26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 58:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T48a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 1d2968648d8e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1d2968648d8e…. Malware family: Trojan.Generic. Threat score 100/100. 21/29 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","assembly","executable"],"identifier":"1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":21,"total":29},"behavioralIndicators":{"malicious":6,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tdaa,"" queries volume information of "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll" at 00014031-00002452-0000010C-39235316 "" queries volume information of "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll" at 00014031-00002452-0000010C-39235435 "" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00014031-00002452-0000010C-39469801 "" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00014031-00002452-0000010C-39469991 "" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll" at 00014031-00002452-0000010C-39564905 "" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll" at 00014031-00002452-0000010C-39565003 "" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00014031-00002452-0000010C-39654797 "" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00014031-00002452-0000010C-39654907 "" queries volume information of "%WINDIR%\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00014031-00002452-0000010C-39807705 "" queries volume information of "%WINDIR%\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00014031-00002452-0000010C-39807783 "SpotifyWebHelper.exe" queries volume information of "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll" at 00014932-00000440-0000010C-41697720 "SpotifyWebHelper.exe" queries volume information of "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll" at 00014932-00000440-0000010C-41697831 "SpotifyWebHelper.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00014932-00000440-0000010C-41900140 "SpotifyWebHelper.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00014932-00000440-0000010C-41900292 "SpotifyWebHelper.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll" at 00014932-00000440-0000010C-41988313 "SpotifyWebHelper.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll" at 00014932-00000440-0000010C-41988450 "SpotifyWebHelper.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00014932-00000440-0000010C-42081686 "SpotifyWebHelper.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00014932-00000440-0000010C-42081830 "SpotifyWebHelper.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00014932-00000440-0000010C-42220545 "SpotifyWebHelper.exe" queries volume information of "%WINDIR%\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00014932-00000440-0000010C-4222067028:T8cc,"AcroRd32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "AcroRd32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "AcroRd32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "AcroRd32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "AcroRd32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "AcroRd32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: "CERTIFICATES") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\BE36A4562FB2EE05DBB3D32323ADF445084ED656"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\CDD4EEAE6000AC7F40C3802C171E30148030C072"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\02FAF3E291435468607857694DF5E45B68851868"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\039EEDB80BE7A03C6953893B20D2D9323A4C2AFD"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\07E032E020B72C3F192F0628A2593A19A70F069E"; Key: "BLOB")29:Ta08,Process "AcroRd32.exe" (UID: 00014643-00001536) was launched with new environment variables: "MEOW="%PROGRAMFILES%\Adobe\Reader 11.0\Reader\"" Process "SpotifyWebHelper.exe" (UID: 00014932-00000440) was launched with missing environment variables: "MEOW" Process "AcroRd32.exe" (UID: 00015537-00003024) was launched with new environment variables: "MEOW="%PROGRAMFILES%\Adobe\Reader 11.0\Reader\"" Process "SpotifyWebHelper.exe" (UID: 00015841-00003292) was launched with missing environment variables: "MEOW" Process "AcroRd32.exe" (UID: 00016476-00003324) was launched with new environment variables: "MEOW="%PROGRAMFILES%\Adobe\Reader 11.0\Reader\"" Process "SpotifyWebHelper.exe" (UID: 00016766-00002468) was launched with missing environment variables: "MEOW" Process "AcroRd32.exe" (UID: 00017318-00002700) was launched with new environment variables: "MEOW="%PROGRAMFILES%\Adobe\Reader 11.0\Reader\"" Process "SpotifyWebHelper.exe" (UID: 00017606-00004000) was launched with missing environment variables: "MEOW" Process "AcroRd32.exe" (UID: 00018199-00002728) was launched with new environment variables: "MEOW="%PROGRAMFILES%\Adobe\Reader 11.0\Reader\"" Process "SpotifyWebHelper.exe" (UID: 00018483-00003376) was launched with missing environment variables: "MEOW" Process "AcroRd32.exe" (UID: 00019128-00002640) was launched with new environment variables: "MEOW="%PROGRAMFILES%\Adobe\Reader 11.0\Reader\"" Process "SpotifyWebHelper.exe" (UID: 00019410-00002612) was launched with missing environment variables: "MEOW" Process "AcroRd32.exe" (UID: 00020113-00002988) was launched with new environment variables: "MEOW="%PROGRAMFILES%\Adobe\Reader 11.0\Reader\"" Process "SpotifyWebHelper.exe" (UID: 00020402-00004052) was launched with missing environment variables: "MEOW" Process "AcroRd32.exe" (UID: 00021198-00000984) was launched with new environment variables: "MEOW="%PROGRAMFILES%\Adobe\Reader 11.0\Reader\"" Process "SpotifyWebHelper.exe" (UID: 00021449-00003428) was launched with missing environment variables: "MEOW" Process "AcroRd32.exe" (UID: 00022295-00002444) was launched with new environment variables: "MEOW="%PROGRAMFILES%\Adobe\Reader 11.0\Reader\"" Process "SpotifyWebHelper.exe" (UID: 00022574-00001048) was launched with missing environment variables: "MEOW" Process "AcroRd32.exe" (UID: 00023543-00002932) was launched with new environment variables: "MEOW="%PROGRAMFILES%\Adobe\Reader 11.0\Reader\"" Process "SpotifyWebHelper.exe" (UID: 00023839-00003560) was launched with missing environment variables: "MEOW"2a:T9f2,"/c mkdir "%APPDATA%\Spotify\SpotifyWebHelper"" on 2017-7-15.15:33:17.430 "/c copy /Y /B "C:\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.exe" "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" on 2017-7-15.15:33:17.500, "/c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs" on 2017-7-15.15:33:17.580 "/c "%APPDATA%\Spotify\SpotifyWebHelper\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.pdf" on 2017-7-15.15:33:17.730, "/c ping 127.0.0.1 -n 3 && "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" on 2017-7-15.15:33:17.740 "/c mkdir "%APPDATA%\Spotify\SpotifyWebHelper"" on 2017-7-15.15:34:45.822 "/c copy /Y /B "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" on 2017-7-15.15:34:45.962, "/c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs" on 2017-7-15.15:34:46.252 "/c "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.pdf" on 2017-7-15.15:34:46.432, "/c ping 127.0.0.1 -n 3 && "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" on 2017-7-15.15:34:46.573 "/c mkdir "%APPDATA%\Spotify\SpotifyWebHelper"" on 2017-7-15.15:35:35.405 "/c copy /Y /B "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" on 2017-7-15.15:35:35.586, "/c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs" on 2017-7-15.15:35:35.766 "/c "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.pdf" on 2017-7-15.15:35:35.976, "/c ping 127.0.0.1 -n 3 && "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" on 2017-7-15.15:35:36.096 "/c mkdir "%APPDATA%\Spotify\SpotifyWebHelper"" on 2017-7-15.15:37:03.437 "/c copy /Y /B "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" on 2017-7-15.15:37:03.747, "/c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs" on 2017-7-15.15:37:03.958 "/c "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.pdf" on 2017-7-15.15:37:04.208, "/c ping 127.0.0.1 -n 3 && "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" on 2017-7-15.15:37:04.3482b:Tc3b,Spawned process "cmd.exe" with commandline "/c mkdir "%APPDATA%\Spotify\SpotifyWebHelper"" (UID: 00014568-00002620) Spawned process "cmd.exe" with commandline "/c copy /Y /B "C:\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.exe" "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" (UID: 00014577-00003976), Spawned process "cmd.exe" with commandline "/c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs" (UID: 00014585-00003940) Spawned process "reg.exe" with commandline ""REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs""" (UID: 00014589-00003728) Spawned process "cmd.exe" with commandline "/c "%APPDATA%\Spotify\SpotifyWebHelper\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.pdf" (UID: 00014596-00002692), Spawned process "cmd.exe" with commandline "/c ping 127.0.0.1 -n 3 && "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" (UID: 00014600-00003420) Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00014610-00002908) Spawned process "AcroRd32.exe" with commandline ""%APPDATA%\Spotify\SpotifyWebHelper\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.pdf" (UID: 00014643-00001536), Spawned process "SpotifyWebHelper.exe" (UID: 00014932-00000440), Spawned process "cmd.exe" with commandline "/c mkdir "%APPDATA%\Spotify\SpotifyWebHelper"" (UID: 00015407-00001804), Spawned process "cmd.exe" with commandline "/c copy /Y /B "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" (UID: 00015422-00002648) Spawned process "cmd.exe" with commandline "/c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs" (UID: 00015451-00002592), Spawned process "reg.exe" with commandline ""REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs""" (UID: 00015455-00002524), Spawned process "cmd.exe" with commandline "/c "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.pdf" (UID: 00015468-00002528) Spawned process "cmd.exe" with commandline "/c ping 127.0.0.1 -n 3 && "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" (UID: 00015477-00002708), Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00015506-00002268), Spawned process "AcroRd32.exe" with commandline ""%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.pdf" (UID: 00015537-00003024) Spawned process "SpotifyWebHelper.exe" (UID: 00015841-00003292) Spawned process "cmd.exe" with commandline "/c mkdir "%APPDATA%\Spotify\SpotifyWebHelper"" (UID: 00016363-00003820) Spawned process "cmd.exe" with commandline "/c copy /Y /B "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" (UID: 00016382-00003616)2c:T50c,"" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\machine.config" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "" touched file "%WINDIR%\assembly\NativeImages_v2.0.50727_32\index23b.dat"2d:T6a2,Process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00014610-00002908) Process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00015506-00002268) Process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00016445-00003404) Process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00017283-00002856) Process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00018161-00002672) Process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00019085-00003364) Process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00020066-00003468) Process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00021122-00003168) Process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00022245-00001896) Process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00023498-00002568) Process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00024794-00003316) Process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00026471-00002492) Process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00027880-00001024) Process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00029466-00002656) Process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00031145-00000320) Process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00032922-00003576) Process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00034696-00003748) Process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00036736-00001728) Process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00038761-00000272) Process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00040833-00001836)2e:Taf2,"" opened "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.2452.3741793" with delete access "" opened "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.2452.3741793" with delete access "" opened "%APPDATA%\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2452.3741863" with delete access "SpotifyWebHelper.exe" opened "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.440.1570674785" with delete access "SpotifyWebHelper.exe" opened "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.440.1570674785" with delete access "SpotifyWebHelper.exe" opened "%APPDATA%\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.440.1570674825" with delete access "SpotifyWebHelper.exe" opened "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.3292.3137548778" with delete access "SpotifyWebHelper.exe" opened "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.3292.3137548778" with delete access "SpotifyWebHelper.exe" opened "%APPDATA%\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.3292.3137548839" with delete access "SpotifyWebHelper.exe" opened "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.2468.409514184" with delete access "SpotifyWebHelper.exe" opened "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.2468.409514184" with delete access "SpotifyWebHelper.exe" opened "%APPDATA%\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.2468.409514244" with delete access "SpotifyWebHelper.exe" opened "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.4000.1976386645" with delete access "SpotifyWebHelper.exe" opened "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.4000.1976386645" with delete access "SpotifyWebHelper.exe" opened "%APPDATA%\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.4000.1976386715" with delete access "SpotifyWebHelper.exe" opened "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.3376.3543259717" with delete access "SpotifyWebHelper.exe" opened "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.3376.3543259717" with delete access "SpotifyWebHelper.exe" opened "%APPDATA%\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.3376.3543259797" with delete access "SpotifyWebHelper.exe" opened "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.2612.815225613" with delete access "SpotifyWebHelper.exe" opened "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.2612.815225613" with delete access2f:Ta0c,"" wrote bytes "a8cf255f" to virtual address "0x68561FDC" (part of module "MSCORWKS.DLL") "" wrote bytes "08572d76047836760000000051c1a2759498a275ee9ca27575dca475273ea475efb2a8750000000046ce3675013d377538ed3775cfcd367531233675de2f3775c4ca367580bb3675aa6e37759fbb367592bb367546ba36750abf367500000000" to virtual address "0x69C51000" (part of module "SHFOLDER.DLL") "" wrote bytes "db4df37100000000" to virtual address "0x00BB2000" (part of module "1D2968648D8E72FF017EBAD79E1B16EB8D09FB8257E5A5235E0AD63E6BEE0C4A.EXE") "reg.exe" wrote bytes "4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000" to virtual address "0x76FE1000" (part of module "NSI.DLL") "PING.EXE" wrote bytes "4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000" to virtual address "0x76FE1000" (part of module "NSI.DLL") "SpotifyWebHelper.exe" wrote bytes "f0da9009" to virtual address "0x68561FDC" (part of module "MSCORWKS.DLL") "SpotifyWebHelper.exe" wrote bytes "db4df37100000000" to virtual address "0x00AA2000" (part of module "SPOTIFYWEBHELPER.EXE") "SpotifyWebHelper.exe" wrote bytes "08572d76047836760000000051c1a2759498a275ee9ca27575dca475273ea475efb2a8750000000046ce3675013d377538ed3775cfcd367531233675de2f3775c4ca367580bb3675aa6e37759fbb367592bb367546ba36750abf367500000000" to virtual address "0x6A1C1000" (part of module "SHFOLDER.DLL") "SpotifyWebHelper.exe" wrote bytes "a5ed6f0b" to virtual address "0x68561FDC" (part of module "MSCORWKS.DLL") "SpotifyWebHelper.exe" wrote bytes "08572d76047836760000000051c1a2759498a275ee9ca27575dca475273ea475efb2a8750000000046ce3675013d377538ed3775cfcd367531233675de2f3775c4ca367580bb3675aa6e37759fbb367592bb367546ba36750abf367500000000" to virtual address "0x6A1B1000" (part of module "SHFOLDER.DLL") "SpotifyWebHelper.exe" wrote bytes "db4df37100000000" to virtual address "0x011E2000" (part of module "SPOTIFYWEBHELPER.EXE") "SpotifyWebHelper.exe" wrote bytes "a77621fa" to virtual address "0x68561FDC" (part of module "MSCORWKS.DLL") "SpotifyWebHelper.exe" wrote bytes "08572d76047836760000000051c1a2759498a275ee9ca27575dca475273ea475efb2a8750000000046ce3675013d377538ed3775cfcd367531233675de2f3775c4ca367580bb3675aa6e37759fbb367592bb367546ba36750abf367500000000" to virtual address "0x5C8A1000" (part of module "SHFOLDER.DLL")30:Tcb4,15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 440) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate) 15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 3292) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate) 15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 2468) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate) 15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 4000) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate) 15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 3376) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate) 15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 2612) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate) 15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 4052) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate) 15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 3428) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate) 15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 1048) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate) 15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 3560) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate) 15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 3044) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate) 15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 3920) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate) 15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 1388) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate) 15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 1572) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate) 15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 2104) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate) 15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 3964) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate) 15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 1540) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate) 15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 2508) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate) 15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 1904) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate) 15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 3716) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate) 15/64 Antivirus vendors marked spawned process "SpotifyWebHelper.exe" (PID: 3408) as malicious (classified as "Gen:Variant.Zusy" with 23% detection rate)31:T2096,Spawned