Fv9D7Zfd3XS%2FO8fQ%3D%3D","method":"GET","header":"GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgRIpoTtcV%2Fv9D7Zfd3XS%2FO8fQ%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.int-x3.letsencrypt.org","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"host":"isrg.trustid.ocsp.identrust.com","host_ip":"23.45.46.123:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D","method":"GET","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: isrg.trustid.ocsp.identrust.com","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}],"processes":[{"pid":3604,"ppid":0,"name":"rundll32.exe","command_line":"\"%WINDIR%\\System32\\ieframe.dll\",OpenURL C:\\ef75252054db37365cb91d79f08e22883dc13cb008df2dc55c04e96b7bb224ad.url","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00064000-00003604","icon":"$2b"},{"pid":2232,"ppid":3604,"name":"iexplore.exe","command_line":"https://bittube.tv/post/45802f4c-c75e-416a-b1d5-415d957e6861","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00064000-00003604","uid":"00064172-00002232"},{"pid":3672,"ppid":2232,"name":"iexplore.exe","command_line":"SCODEF:2232 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00064172-00002232","uid":"00064205-00003672"}],"all_imported_dlls":["jp2ssv.dll","wship6.dll","lpk.dll","slc.dll","ssv.dll","Wpc.dll","duser.dll","wevtapi.dll","URLREDIR.DLL","dxgi.dll","rasadhlp.dll","usp10.dll","KernelBase.dll","IPHLPAPI.DLL","winnsi.dll","WindowsCodecs.dll","wshqos.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","netprofm.dll","rsaenh.dll","setupapi.dll","kernel32.dll","dui70.dll","linkinfo.dll","iertutil.dll","urlmon.dll","devobj.dll","d2d1.dll","dnsapi.dll","cryptbase.dll","sxs.dll","imagehlp.dll","shlwapi.dll","xmllite.dll","cfgmgr32.dll","clbcatq.dll","nlaapi.dll","imm32.dll","ieui.dll","webio.dll","msvcr100.dll","wininet.dll","dwmapi.dll","propsys.dll","rpcss.dll","cryptsp.dll","msvcrt.dll","profapi.dll","mswsock.dll","comctl32.dll","sspicli.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","Wldap32.dll","samcli.dll","winhttp.dll","api-ms-win-downlevel-version-l1-1-0.dll","sqmapi.dll","ws2_32.dll","ntshrui.dll","ieproxy.dll","netutils.dll","mlang.dll","msimg32.dll","ntmarta.dll","SensApi.dll","deploy.dll","bcrypt.dll","sechost.dll","srvcli.dll","oleaccrc.dll","credssp.dll","d3d11.dll","msasn1.dll","mscoreei.dll","apphelp.dll","api-ms-win-downlevel-user32-l1-1-0.dll","gdi32.dll","shell32.dll","oleacc.dll","jscript9.dll","userenv.dll","api-ms-win-core-synch-l1-2-0.dll","gpapi.dll","normaliz.dll","oleaut32.dll","user32.dll","bcryptprimitives.dll","uxtheme.dll","schannel.dll","FWPUCLNT.DLL","ncrypt.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","rpcrt4.dll","crypt32.dll","advapi32.dll","version.dll","ieframe.dll","ole32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","secur32.dll","IEShims.dll","comdlg32.dll","mshtml.dll","DWrite.dll","dhcpcsvc6.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","wkscli.dll","ExplorerFrame.dll","msvcr90.dll","RpcRtRemote.dll","cryptnet.dll","nsi.dll","netapi32.dll","samlib.dll","msimtf.dll","d3d10warp.dll","npmproxy.dll","wintrust.dll","UIAnimation.dll","cscapi.dll","mscorwks.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","msctf.dll","WSHTCPIP.DLL","mscoree.dll","dhcpcsvc.dll","MSOHEV.DLL","actxprxy.dll","VxSSL64.dll","wow64win.dll","wow64.dll","wow64cpu.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"B5LX0I8I.txt","sha256":"c05939fc5f02109e43306044877f97f8971e88d3cf541f4af7063136d77ece9f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"L5EF98WC.txt","sha256":"c1c08d0985ebcaf10364eb4a9ec23e48d911129cfca22cc3601d32ff3fc3ad2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"OLIE8QSI.txt","sha256":"d3fca97dd4cfa952dc5740f6b447443060c6314a190a56035e0dfe366fceed2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"POUX099H.txt","sha256":"bd7962ebe90904d5cdaeb557c82986154148f464f4db6a298d12c5d6a5f81133","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"44E0OSZLLTD6EYQ12JJM.temp","sha256":"faf464279376e1abb3731de85f6e87dda3be8cf2b0984eee9316ca9d69ee0104","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"en-US.3","sha256":"c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"imagestore.dat","sha256":"d84c40920fc2b6bf2e1b58063271cb586bf920c1a36310940baeda254bd49bea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"0917D36B5BCB9859D72A7EF4EC0350ED","sha256":"c03045d679719d6b531a320806410326a1be64860c2db588da67b1421ea65ca6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sha256":"1730d1e535ea528ae6a498fb91728d82bdfde4b221e0ff7cd8aae6f6733ada39","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sha256":"88aba492f4950c7ae7b4e616fea36c74aafbbbc0803ae16d17defaff412a6db0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F","sha256":"bcae26d8650a27e9a77e10c24c5b1e7167417e7a7f618d910b4bd756cc2f890d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62","sha256":"ab1979761ea0c74bef7008541917c9bbea87009f2586903ce1311b482e1ed452","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894","sha256":"8b205e65feebdafc11f866e2fd99ea50fc4991fa6dc60d39ad31e665a48dc560","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sha256":"b936c8ec46fdce7817d6f970894cd782864837770fbf449d59599aecb41085ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08","sha256":"e097553550d5fc623c5ef334d0ed27bd29befedd25927556d934364e56a22a69","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"61d2e49d89dc0e3fba71c50a65c82aedd45d4630c192