process "" (UID: 00014031-00002452) Spawned process "cmd.exe" with commandline "/c mkdir "%APPDATA%\Spotify\SpotifyWebHelper"" (UID: 00014568-00002620) Spawned process "cmd.exe" with commandline "/c copy /Y /B "C:\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.exe" "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" (UID: 00014577-00003976), Spawned process "cmd.exe" with commandline "/c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs" (UID: 00014585-00003940) Spawned process "reg.exe" with commandline ""REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs""" (UID: 00014589-00003728) Spawned process "cmd.exe" with commandline "/c "%APPDATA%\Spotify\SpotifyWebHelper\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.pdf" (UID: 00014596-00002692), Spawned process "cmd.exe" with commandline "/c ping 127.0.0.1 -n 3 && "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" (UID: 00014600-00003420) Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00014610-00002908) Spawned process "SpotifyWebHelper.exe" (UID: 00014932-00000440) Spawned process "cmd.exe" with commandline "/c mkdir "%APPDATA%\Spotify\SpotifyWebHelper"" (UID: 00015407-00001804) Spawned process "cmd.exe" with commandline "/c copy /Y /B "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" (UID: 00015422-00002648), Spawned process "cmd.exe" with commandline "/c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs" (UID: 00015451-00002592) Spawned process "reg.exe" with commandline ""REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs""" (UID: 00015455-00002524) Spawned process "cmd.exe" with commandline "/c "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.pdf" (UID: 00015468-00002528), Spawned process "cmd.exe" with commandline "/c ping 127.0.0.1 -n 3 && "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" (UID: 00015477-00002708) Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00015506-00002268) Spawned process "SpotifyWebHelper.exe" (UID: 00015841-00003292) Spawned process "cmd.exe" with commandline "/c mkdir "%APPDATA%\Spotify\SpotifyWebHelper"" (UID: 00016363-00003820) Spawned process "cmd.exe" with commandline "/c copy /Y /B "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" (UID: 00016382-00003616), Spawned process "cmd.exe" with commandline "/c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs" (UID: 00016400-00003764) Spawned process "reg.exe" with commandline ""REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs""" (UID: 00016404-00003712) Spawned process "cmd.exe" with commandline "/c "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.pdf" (UID: 00016419-00003672), Spawned process "cmd.exe" with commandline "/c ping 127.0.0.1 -n 3 && "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" (UID: 00016433-00003548) Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00016445-00003404) Spawned process "SpotifyWebHelper.exe" (UID: 00016766-00002468) Spawned process "cmd.exe" with commandline "/c mkdir "%APPDATA%\Spotify\SpotifyWebHelper"" (UID: 00017164-00003968) Spawned process "cmd.exe" with commandline "/c copy /Y /B "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" (UID: 00017195-00002540), Spawned process "cmd.exe" with commandline "/c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs" (UID: 00017218-00002572) Spawned process "reg.exe" with commandline ""REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs""" (UID: 00017222-00003996) Spawned process "cmd.exe" with commandline "/c "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.pdf" (UID: 00017240-00003988), Spawned process "cmd.exe" with commandline "/c ping 127.0.0.1 -n 3 && "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" (UID: 00017257-00003588) Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00017283-00002856) Spawned process "SpotifyWebHelper.exe" (UID: 00017606-00004000) Spawned process "cmd.exe" with commandline "/c mkdir "%APPDATA%\Spotify\SpotifyWebHelper"" (UID: 00018040-00002232) Spawned process "cmd.exe" with commandline "/c copy /Y /B "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" (UID: 00018064-00002216), Spawned process "cmd.exe" with commandline "/c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs" (UID: 00018086-00002068) Spawned process "reg.exe" with commandline ""REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs""" (UID: 00018090-00001632) Spawned process "cmd.exe" with commandline "/c "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.pdf" (UID: 00018125-00001972), Spawned process "cmd.exe" with commandline "/c ping 127.0.0.1 -n 3 && "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" (UID: 00018145-00001284) Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00018161-00002672) Spawned process "SpotifyWebHelper.exe" (UID: 00018483-00003376) Spawned process "cmd.exe" with commandline "/c mkdir "%APPDATA%\Spotify\SpotifyWebHelper"" (UID: 00018943-00003380) Spawned process "cmd.exe" with commandline "/c copy /Y /B "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" (UID: 00018971-00003352), Spawned process "cmd.exe" with commandline "/c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs" (UID: 00019019-00002664) Spawned process "reg.exe" with commandline ""REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs""" (UID: 00019024-00003592) Spawned process "cmd.exe" with commandline "/c "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.pdf" (UID: 00019049-00003220), Spawned process "cmd.exe" with commandline "/c ping 127.0.0.1 -n 3 && "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" (UID: 00019074-00003868) Spawned process "PING.EXE" with commandline "ping 127.0.0.1 -n 3" (UID: 00019085-00003364) Spawned process "SpotifyWebHelper.exe" (UID: 00019410-00002612) Spawned process "cmd.exe" with commandline "/c mkdir "%APPDATA%\Spotify\SpotifyWebHelper"" (UID: 00019907-00002488) Spawned process "cmd.exe" with commandline "/c copy /Y /B "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe" (UID: 00019951-00003912), Spawned process "cmd.exe" with commandline "/c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs" (UID: 00019983-00003320) Spawned process "reg.exe" with commandline ""REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Spotify Web Helper v1.0" /f /d "%APPDATA%\Spotify\SpotifyWebHelper\Spotify.vbs""" (UID: 00019988-00003000) Spawned process "cmd.exe" with commandline "/c "%APPDATA%\Spotify\SpotifyWebHelper\SpotifyWebHelper.pdf" (UID: 00020019-00004028)32:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA//////////////8AAAAAAP//////////////AAAAAAD//////////////wAAAAAA//////////////8AAAAAAP//eY//////////AAAAAAD//3+Y/////////wAAAAAA///3if///4////8AAAAAAP///4l4/4iJ////AAAAAAD/////mIeYiP///wAAAAAA/////4iI//////8AAAAAAP////+Jj///////AAAAAAD/////+Y///////wAAAAAA//////mP//////8AAAAAAP////+If///////AAAAAAD/////j5///////wAAAAAA/////4eP//////8AAAAAAP//////////////AAAAAACIiIiIiIiI/////wCZmZmZmZmZmZmZmf////8AmZmZmZmZmZmZmZn/////AJmZn5mfh5+ZmZmZ/////wCZmZ+Zn5ifmZmZmf////8AmZmfh5+fn4iZmZn/////AJmZn5ifmJ+ZmZmZ/4//jwCZmZ+Hn4efiJmZmf////AAmZmZmZmZmZmZmZn///8AAJmZmZmZmZmZmZmZ//+AAAAAAAAA//////////+IAAAAAAAAAP//////////gAAAAAAAAAAAAAAAAAAAAAAAAAD+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAcAAAAPAAAAH/4AAD/+AAA//////w==33:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==34:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==35:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==36:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==37:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAREREREREREREREREREREAERERERERERERERERERERABEREREREREREREREREREQAREREREREREREREREREREAEREfj4ERERERERERERERABERfxj4EREREREREREREQARERcRjxERERERERERcREAERERh3+BEREREREREYERABERERER+BERERERdxEREQAREREREf9xERERj//3EREAEREREREfEY+Ij4ERGBERABERERERGHERiP+Hd48REQARERERERH3Ef8REREREREAERERERER+BH4ERERERERAJmZmZmZEZ8fkREREREREQCZmZmZmZmYfxEREREREREAmZmZmZmZmfmZmZmZERERAJmZmZmZmZmJmZmZmZmREQCZmZmZmZmf+ZmZmZmZmZkAmZmZmZmZf4eZmZmZmZmZAJmZmZmZmf+YmZmZmZmZmQCZmZmZmZn4n5mZmZmZmZkAmZmZmZmZ/3+ZmZmZmZmZAJmZmZmZmX//mZmZmZmZmQCZmZmZmZmZmZmZmZmZmZkAmZmZmZmZmZmZmZmZmZmZAJmZmZmZmZmZmZmZmZmZmQCZmZmZmZmZmZmZmZmZmZkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==38:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==39:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==3a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA//////////////8AAAAAAP//////////////AAAAAAD//////////////wAAAAAA//////////////8AAAAAAP//eY//////////AAAAAAD//3+Y/////////wAAAAAA///3if///4////8AAAAAAP///4l4/4iJ////AAAAAAD/////mIeYiP///wAAAAAA/////4iI//////8AAAAAAP////+Jj///////AAAAAAD/////+Y///////wAAAAAA//////mP//////8AAAAAAP////+If///////AAAAAAD/////j5///////wAAAAAA/////4eP//////8AAAAAAP//////////////AAAAAACIiIiIiIiI/////wCZmZmZmZmZmZmZmf////8AmZmZmZmZmZmZmZn/////AJmZn5mfh5+ZmZmZ/////wCZmZ+Zn5ifmZmZmf////8AmZmfh5+fn4iZmZn/////AJmZn5ifmJ+ZmZmZ/4//jwCZmZ+Hn4efiJmZmf////AAmZmZmZmZmZmZmZn///8AAJmZmZmZmZmZmZmZ//+AAAAAAAAA//////////+IAAAAAAAAAP//////////gAAAAAAAAAAAAAAAAAAAAAAAAAD+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAcAAAAPAAAAH/4AAD/+AAA//////w==3b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==3c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==3d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==3e:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==3f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAREREREREREREREREREREAERERERERERERERERERERABEREREREREREREREREREQAREREREREREREREREREREAEREfj4ERERERERERERERABERfxj4EREREREREREREQARERcRjxERERERERERcREAERERh3+BEREREREREYERABERERER+BERERERdxEREQAREREREf9xERERj//3EREAEREREREfEY+Ij4ERGBERABERERERGHERiP+Hd48REQARERERERH3Ef8REREREREAERERERER+BH4ERERERERAJmZmZmZEZ8fkREREREREQCZmZmZmZmYfxEREREREREAmZmZmZmZmfmZmZmZERERAJmZmZmZmZmJmZmZmZmREQCZmZmZmZmf+ZmZmZmZmZkAmZmZmZmZf4eZmZmZmZmZAJmZmZmZmf+YmZmZmZmZmQCZmZmZmZn4n5mZmZmZmZkAmZmZmZmZ/3+ZmZmZmZmZAJmZmZmZmX//mZmZmZmZmQCZmZmZmZmZmZmZmZmZmZkAmZmZmZmZmZmZmZmZmZmZAJmZmZmZmZmZmZmZmZmZmQCZmZmZmZmZmZmZmZmZmZkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==40:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==41:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==42:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA//////////////8AAAAAAP//////////////AAAAAAD//////////////wAAAAAA//////////////8AAAAAAP//eY//////////AAAAAAD//3+Y/////////wAAAAAA///3if///4////8AAAAAAP///4l4/4iJ////AAAAAAD/////mIeYiP///wAAAAAA/////4iI//////8AAAAAAP////+Jj///////AAAAAAD/////+Y///////wAAAAAA//////mP//////8AAAAAAP////+If///////AAAAAAD/////j5///////wAAAAAA/////4eP//////8AAAAAAP//////////////AAAAAACIiIiIiIiI/////wCZmZmZmZmZmZmZmf////8AmZmZmZmZmZmZmZn/////AJmZn5mfh5+ZmZmZ/////wCZmZ+Zn5ifmZmZmf////8AmZmfh5+fn4iZmZn/////AJmZn5ifmJ+ZmZmZ/4//jwCZmZ+Hn4efiJmZmf////AAmZmZmZmZmZmZmZn///8AAJmZmZmZmZmZmZmZ//+AAAAAAAAA//////////+IAAAAAAAAAP//////////gAAAAAAAAAAAAAAAAAAAAAAAAAD+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAcAAAAPAAAAH/4AAD/+AAA//////w==43:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==44:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==45:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==46:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==47:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==48:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAREREREREREREREREREREAERERERERERERERERERERABEREREREREREREREREREQAREREREREREREREREREREAEREfj4ERERERERERERERABERfxj4EREREREREREREQARERcRjxERERERERERcREAERERh3+BEREREREREYERABERERER+BERERERdxEREQAREREREf9xERERj//3EREAEREREREfEY+Ij4ERGBERABERERERGHERiP+Hd48REQARERERERH3Ef8REREREREAERERERER+BH4ERERERERAJmZmZmZEZ8fkREREREREQCZmZmZmZmYfxEREREREREAmZmZmZmZmfmZmZmZERERAJmZmZmZmZmJmZmZmZmREQCZmZmZmZmf+ZmZmZmZmZkAmZmZmZmZf4eZmZmZmZmZAJmZmZmZmf+YmZmZmZmZmQCZmZmZmZn4n5mZmZmZmZkAmZmZmZmZ/3+ZmZmZmZmZAJmZmZmZmX//mZmZmZmZmQCZmZmZmZmZmZmZmZmZmZkAmZmZmZmZmZmZmZmZmZmZAJmZmZmZmZmZmZmZmZmZmQCZmZmZmZmZmZmZmZmZmZkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==49:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==4a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA//////////////8AAAAAAP//////////////AAAAAAD//////////////wAAAAAA//////////////8AAAAAAP//eY//////////AAAAAAD//3+Y/////////wAAAAAA///3if///4////8AAAAAAP///4l4/4iJ////AAAAAAD/////mIeYiP///wAAAAAA/////4iI//////8AAAAAAP////+Jj///////AAAAAAD/////+Y///////wAAAAAA//////mP//////8AAAAAAP////+If///////AAAAAAD/////j5///////wAAAAAA/////4eP//////8AAAAAAP//////////////AAAAAACIiIiIiIiI/////wCZmZmZmZmZmZmZmf////8AmZmZmZmZmZmZmZn/////AJmZn5mfh5+ZmZmZ/////wCZmZ+Zn5ifmZmZmf////8AmZmfh5+fn4iZmZn/////AJmZn5ifmJ+ZmZmZ/4//jwCZmZ+Hn4efiJmZmf////AAmZmZmZmZmZmZmZn///8AAJmZmZmZmZmZmZmZ//+AAAAAAAAA//////////+IAAAAAAAAAP//////////gAAAAAAAAAAAAAAAAAAAAAAAAAD+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAcAAAAPAAAAH/4AAD/+AAA//////w==4b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==4c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==4d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==4e:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==4f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==50:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAREREREREREREREREREREAERERERERERERERERERERABEREREREREREREREREREQAREREREREREREREREREREAEREfj4ERERERERERERERABERfxj4EREREREREREREQARERcRjxERERERERERcREAERERh3+BEREREREREYERABERERER+BERERERdxEREQAREREREf9xERERj//3EREAEREREREfEY+Ij4ERGBERABERERERGHERiP+Hd48REQARERERERH3Ef8REREREREAERERERER+BH4ERERERERAJmZmZmZEZ8fkREREREREQCZmZmZmZmYfxEREREREREAmZmZmZmZmfmZmZmZERERAJmZmZmZmZmJmZmZmZmREQCZmZmZmZmf+ZmZmZmZmZkAmZmZmZmZf4eZmZmZmZmZAJmZmZmZmf+YmZmZmZmZmQCZmZmZmZn4n5mZmZmZmZkAmZmZmZmZ/3+ZmZmZmZmZAJmZmZmZmX//mZmZmZmZmQCZmZmZmZmZmZmZmZmZmZkAmZmZmZmZmZmZmZmZmZmZAJmZmZmZmZmZmZmZmZmZmQCZmZmZmZmZmZmZmZmZmZkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==51:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==52:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==53:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA//////////////8AAAAAAP//////////////AAAAAAD//////////////wAAAAAA//////////////8AAAAAAP//eY//////////AAAAAAD//3+Y/////////wAAAAAA///3if///4////8AAAAAAP///4l4/4iJ////AAAAAAD/////mIeYiP///wAAAAAA/////4iI//////8AAAAAAP////+Jj///////AAAAAAD/////+Y///////wAAAAAA//////mP//////8AAAAAAP////+If///////AAAAAAD/////j5///////wAAAAAA/////4eP//////8AAAAAAP//////////////AAAAAACIiIiIiIiI/////wCZmZmZmZmZmZmZmf////8AmZmZmZmZmZmZmZn/////AJmZn5mfh5+ZmZmZ/////wCZmZ+Zn5ifmZmZmf////8AmZmfh5+fn4iZmZn/////AJmZn5ifmJ+ZmZmZ/4//jwCZmZ+Hn4efiJmZmf////AAmZmZmZmZmZmZmZn///8AAJmZmZmZmZmZmZmZ//+AAAAAAAAA//////////+IAAAAAAAAAP//////////gAAAAAAAAAAAAAAAAAAAAAAAAAD+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAcAAAAPAAAAH/4AAD/+AAA//////w==54:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==55:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==56:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==57:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790676073277,"unified_at":"2026-09-29T10:01:13.277Z","metadata":{"hashes":{"sha256":"1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a","sha1":"15f2ab3fea0226edc895cc3f23d72e77c881b252","md5":"c9dafb23bdba2a46fe1e573ae75c0d4d","sha512":"9642783f568f0409fbb59a60b4eff85a9a6dc48fd2e72f39b0b557029f3ca1131fac40b81d4dbce90d29e46f40dbb14ee52dcabc137f6dfc81fbd64d92a9b8b1","ssdeep":"3072:sYEXbcN8yhRHw9wyyq1aETK0/SryFoWiYc+/vcbef50JUaRKV/1aDVnILrzZ2CwU:hEXbvab","ssdeep_chunks":["3072:sYEXbcN","3072:YEXbcN8","3072:EXbcN8y","3072:XbcN8yh","3072:bcN8yhR","3072:cN8yhRH","3072:N8yhRHw","3072:8yhRHw9","3072:yhRHw9w","3072:hRHw9wy","3072:RHw9wyy","3072:Hw9wyyq","3072:w9wyyq1","3072:9wyyq1a","3072:wyyq1aE","3072:yyq1aET","3072:yq1aETK","3072:q1aETK0","3072:1aETK0/","3072:aETK0/S","3072:ETK0/Sr","3072:TK0/Sry","3072:K0/SryF","3072:0/SryFo","3072:/SryFoW","3072:SryFoWi","3072:ryFoWiY","3072:yFoWiYc","3072:FoWiYc+","3072:oWiYc+/","3072:WiYc+/v","3072:iYc+/vc","3072:Yc+/vcb","3072:c+/vcbe","3072:+/vcbef","3072:/vcbef5","3072:vcbef50","3072:cbef50J","3072:bef50JU","3072:ef50JUa","3072:f50JUaR","3072:50JUaRK","3072:0JUaRKV","3072:JUaRKV/","3072:UaRKV/1","3072:aRKV/1a","3072:RKV/1aD","3072:KV/1aDV","3072:V/1aDVn","3072:/1aDVnI","3072:1aDVnIL","3072:aDVnILr","3072:DVnILrz","3072:VnILrzZ","3072:nILrzZ2","3072:ILrzZ2C","3072:LrzZ2Cw","3072:rzZ2CwU","6144:sYEXbcN","6144:YEXbcN8","6144:EXbcN8y","6144:XbcN8yh","6144:bcN8yhR","6144:cN8yhRH","6144:N8yhRHw","6144:8yhRHw9","6144:yhRHw9w","6144:hRHw9wy","6144:RHw9wyy","6144:Hw9wyyq","6144:w9wyyq1","6144:9wyyq1a","6144:wyyq1aE","6144:yyq1aET","6144:yq1aETK","6144:q1aETK0","6144:1aETK0/","6144:aETK0/S","6144:ETK0/Sr","6144:TK0/Sry","6144:K0/SryF","6144:0/SryFo","6144:/SryFoW","6144:SryFoWi","6144:ryFoWiY","6144:yFoWiYc","6144:FoWiYc+","6144:oWiYc+/","6144:WiYc+/v","6144:iYc+/vc","6144:Yc+/vcb","6144:c+/vcbe","6144:+/vcbef","6144:/vcbef5","6144:vcbef50","6144:cbef50J","6144:bef50JU","6144:ef50JUa","6144:f50JUaR","6144:50JUaRK","6144:0JUaRKV","6144:JUaRKV/","6144:UaRKV/1","6144:aRKV/1a","6144:RKV/1aD","6144:KV/1aDV","6144:V/1aDVn","6144:/1aDVnI","6144:1aDVnIL","6144:aDVnILr","6144:DVnILrz","6144:VnILrzZ","6144:nILrzZ2","6144:ILrzZ2C","6144:LrzZ2Cw","6144:rzZ2CwU","3072:hEXbvab"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"file","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":342528,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1500129807000,"last_seen":1661244312000,"last_multi_scan":1661244312000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":19,"suspicious_count":18,"malicious_count":6,"total":43},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Mucc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1217592","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.HiddenTear.K","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.SBOA-4498","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.HiddenTear.K (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Filecoder.IQ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Filecoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000121 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransomware-GCU!C9DAFB23BDBA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.FileCoder.eqzrva","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Cryptear-E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Ransom.Reyptson","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.5F228E29","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.5F228E29","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MulDrop7.BVSD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.5758","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$27","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"cmd.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ACRORD32.EXE\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ACRORD32.EXE\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ACRORD32.EXE\"; Key: \"PATH\"; Value: \"00000000010000005600000043003A005C00500072006F006700720061006D002000460069006C00650073005C00410064006F00620065005C005200650061006400650072002000310031002E0030005C005200650061006400650072005C000000\")\n \"AcroRd32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{AC76BA86-7AD7-1031-7B44-AB0000000001}\")\n \"AcroRd32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{AC76BA86-7AD7-1031-7B44-AB0000000001}\"; Key: \"VERSION\"; Value: \"0000000004000000040000000900000B\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$28","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\Desktop\\NL\\RP\\Reyptson\\Reyptson\\obj\\Release\\Reyptson.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"AcroRd32.exe\" created file \"%TEMP%\\A9R9376.tmp\"\n \"AcroRd32.exe\" created file \"%TEMP%\\A9R9377.tmp\"\n \"AcroRd32.exe\" created file \"%TEMP%\\A9R9378.tmp\"\n \"AcroRd32.exe\" created file \"%TEMP%\\A9R9379.tmp\"\n \"AcroRd32.exe\" created file \"%TEMP%\\A9R937A.tmp\"\n \"AcroRd32.exe\" created file \"%TEMP%\\A9R937B.