160c1793c949144cd5d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sha256":"790950f6dd322b6744556a97fb7f398ea54fc45caf6b5908a5c9263e45053305","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"CC197601BE0898B7B0FCC91FA15D8A69_B692386BB395D0D1B54DEE15DF22E03C","sha256":"a9536fd50c263e7a706263f426503d44eed49cab34c8e1e46e46f485a682f8b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"CC197601BE0898B7B0FCC91FA15D8A69_F6B3190C3680C3E0B5B932C2525D14C7","sha256":"04395020ac5eabc140e689f047782c3d087973d0c2d0525fbbe1981ac43019b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"JavaDeployReg.log","sha256":"45cb881f78c3c79aaf69209e30e52000d9cb99f5655324290c0838fb20338d8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"~DF4F7555D88E0EDF5F.TMP","sha256":"004b7df0f0a074b860470c5b51446967e7aa3ccb52320ce8269ed09fabf04404","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"~DF7894FB4E3A8914C6.TMP","sha256":"a085ea043ec1c957457f20bbf160de88c6a3e79b686c89ff423f1dd3ff2c5a42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"~DF7D4F38E855893BAE.TMP","sha256":"c59fa2f1b1c6fa06cc3c55ea4503cdec19719bc4928c9cfbbb0cf54a877a0ac1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"~DF9C0AA4965952A17F.TMP","sha256":"eb2818b0a6c39558f12b59bbeba7af03ad74eda9091c8da12df5f869f862d7f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"~DFEB5420B8A6FF97FE.TMP","sha256":"9f3c6059460d876a88b86fb4172c4b35a0a4337624a5d65eb2f593e5eed5b5ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"font-awesome.min_1_.css","sha256":"799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"vendors_1_.js","sha256":"999c61e564c46ef45ba763eac3c98aba1187264bc0fd32e17683e870ad49619c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"css_3_.css","sha256":"01c0b1456ae28074c628fac49894289af59c079e6e02822e37f809ab8cd123c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"main_1_.js","sha256":"075177caa0af4ddf818767827d83537e8e5a4bbe297066ac425641af5a88a71d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"favicon_2_.ico","sha256":"6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"favicon_1_.ico","sha256":"0af719221b600a5e8907edda7322bf1140388f962e4bf5b12f659d2a18e1d03c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"bittube_1_.xml","sha256":"021a5868b6c9e8beba07848ba30586c693f87ac02ee2ccaa0f26b7163c0c6b44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"css_2_.css","sha256":"062fe59f31246f74e731529f9b3a62b0ddbe3cf8644ea1fb842632bb176b068a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"search__0633EE93-D776-472f-A0FF-E1416B8B2E3A_.ico","sha256":"6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"mem5YaGs126MiZpBA-UN7rgOUuhv_1_.woff","sha256":"ea20e5db3ba915c503173fae268445fc2745fc9a5dce2f58d47f5a355e1cdb18","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"RecoveryStore._6AA58AAF-02EA-11EB-9A7F-080027D6C473_.dat","sha256":"1f52f5cbc561ef9bd60980858df177a018025e5a235a7f2ed7f4aca89ad73114","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"45802f4c-c75e-416a-b1d5-415d957e6861_1_.htm","sha256":"3ffc2fddebc58b6c8c9832ba09472d85b493f83ac24a20872a89e9f231a18ffc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"RecoveryStore._88B090C0-D917-11E7-B67B-080027A49DD6_.dat","sha256":"de315c2616bd24a4dcf92ba067ceaa4b2ecc568312200bfa064252a95bb86aad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"styles_1_.css","sha256":"06fe16fd0760410ba6e7e9c93510d8f61b564054db1473fd39598dfa0734fe10","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"runtime_1_.js","sha256":"ac20405da0c04aea5ed7fc5f5e5046a47f196f9d2d5ed62da866d5e963d659d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"favicon_3_.ico","sha256":"6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"atrk_1_.js","sha256":"90451ba3e82cd9db02f0ca76bd45d0ab5ef7e90a49da4215903cb7f08471e2e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"icon_1_.css","sha256":"02499940bf505711e8fde591f5735c9226d5d74f7e3b2f63744671a1b2e6d0d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"search_1_.json","sha256":"19170bd75edc0b5183a2f9fcc3001d9d222deff61e5915ad1127b65ab581a2a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"atrk_1_.gif","sha256":"89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"KFOmCnqEu92Fr1Mu4mxM_1_.woff","sha256":"c1dc87f99c7ff228806117d58f085c6c573057fa237228081802b7d8d3cf7684","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"_732D74B6-02EA-11EB-9A7F-080027D6C473_.dat","sha256":"1e72798758cc9d40b64c10cd63ac1ff92e01030a4197458f7d182ad2e391818d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"mem5YaGs126MiZpBA-UNirkOUuhv_1_.woff","sha256":"57c79375b1419ee1d984f443cda77c04b9b38c0be5330b2d41d65103115ffd72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"_1C687EF4-02EB-11EB-9A7F-080027D6C473_.dat","sha256":"a888510fa5e8a08e725c910170b66478c7b673e0769fae3901ec09fb30721a0b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"08PVZLPA.txt","sha256":"ddd8cb318e143dea3f0a4f5e39ecc18da2187f2247ac0577708e4be5b43a4e7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"1416DA7E.txt","sha256":"8d5c7f534b43912c1b8c35aba3980b401b4c9d6c8f7f1d32addd1278a1a23619","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"H7GG7AN4.txt","sha256":"7115ee73706dc3bb847b8bf7a6005024188a5fd74ea33169bb8e3b6b8cd946fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"HSY3BKJY.txt","sha256":"ea89a472be29e8c44ebd666b80f3b7928213bf667b299b50cb56bce328a5296f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"XMBYAPZFU2VZUIO0NCLY.temp","sha256":"458fb8b9879da548ceae8076e4f033982cc1b22d359bdce08649f9b12df7b97c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"~DF221C5D23C4B6BB52.TMP","sha256":"442cd9a976299e2135f003d1a25f5b17942d11b3bd19923864c41a4c78965a7f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"~DF4E0187DB25DC47B6.TMP","sha256":"1ba93bf0397faa8e4dae253dd4803b0bc586d08cf0c82581098ec2e9181290e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"~DF9218975591C37149.TMP","sha256":"1c25d55d9d889fe635e38344d1e59f34972033bf3104190bf456b17339e94f15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"~DFC41B0CB72E36FEE7.TMP","sha256":"4e8b733f9c2630ca51de3978ce678757d3aa74293912d93bb5d2702a0e9f6835","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"_654729DF-02EA-11EB-A5A6-080027E92419_.dat","sha256":"c381a0cdff3d4065a4e0b283b9d4abfa2fdce347ceb8cb66237ad4d0e49ca6c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"all_1_.css","sha256":"cfac6241dd3aabb5f1552c17501790093015c006a8e13671823c1ff4872beaae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"airtime.loader_1_.js","sha256":"024f946aa917f343007b63231879498ff29d2389042f6db7e2f7f448b017282b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"RecoveryStore._654729DD-02EA-11EB-A5A6-080027E92419_.dat","sha256":"003614ed9d0270db73a5cec34760d47a58508be0815a9a8dfb8a88b87d376ca4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"css_1_.css","sha256":"062fe59f31246f74e731529f9b3a62b0ddbe3cf8644ea1fb842632bb176b068a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"_6F1F3F76-02EA-11EB-A5A6-080027E92419_.dat","sha256":"cec1484137d3189a9c68b23741e624478587dc83db60708f589e12c03cf86952","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"mem8YaGs126MiZpBA-UFVZ0d_1_.woff","sha256":"81f0ec27796225ea29f9f1c7b74f083edcd7bc97a09d5fc4e8d03c0134e62445","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"05G9F6OP.txt","sha256":"83c309c41eae1f8033bc70fb015b53aff188e0fb4a978f7a1f6a632301abc03d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"4YAR8E3N.txt","sha256":"d4f12696aeae590a44666a5f10f960892d7556f67d8a6af4a9307ef08350649b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"ACWPR8QN.txt","sha256":"f7cb087c429ed854bd645fbca25694c46378470ee7f6cacb7f2e7def0d4b2ee2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"D0FSGRUY.txt","sha256":"0f410692a3b747e2e72db6370b98c674c0019f496feda88a7a2c635b3644cdc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"DQK4D7YN.txt","sha256":"11502f318b46bc8985f19f984aca6a473d78cbedf91c0a33f75be7eef5005990","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"JY8NZ81M.txt","sha256":"bc8cd4298703787e8c496d10cc1d1c99f5d13a6c4c087b1f5341a32a8fa0d141","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"QXN431R7.txt","sha256":"53a7de81730de1c43c4461ac641a936ad48e0117b5b20e74f8d9571759337564","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"8IWU7PQ9RCEP7T9JRUHY.temp","sha256":"5c3bd4028a886b7c4ea1d3155057cd552c90b074fd853144a1158d5a66d78414","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"en-US.4","sha256":"c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"~DF16443BE3306BF144.TMP","sha256":"91a4b979d5ec90b8668663ddd4aa80a8467a92de03aa01bae2b13c1b7936dec0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"~DF56AC83E385EB653C.TMP","sha256":"4fd5d7ab91be1c5e64b0db7759e700de3c9cd92b7b302cc0fb9b057da4ebe77d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"~DF8572503F83622E6E.TMP","sha256":"3d66f5ba47d28c1cbbe01c19aaec900a785478f21d9f8bcc50231c264f36ed75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"~DF86C9870270A9F58A.TMP","sha256":"3d0be145d75bef90db6b26203694c9912a8b7759a134d806b90dc478fc9a7e9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"~DFD556007109B3DA7A.TMP","sha256":"6a4fa800e5a2f18bdf1e1a19a715c4024048bc1ffa215f89f310d0b4b6efca6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"favicon_4_.ico","sha256":"0af719221b600a5e8907edda7322bf1140388f962e4bf5b12f659d2a18e1d03c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"main_3_.js","sha256":"075177caa0af4ddf818767827d83537e8e5a4bbe297066ac425641af5a88a71d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"favicon_5_.ico","sha256":"6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"RecoveryStore._C7A4F1AE-D920-11E7-B48D-080027D44A30_.dat","sha256":"38e73163d0b0015a968633fd14feb9154cacee2b92431a7169d54143624cf2a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"css_4_.css","sha256":"01c0b1456ae28074c628fac49894289af59c079e6e02822e37f809ab8cd123c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"_4F5BC833-02EA-11EB-8E31-080027C0A4A0_.dat","sha256":"e576acf931cdf6362cc5259954e62046f094e56e253182f9ce5784255063a2f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"RecoveryStore._4F5BC831-02EA-11EB-8E31-080027C0A4A0_.dat","sha256":"d60c4c3cbcbb12c199bad9e78cc0c2d7510872dbba3c0cdc79b332d4ab8e1523","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"_78ECE6F6-02EB-11EB-8E31-080027C0A4A0_.dat","sha256":"10763b37727846fa1e969e7004f68e13fd37380b10404d25c8cb5266ec6c3ff3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException\\Low","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_151\\lib\\plugin.jar","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%WINDIR%\\System32\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{6AA58AB1-02EA-11EB-9A7F-080027D6C473}.dat","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%TEMP%\\~DFEB5420B8A6FF97FE.TMP","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\System32\\Macromed\\Flash\\Flash32_27_0_0_187.ocx","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0917D36B5BCB9859D72A7EF4EC0350ED","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\0917D36B5BCB9859D72A7EF4EC0350ED","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%TEMP%\\~pnbfddc.tmp","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\airtime.loader[1].js","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_5FA8E5E800867BF860DF5E533E701BAF","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\85B3F147E3624A14E6A20DB4F6C2C5D9","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\all[1].css","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\vendors[1].js","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\main[1].js","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CC197601BE0898B7B0FCC91FA15D8A69_F6B3190C3680C3E0B5B932C2525D14C7","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\css[3].css","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{6AA58AAF-02EA-11EB-9A7F-080027D6C473}.dat","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\HVI1ZDNF\\bittube[1].xml","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC197601BE0898B7B0FCC91FA15D8A69_B692386BB395D0D1B54DEE15DF22E03C","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC197601BE0898B7B0FCC91FA15D8A69_7C2A746A9F00A493EC968C354A78B302","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\mem5YaGs126MiZpBA-UN7rgOUuhv[1].woff","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\mem8YaGs126MiZpBA-UFVZ0d[1].woff","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[2].ico","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[3].ico","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\atrk[1].gif","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{732D74B6-02EA-11EB-9A7F-080027D6C473}.dat","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%TEMP%\\~DF9C0AA4965952A17F.TMP","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\NIFFDOLS.txt","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\urlblockindex[1].bin","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_49FC544F04082FD9F64F9EFB226AF8B5","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\VG8BU31O.txt","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\IYXGE11F.txt","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HGEILYKK.txt","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\L5EF98WC.txt","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\OLIE8QSI.txt","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\search[1].json","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%TEMP%\\~DF7894FB4E3A8914C6.TMP","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\UrlBlockManager\\urlblocklist.bin","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Low","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Tracking Protection","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\TabRoaming","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\PlayReady","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache\\Low","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%TEMP%\\Low","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%TEMP%\\~DF7D4F38E855893BAE.TMP","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%WINDIR%\\System32\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\System32\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\URLREDIR.DLL","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"C:\\ef75252054db37365cb91d79f08e22883dc13cb008df2dc55c04e96b7bb224ad.url","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_151\\bin\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"C:\\https:\\bittube.tv\\post\\45802f4c-c75e-416a-b1d5-415d957e6861","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E49827401028F7A0F97B5576C77A26CB_C95AFE779A09B6B8C03D47AD8998ACC3","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\644B8874112055B5E195ECB0E8F243A4","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\294D4F6B014DE801039471A29FBE28BF","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\B5LX0I8I.txt","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\45802f4c-c75e-416a-b1d5-415d957e6861[1].htm","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_1374AC543829516A5CA56081CD00C32A","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\69C6F6EC64E114822DF688DC12CDD86C","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6DB145CFEEC544B1582FED1ADA3370DD","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\font-awesome.min[1].css","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\runtime[1].js","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\styles[1].css","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC197601BE0898B7B0FCC91FA15D8A69_F6B3190C3680C3E0B5B932C2525D14C7","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC197601BE0898B7B0FCC91FA15D8A69_C6F0BB424596C87E952214FC74B71826","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC4FEA46495CA161D470CD085EDBAADE","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\css[1].css","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\css[2].css","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\icon[1].css","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\CI1NEHIQ.txt","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3S9Q96YC.txt","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B66240B0F6C84BD4857ABA60CF5CE4A0_F03A28002BA04D67D40293EB07685203","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6A2279C2CA42EBEE26F14589F0736E50","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\System32\\en-US\\jscript9.