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\-=Reyptson=-\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"-=Reyptson=-\"\n \"Local\\ZonesCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"UserCache.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 6A1D0000\n \"SpotifyWebHelper.exe\" loaded module \"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 6A1D0000\n \"SpotifyWebHelper.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\d40b99d82652dbbc000d378a824ae296\\mscorlib.ni.dll\" at 63F60000\n \"SpotifyWebHelper.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\d40b99d82652dbbc000d378a824ae296\\mscorlib.ni.dll\" at 63460000\n \"SpotifyWebHelper.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\d40b99d82652dbbc000d378a824ae296\\mscorlib.ni.dll\" at 639B0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$29","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"$2a","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"AcroRd32.exe\" searching for class \"JFWUI2\"\n \"AcroRd32.exe\" searching for class \"AdobeAcrobat\"\n \"AcroRd32.exe\" searching for class \"Shell_TrayWnd\"\n \"AcroRd32.exe\" searching for class \"AdobeAcrobatSpeedLaunchCmdWnd\"\n \"AcroRd32.exe\" searching for class \"AdobeReaderSpeedLaunchCmdWnd\"\n \"AcroRd32.exe\" searching for window \"_AcroAppTimer\"\n \"AcroRd32.exe\" searching for class \"Acrobat Instance Window Class\"\n \"AcroRd32.exe\" searching for class \"ACROSEMAPHORE_R11\"\n \"AcroRd32.exe\" searching for class \"NDDEAgnt\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$2b","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"SpotifyWebHelper.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"assets-170715223452Z-98048416\" has type \"PNG image data 46 x 46 8-bit/color RGB non-interlaced\"\n \"A9R937E.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\"\n \"A9B8213768ADC68AF64FCC6409E8BE414726687F.crl\" has type \"data\"\n \"UserCache.bin\" has type \"data\"\n \"A9R9377.tmp\" has type \"data\"\n \"A9R9378.tmp\" has type \"data\"\n \"assets-170715223452Z-98048421\" has type \"PNG image data 48 x 48 8-bit/color RGBA non-interlaced\"\n \"Spotify.vbs\" has type \"ASCII text\"\n \"A9R937C.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\"\n \"48B76449F3D5FEFA1133AA805E420F0FCA643651.crl\" has type \"data\"\n \"assets-170715223452Z-98048407\" has type \"PNG image data 48 x 48 8-bit/color RGBA non-interlaced\"\n \"A9R9379.tmp\" has type \"data\"\n \"A9R937B.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\"\n \"A9R937D.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2c","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"37z2akkbd3vqphw5.onion\"\n Pattern match: \"https://www.torproject.org/download/download\"\n Pattern match: \"http://media.blizzard.com/emails/2014-account/lock.png\\\"\n Pattern match: \"http://www.melvinmusicals.com/facefiles/factura.pdf.rar\\\"\n Pattern match: \"https://www.torproject.org/download/download\\\"\n Pattern match: \"http://x/?user\"\n Pattern match: \"https://x.to/\"\n Pattern match: \"www.torproject.org/download/download\\r\\ny\"\n Heuristic match: \"7z2akkbd3vqphw5.onion\"\n Pattern match: \"ject.org/download/download\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"todo de pagoPayPalPago a realizar desde\" (Indicator: \"paypal\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"SpotifyWebHelper.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.exe.bin\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00014031-00002452-00000105-40067266\n \"SpotifyWebHelper.exe\" at 00014932-00000440-00000105-42299044\n \"SpotifyWebHelper.exe\" at 00015841-00003292-00000105-44820041\n \"SpotifyWebHelper.exe\" at 00016766-00002468-00000105-46877401\n \"SpotifyWebHelper.exe\" at 00017606-00004000-00000105-49223619\n \"SpotifyWebHelper.exe\" at 00018483-00003376-00000105-51748364\n \"SpotifyWebHelper.exe\" at 00019410-00002612-00000105-54361906","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"AcroRd32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is allocating memory with PAGE_GUARD access rights\n \"SpotifyWebHelper.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"AcroRd32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"SpotifyWebHelper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"AcroRd32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"SpotifyWebHelper.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"1566804069\" milliseconds\n \"SpotifyWebHelper.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"cmd.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"AcroRd32.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"SpotifyWebHelper.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"cmd.exe\" called \"OpenService\" to access the \"PcaSvc\" service\n \"AcroRd32.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"AcroRd32.exe\" called \"OpenService\" to access the \"gpsvc\" service\n \"AcroRd32.exe\" called \"OpenService\" to access the \"RASMAN\" service\n \"AcroRd32.exe\" called \"OpenService\" to access the \"rasman\" service\n \"AcroRd32.exe\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"AcroRd32.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"gpsvc\"\n \"AcroRd32.exe\" called \"ControlService\" and sent control code \"0XFC\" to the service \"gpsvc\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"reg.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"reg.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SPOTIFY WEB HELPER V1.0\"; Value: \"%APPDATA%\\Spotify\\SpotifyWebHelper\\Spotify.vbs\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"/c ping 127.0.0.1 -n 3 && \"\", Heuristic match: \"Pinging 127.0.0.1\", Heuristic match: \"Reply from 127.0.0.1:\", Heuristic match: \"Ping statistics for 127.0.0.1:\n Packets: Sent = 4\n Received = 4\n Lost = 0 (0% loss)\n\", Heuristic match: \"Pinging 127.0.0.1 with 32 bytes of data:\", Heuristic match: \"Reply from 127.0.0.1: bytes=32 time<1ms TTL=128\", Heuristic match: \"Ping statistics for 127.0.0.1:\", Heuristic match: \"/c ping 127.0.0.1 -n 3 && \\\"\"\n \"15.0.1.0\"\n Heuristic match: \"/c ping 127.0.0.1 -n 3 && \"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe\", Heuristic match: \"ping 127.0.0.1 -n 3\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"$2d","origin":"Monitored Target","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2e","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"SpotifyWebHelper.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"SpotifyWebHelper.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"SpotifyWebHelper.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2f","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"AcroRd32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"SpotifyWebHelper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"malicious","category":"Anti-Reverse Engineering","name":"Uses ping excessively (often used to bypass analysis)","description":"Process \"PING.EXE\" spawned very often","origin":"Monitored Target","relevance":7,"id":"target-45","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"15/64 Antivirus vendors marked sample as malicious (23% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"15/64 Antivirus vendors marked sample as malicious (23% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"$30","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Scans for the windows taskbar (often used for explorer injection)","description":"\"AcroRd32.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":5,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$31","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]}],"incidents":[{"name":"Persistence","details_count":2,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]}]},"activity":{"stats":{"process_count":42,"spawned_processes_count":42,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":32,"imported_dlls_count":112,"dropped_files_count":0,"extracted_files_count":14,"files_written_count":571,"files_deleted_count":0,"registry_keys_created_count":10,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":14,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"596a277f7ca3e15023254fb3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Zusy","submit_name":"1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a","analysis_start_time":"2017-07-15T15:32:03+00:00","indicators_count":{"informative":19,"suspicious":22,"malicious":7},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}],"processes":[{"pid":2452,"ppid":0,"name":"1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.exe","command_line":"","sha256":"1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a","normalized_path":"C:\\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.exe","uid":"00014031-00002452","icon":"$32"},{"pid":2620,"ppid":2452,"name":"cmd.exe","command_line":"/c mkdir \"%APPDATA%\\Spotify\\SpotifyWebHelper\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014031-00002452","uid":"00014568-00002620","icon":"$33"},{"pid":3976,"ppid":2452,"name":"cmd.exe","command_line":"/c copy /Y /B \"C:\\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.exe\" \"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014031-00002452","uid":"00014577-00003976","icon":"$34"},{"pid":3940,"ppid":2452,"name":"cmd.exe","command_line":"/c REG ADD HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v \"Spotify Web Helper v1.0\" /f /d \"%APPDATA%\\Spotify\\SpotifyWebHelper\\Spotify.vbs","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014031-00002452","uid":"00014585-00003940","icon":"$35"},{"pid":3728,"ppid":3940,"name":"reg.exe","command_line":"\"REG ADD HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v \"Spotify Web Helper v1.0\" /f /d \"%APPDATA%\\Spotify\\SpotifyWebHelper\\Spotify.vbs\"\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00014585-00003940","uid":"00014589-00003728"},{"pid":2692,"ppid":2452,"name":"cmd.exe","command_line":"/c \"%APPDATA%\\Spotify\\SpotifyWebHelper\\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.pdf","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014031-00002452","uid":"00014596-00002692","icon":"$36"},{"pid":1536,"ppid":2692,"name":"AcroRd32.exe","command_line":"\"%APPDATA%\\Spotify\\SpotifyWebHelper\\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.pdf","sha256":"e67a01f0d47be82ed631fe93f0b2f8c6276b4ce89b46b51d178e66f976b324bd","normalized_path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe","parent_uid":"00014596-00002692","uid":"00014643-00001536","icon":"$37"},{"pid":3420,"ppid":2452,"name":"cmd.exe","command_line":"/c ping 127.0.0.1 -n 3 && \"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014031-00002452","uid":"00014600-00003420","icon":"$38"},{"pid":2908,"ppid":3420,"name":"PING.EXE","command_line":"ping 127.0.0.1 -n 3","sha256":"4ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d","normalized_path":"%WINDIR%\\System32\\PING.EXE","parent_uid":"00014600-00003420","uid":"00014610-00002908","icon":"$39"},{"pid":440,"ppid":3420,"name":"SpotifyWebHelper.exe","command_line":"","sha256":"1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a","normalized_path":"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe","parent_uid":"00014600-00003420","uid":"00014932-00000440","icon":"$3a"},{"pid":1804,"ppid":440,"name":"cmd.exe","command_line":"/c mkdir \"%APPDATA%\\Spotify\\SpotifyWebHelper\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014932-00000440","uid":"00015407-00001804","icon":"$3b"},{"pid":2648,"ppid":440,"name":"cmd.exe","command_line":"/c copy /Y /B \"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe\" \"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014932-00000440","uid":"00015422-00002648","icon":"$3c"},{"pid":2592,"ppid":440,"name":"cmd.exe","command_line":"/c REG ADD HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v \"Spotify Web Helper v1.0\" /f /d \"%APPDATA%\\Spotify\\SpotifyWebHelper\\Spotify.vbs","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014932-00000440","uid":"00015451-00002592","icon":"$3d"},{"pid":2524,"ppid":2592,"name":"reg.exe","command_line":"\"REG ADD HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v \"Spotify Web Helper v1.0\" /f /d \"%APPDATA%\\Spotify\\SpotifyWebHelper\\Spotify.vbs\"\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00015451-00002592","uid":"00015455-00002524","icon":"$3e"},{"pid":2528,"ppid":440,"name":"cmd.exe","command_line":"/c \"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.pdf","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014932-00000440","uid":"00015468-00002528"},{"pid":3024,"ppid":2528,"name":"AcroRd32.exe","command_line":"\"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.pdf","sha256":"e67a01f0d47be82ed631fe93f0b2f8c6276b4ce89b46b51d178e66f976b324bd","normalized_path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe","parent_uid":"00015468-00002528","uid":"00015537-00003024","icon":"$3f"},{"pid":2708,"ppid":440,"name":"cmd.exe","command_line":"/c ping 127.0.0.1 -n 3 && \"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014932-00000440","uid":"00015477-00002708","icon":"$40"},{"pid":2268,"ppid":2708,"name":"PING.EXE","command_line":"ping 127.0.0.1 -n 3","sha256":"4ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d","normalized_path":"%WINDIR%\\System32\\PING.EXE","parent_uid":"00015477-00002708","uid":"00015506-00002268","icon":"$41"},{"pid":3292,"ppid":2708,"name":"SpotifyWebHelper.exe","command_line":"","sha256":"1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a","normalized_path":"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe","parent_uid":"00015477-00002708","uid":"00015841-00003292","icon":"$42"},{"pid":3820,"ppid":3292,"name":"cmd.exe","command_line":"/c mkdir \"%APPDATA%\\Spotify\\SpotifyWebHelper\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00015841-00003292","uid":"00016363-00003820","icon":"$43"},{"pid":3616,"ppid":3292,"name":"cmd.exe","command_line":"/c copy /Y /B \"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe\" \"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00015841-00003292","uid":"00016382-00003616","icon":"$44"},{"pid":3764,"ppid":3292,"name":"cmd.exe","command_line":"/c REG ADD HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v \"Spotify Web Helper v1.0\" /f /d \"%APPDATA%\\Spotify\\SpotifyWebHelper\\Spotify.vbs","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00015841-00003292","uid":"00016400-00003764","icon":"$45"},{"pid":3712,"ppid":3764,"name":"reg.exe","command_line":"\"REG ADD HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v \"Spotify Web Helper v1.0\" /f /d \"%APPDATA%\\Spotify\\SpotifyWebHelper\\Spotify.vbs\"\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00016400-00003764","uid":"00016404-00003712","icon":"$46"},{"pid":3672,"ppid":3292,"name":"cmd.exe","command_line":"/c \"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.pdf","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00015841-00003292","uid":"00016419-00003672","icon":"$47"},{"pid":3324,"ppid":3672,"name":"AcroRd32.exe","command_line":"\"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.pdf","sha256":"e67a01f0d47be82ed631fe93f0b2f8c6276b4ce89b46b51d178e66f976b324bd","normalized_path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe","parent_uid":"00016419-00003672","uid":"00016476-00003324","icon":"$48"},{"pid":3548,"ppid":3292,"name":"cmd.exe","command_line":"/c ping 127.0.0.1 -n 3 && \"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00015841-00003292","uid":"00016433-00003548"},{"pid":3404,"ppid":3548,"name":"PING.EXE","command_line":"ping 127.0.0.1 -n 3","sha256":"4ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d","normalized_path":"%WINDIR%\\System32\\PING.EXE","parent_uid":"00016433-00003548","uid":"00016445-00003404","icon":"$49"},{"pid":2468,"ppid":3548,"name":"SpotifyWebHelper.exe","command_line":"","sha256":"1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a","normalized_path":"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe","parent_uid":"00016433-00003548","uid":"00016766-00002468","icon":"$4a"},{"pid":3968,"ppid":2468,"name":"cmd.exe","command_line":"/c mkdir \"%APPDATA%\\Spotify\\SpotifyWebHelper\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016766-00002468","uid":"00017164-00003968","icon":"$4b"},{"pid":2540,"ppid":2468,"name":"cmd.exe","command_line":"/c copy /Y /B \"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe\" \"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016766-00002468","uid":"00017195-00002540","icon":"$4c"},{"pid":2572,"ppid":2468,"name":"cmd.exe","command_line":"/c REG ADD HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v \"Spotify Web Helper v1.0\" /f /d \"%APPDATA%\\Spotify\\SpotifyWebHelper\\Spotify.vbs","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016766-00002468","uid":"00017218-00002572","icon":"$4d"},{"pid":3996,"ppid":2572,"name":"reg.exe","command_line":"\"REG ADD HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v \"Spotify Web Helper v1.0\" /f /d \"%APPDATA%\\Spotify\\SpotifyWebHelper\\Spotify.vbs\"\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00017218-00002572","uid":"00017222-00003996","icon":"$4e"},{"pid":3988,"ppid":2468,"name":"cmd.exe","command_line":"/c \"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.pdf","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016766-00002468","uid":"00017240-00003988","icon":"$4f"},{"pid":2700,"ppid":3988,"name":"AcroRd32.exe","command_line":"\"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.pdf","sha256":"e67a01f0d47be82ed631fe93f0b2f8c6276b4ce89b46b51d178e66f976b324bd","normalized_path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe","parent_uid":"00017240-00003988","uid":"00017318-00002700","icon":"$50"},{"pid":3588,"ppid":2468,"name":"cmd.exe","command_line":"/c ping 127.0.0.1 -n 3 && \"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016766-00002468","uid":"00017257-00003588","icon":"$51"},{"pid":2856,"ppid":3588,"name":"PING.EXE","command_line":"ping 127.0.0.1 -n 3","sha256":"4ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d","normalized_path":"%WINDIR%\\System32\\PING.EXE","parent_uid":"00017257-00003588","uid":"00017283-00002856","icon":"$52"},{"pid":4000,"ppid":3588,"name":"SpotifyWebHelper.exe","command_line":"","sha256":"1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a","normalized_path":"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe","parent_uid":"00017257-00003588","uid":"00017606-00004000","icon":"$53"},{"pid":2232,"ppid":4000,"name":"cmd.exe","command_line":"/c mkdir \"%APPDATA%\\Spotify\\SpotifyWebHelper\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00017606-00004000","uid":"00018040-00002232","icon":"$54"},{"pid":2216,"ppid":4000,"name":"cmd.exe","command_line":"/c copy /Y /B \"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe\" \"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00017606-00004000","uid":"00018064-00002216","icon":"$55"},{"pid":2068,"ppid":4000,"name":"cmd.exe","command_line":"/c REG ADD HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v \"Spotify Web Helper v1.0\" /f /d \"%APPDATA%\\Spotify\\SpotifyWebHelper\\Spotify.vbs","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00017606-00004000","uid":"00018086-00002068","icon":"$56"},{"pid":1972,"ppid":4000,"name":"cmd.exe","command_line":"/c \"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.pdf","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00017606-00004000","uid":"00018125-00001972","icon":"$57"},{"pid":1284,"ppid":4000,"name":"cmd.exe","command_line":"/c ping 127.0.0.1 -n 3 && \"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00017606-00004000","uid":"00018145-00001284"}],"all_imported_dlls":["winrnr.dll","gpapi.dll","kernel32.dll","iertutil.dll","urlmon.dll","crypt32.dll","winbrand.dll","ACE.dll","wsock32.dll","usp10.dll","uxtheme.dll","System.Windows.Forms.dll","sspicli.dll","Accessibility.dll","oleaccrc.dll","IPHLPAPI.DLL","rasapi32.dll","cryptsp.dll","comctl32.dll","apphelp.dll","cfgmgr32.dll","nsi.dll","AGM.dll","sqlite.dll","userenv.dll","devobj.dll","dhcpcsvc.dll","dhcpcsvc6.dll","System.ni.dll","shlwapi.dll","System.dll","rsaenh.dll","RpcRtRemote.dll","NapiNSP.dll","pnrpnsp.dll","netprofm.dll","ccme_ecc.dll","ntdll.dll","mscoree.dll","rpcrt4.dll","cryptbase.dll","System.Drawing.dll","dwmapi.dll","devrtl.dll","BIB.dll","advapi32.dll","sechost.dll","mscoreei.dll","oleacc.dll","winnsi.dll","rasman.dll","mscms.dll","wship6.dll","KernelBase.dll","imm32.dll","mscorjit.dll","setupapi.dll","shdocvw.dll","sfc.dll","AcroRd32.dll","ccme_ecdrbg.dll","version.dll","msvcr100.dll","dnsapi.dll","AXSLE.dll","ccme_asym.dll","System.Drawing.ni.dll","System.Windows.Forms.ni.dll","shfolder.dll","msasn1.dll","Wldap32.dll","cryptocme.dll","ccme_base.dll","WSDApi.dll","msctf.dll","rpcss.dll","psapi.dll","wininet.dll","msftedit.dll","user32.dll","mscorwks.dll","AXE8SharedExpat.dll","mswsock.dll","SensApi.dll","wshqos.dll","mscorlib.ni.dll","msvcrt.dll","msvcr80.dll","shell32.dll","GdiPlus.dll","ieframe.dll","sfc_os.dll","rtutils.dll","nlaapi.dll","gdi32.dll","ole32.dll","oleaut32.dll","ntmarta.dll","mpr.dll","WSHTCPIP.DLL","FWPUCLNT.DLL","npmproxy.dll","lpk.dll","profapi.dll","CoolType.dll","ccme_base_non_fips.dll","mscorlib.dll","clbcatq.dll","propsys.dll","ws2_32.dll","msvcp100.dll","rasadhlp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"UserCache.bin","sha256":"18fb9fc1638745ae3ecad260783d528e1b93223d604cd6974fb4bdc89109af16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"Spotify.vbs","sha256":"cd8ea3e6e91f6ee1b6318ec4168693e4218acff016197c91cc21561b76e6038e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"48B76449F3D5FEFA1133AA805E420F0FCA643651.crl","sha256":"ce091c4f44a76f9d943fb55d71ca8fb7de9e7149609a3d8552f0e7094acd8197","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sha256":"e4b6aaa2312f828f82889184cf66a8ff977a23f1e3b5e9c4a1cf184a77f8a175","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"A9R9377.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"A9R9378.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"A9R9379.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"A9R937B.tmp","sha256":"5146ce6af73b43ce6f97dd4782510b477f26613c9f75b61d7019b1df220b1682","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"assets-170715223452Z-98048416","sha256":"7478d978724c4725e17239da8d19b083c27bf19f544665e89a06ce712ea83e27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"A9R937E.tmp","sha256":"3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"assets-170715223452Z-98048421","sha256":"5ae4a147bf8d36fc0c8fc945616475810f1b87e5b8c101d6761a5fe54608f270","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"A9R937C.tmp","sha256":"d1e10ebe9f745f12c7b29f0a7ca27c576c0ba1e37fdcc19563e822c6692a1d68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"assets-170715223452Z-98048407","sha256":"d1efe9940f6aa0ddce0fb19e0ce1b2662e67cace8f73e6ea7eb44986dc3885b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"A9R937D.tmp","sha256":"fa5fdebe80ec0ce7dc40738b4fd46a9e9b36eca6a810c523ee6ef3fd40b4179e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]}],"files_written":[{"path":"C:\\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.exe.config","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MARLETT.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ARIAL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ARIALI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ARIALBD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ARIALBI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BATANG.TTC","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\COUR.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\COURI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\COURBD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\COURBI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\DAUNPENH.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\DOKCHAMP.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ESTRE.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\EUPHEMIA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GAUTAMI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GAUTAMIB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\VANI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\VANIB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GULIM.TTC","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\IMPACT.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ISKPOTA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ISKPOTAB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\KALINGA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\KALINGAB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\KARTIKA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\KARTIKAB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\KHMERUI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\KHMERUIB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LAOUI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LAOUIB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LATHA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LATHAB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LUCON.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MALGUNBD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MANGAL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MANGALB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MEIRYO.TTC","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MEIRYOB.TTC","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\HIMALAYA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MSJHBD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MSYHBD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MINGLIU.TTC","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MINGLIUB.TTC","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MONBAITI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MSGOTHIC.TTC","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MSMINCHO.TTC","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MVBOLI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\NTAILU.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\NTAILUB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\NYALA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\PHAGSPA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\PHAGSPAB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\PLANTC.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\RAAVI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\RAAVIB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SEGOESC.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SEGOESCB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUII.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIZ.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SEGUISB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SEGUISYM.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SHRUTI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SHRUTIB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SIMSUN.TTC","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SIMSUNB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SYLFAEN.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TAILE.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TAILEB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TIMES.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TIMESI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TIMESBD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TIMESBI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TUNGA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TUNGAB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\VRINDA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\VRINDAB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SHONAR.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SHONARB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MSYI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TAHOMABD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ANGSA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ANGSAI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ANGSAB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ANGSAZ.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\APARAJ.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\APARAJB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\APARAJBI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\APARAJI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CORDIA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CORDIAI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CORDIAB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CORDIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\EBRIMA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\EBRIMABD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GISHA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GISHABD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\KOKILA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\KOKILAB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\KOKILABI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\KOKILAI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LEELAWAD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LEELAWDB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MSUIGHUR.