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_A7A8E86FCB076C144BD04C40841E7074","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\82CB34DD3343FE727DF8890D352E0D8F","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BAD725C80F9E10846F35D039A996E4A8_01BD2FE9C7DF0143054864DFB0B10442","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BCB67D7ECB470284AF35679F339E879F","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CC197601BE0898B7B0FCC91FA15D8A69_B692386BB395D0D1B54DEE15DF22E03C","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\mem5YaGs126MiZpBA-UNirkOUuhv[1].woff","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\KFOmCnqEu92Fr1Mu4mxM[1].woff","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\favicon[1].png","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\favicon[2].png","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\75CA58072B9926F763A91F0CC2798706_0241374F35FAA6F6819A32A1ABF08ACF","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\620BEF1064BD8E252C599957B3C91896","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\atrk[1].js","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000027.db","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\imagestore\\3mt7jhv\\imagestore.dat","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe.config","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\suggestions[1].en-US","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.3","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.2","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\POUX099H.txt","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Last Active\\RecoveryStore.{88B090C0-D917-11E7-B67B-080027A49DD6}.dat","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%TEMP%\\~DF4F7555D88E0EDF5F.TMP","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Last Active","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Last Active\\{1C687EF4-02EB-11EB-9A7F-080027D6C473}.dat","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%WINDIR%\\System32\\en-US\\oleaccrc.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%PROGRAMFILES%\\Internet Explorer","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%TEMP%\\~DF290300FBF5739B8F.TMP","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\44E0OSZLLTD6EYQ12JJM.temp","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF120855.TMP","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{654729DD-02EA-11EB-A5A6-080027E92419}.dat","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[2].png","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[3].png","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[4].png","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[5].png","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{6F1F3F76-02EA-11EB-A5A6-080027E92419}.dat","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%TEMP%\\~DF221C5D23C4B6BB52.TMP","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\H7GG7AN4.txt","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\styles[1].css","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\urlblockindex[1].bin","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\mem5YaGs126MiZpBA-UNirkOUuhv[1].woff","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\KFOmCnqEu92Fr1Mu4mxM[1].woff","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\mem8YaGs126MiZpBA-UFVZ0d[1].woff","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\atrk[1].js","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\atrk[1].gif","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\08PVZLPA.txt","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\1416DA7E.txt","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\search[1].json","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%TEMP%\\~DF9218975591C37149.TMP","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF120fb7.TMP","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%TEMP%\\~DF4E0187DB25DC47B6.TMP","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{654729DF-02EA-11EB-A5A6-080027E92419}.dat","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%TEMP%\\~DFC41B0CB72E36FEE7.TMP","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[1].png","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[6].png","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[7].png","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[8].png","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%TEMP%\\~DFCEFF86C12756509E.TMP","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\XMBYAPZFU2VZUIO0NCLY.temp","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%TEMP%\\~cyzqcxi.tmp","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\mem5YaGs126MiZpBA-UN7rgOUuhv[1].woff","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HSY3BKJY.txt","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%TEMP%\\~DFD556007109B3DA7A.TMP","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[5].ico","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\6CY2NG59.txt","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\24I82KXY.txt","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[2].ico","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[3].ico","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[4].ico","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[5].ico","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon4BJNM8JY.png","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{592CB6BC-02EA-11EB-8E31-080027C0A4A0}.dat","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%TEMP%\\~DF86C9870270A9F58A.TMP","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JY8NZ81M.txt","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%TEMP%\\~lvxheic.tmp","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\ZAC5QEAJ\\font-awesome.min[1].css","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\H3XVNPGD\\runtime[1].js","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\P6QSO9MS\\all[1].css","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\vendors[1].js","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\icon[1].css","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EKCX8E9R\\KFOmCnqEu92Fr1Mu4mxM[1].woff","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EKCX8E9R\\mem8YaGs126MiZpBA-UFVZ0d[1].woff","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\1C8Y98H0\\atrk[1].gif","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MXWNV8XG\\favicon[4].ico","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\imagestore\\js9ur7b\\imagestore.dat","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\QXN431R7.txt","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\D0FSGRUY.txt","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\WNMJ3S0T.txt","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\search[1].json","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Last Active\\{78ECE6F6-02EB-11EB-8E31-080027C0A4A0}.dat","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%TEMP%\\~DF16443BE3306BF144.TMP","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\en\\IEXPLORE.EXE.mui","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{4F5BC831-02EA-11EB-8E31-080027C0A4A0}.dat","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%TEMP%\\~DF56AC83E385EB653C.TMP","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{4F5BC833-02EA-11EB-8E31-080027C0A4A0}.dat","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\System32\\Macromed\\Flash\\Flash64_27_0_0_187.ocx","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\DQK4D7YN.txt","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\05G9F6OP.txt","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[1].png","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[2].png","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[3].png","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[4].png","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[5].png","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[6].png","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[7].png","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[8].png","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[9].png","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[10].png","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon5Z6WGS6R.png","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YRECD7ZI.txt","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\urlblockindex[1].bin","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\3K0JAKI5\\suggestions[1].en-US","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.4","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ACWPR8QN.txt","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4YAR8E3N.txt","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Last Active\\RecoveryStore.{C7A4F1AE-D920-11E7-B48D-080027D44A30}.dat","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%TEMP%\\~DF8572503F83622E6E.TMP","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%TEMP%\\~DF9A01832549F2B603.TMP","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\8IWU7PQ9RCEP7T9JRUHY.temp","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF124251.TMP","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%PROGRAMFILES(X86)%\\MICROS~2\\Office14\\URLREDIR.DLL","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_151\\lib\\plugin.jar","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_151\\bin\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\SysWOW64\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\SysWOW64\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\ieproxy.dll","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\45802f4c-c75e-416a-b1d5-415d957e6861[1].htm","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VTO935KS\\airtime.loader[1].js","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\ZAC5QEAJ\\styles[1].css","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\H3XVNPGD\\main[1].js","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\H3XVNPGD\\main[2].js","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\H3XVNPGD\\main[3].js","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\css[1].css","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\css[2].css","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\css[3].css","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2M2KC0IU\\css[4].css","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\PU4P3OOW\\bittube[1].xml","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\jscript9.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EKCX8E9R\\mem5YaGs126MiZpBA-UNirkOUuhv[1].woff","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\EKCX8E9R\\mem5YaGs126MiZpBA-UN7rgOUuhv[1].woff","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\4KBMQIHU\\atrk[1].js","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\SysWOW64\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MXWNV8XG\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MXWNV8XG\\favicon[2].ico","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MXWNV8XG\\favicon[3].ico","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{00000000-0000-0000-0000-000000000000}\\{00000000-0000-0000-0000-000000000000}","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TABBEDBROWSING\\NEWTABPAGE\\MFV\\MFV","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\E6A3B45B062D509B3382282D196EFE97D5956CCB\\E6A3B45B062D509B3382282D196EFE97D5956CCB","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\LOWREGISTRY\\ADDTOFAVORITESINITIALSELECTION\\ADDTOFAVORITESINITIALSELECTION","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\LOWREGISTRY\\ADDTOFEEDSINITIALSELECTION\\ADDTOFEEDSINITIALSELECTION","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4\\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2232","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_8b8_IE_EarlyTabStart_0xba4_Mutex","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_8b8_ConnHashTable<2232>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_8b8_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_8b8_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"Local\\InternetShortcutMutex","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"IsoScope_8b8_IE_EarlyTabStart_0xba4_Mutex","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2232","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"IsoScope_8b8_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"IsoScope_8b8_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"IsoScope_8b8_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"IsoScope_8b8_ConnHashTable<2232>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_8b8_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"IsoScope_8b8_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"Local\\https://bittube.tv/","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_8b8_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\https://bittube.tv/","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5f7448605b99bd30cc774754"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_c88_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"IsoScope_c88_ConnHashTable<3208>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"IsoScope_c88_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"IsoScope_c88_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"},{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"IsoScope_c88_IE_EarlyTabStart_0xff0_Mutex","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3208","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"IsoScope_c88_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3208","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_c88_IE_EarlyTabStart_0xff0_Mutex","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_c88_ConnHashTable<3208>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_c88_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_c88_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_c88_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"IsoScope_c88_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5f74485fe6f42617d922166c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_990_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"IsoScope_990_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"IsoScope_990_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"IsoScope_990_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2448","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"IsoScope_990_IE_EarlyTabStart_0xcd0_Mutex","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"IsoScope_990_ConnHashTable<2448>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2448","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_990_IE_EarlyTabStart_0xcd0_Mutex","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_990_ConnHashTable<2448>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_990_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_990_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]},{"name":"IsoScope_990_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5f744863003f680a684e706e"}]}]}},"report_ids":{"sandbox_job_ids":["5f744863003f680a684e706e","5f7448605b99bd30cc774754","5f74485fe6f42617d922166c"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Suspicious Sample ef75252054db… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample ef75252054db…. Threat score 35/100. 0/3 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ef75252054db37365cb91d79f08e22883dc13cb008df2dc55c04e96b7bb224ad"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample ef75252054db… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample ef75252054db…. Threat score 35/100. 0/3 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ef75252054db37365cb91d79f08e22883dc13cb008df2dc55c04e96b7bb224ad"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample ef75252054db… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample ef75252054db…. Threat score 35/100. 0/3 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]