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MOOLBOR.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SYMBOL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UTSAAH.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHBI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\VIJAYA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\VIJAYAB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\WINGDING.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MODERN.FON","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ROMAN.FON","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SCRIPT.FON","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ANDLSO.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ARABTYPE.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SIMPO.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SIMPBDO.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SIMPFXO.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MAJALLA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MAJALLAB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TRADO.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TRADBDO.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\AHRONBD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\DAVID.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\DAVIDBD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\FRANK.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LVNM.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LVNMBD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MRIAM.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MRIAMC.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\NRKIS.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ROD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SIMFANG.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SIMHEI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SIMKAI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ANGSAU.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BROWA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BROWAI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BROWAB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BROWAZ.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BROWAU.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BROWAUI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BROWAUB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BROWAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CORDIAU.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCDL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCDI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCDB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCDBI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCEL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCEI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCEB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCEBI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCFL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCFI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCFB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCFBI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCIL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCII.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCIB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCIBI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCJL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCJI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCJB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCJBI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCKL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCKI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCKB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCKBI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCLL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCLI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCLB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\UPCLBI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\KAIU.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\L_10646.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ARIBLK.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CALIBRI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CALIBRII.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CALIBRIB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CALIBRIZ.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIA.TTC","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CANDARA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CANDARAI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CANDARAB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CANDARAZ.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\COMIC.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\COMICBD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CONSOLA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAZ.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CONSTAN.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CONSTANI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CONSTANB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CONSTANZ.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CORBEL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CORBELI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CORBELB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CORBELZ.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\FRAMD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\FRAMDIT.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GABRIOLA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GEORGIA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\PALA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\PALAI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\PALAB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\PALABI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SEGOEPR.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SEGOEPRB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TREBUC.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TREBUCIT.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TREBUCBD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TREBUCBI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\WEBDINGS.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\COURE.FON","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SERIFE.FON","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SSERIFE.FON","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SMALLE.FON","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SMALLF.FON","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\HATTEN.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ANTQUAB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ANTQUABI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ANTQUAI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BKANT.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GOTHIC.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GOTHICB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GOTHICBI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GOTHICI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ARIALN.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ARIALNB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ARIALNBI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ARIALNI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GARA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GARABD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GARAIT.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MTCORSVA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\AGENCYB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\AGENCYR.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ARLRDBD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ITCBLKAD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BOD_B.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BOD_BI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BOD_I.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BOD_R.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BOD_BLAI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BOD_BLAR.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BOD_CB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BOD_CBI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BOD_CI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BOD_CR.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BOOKOS.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSBI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BRADHITC.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CALIST.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CALISTB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CALISTBI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CALISTI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CASTELAR.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CENSCBK.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKBI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\COPRGTB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\COPRGTL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CURLZ___.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ITCEDSCR.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ELEPHNT.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ELEPHNTI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ENGR.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ERASBD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ERASDEMI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ERASLGHT.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ERASMD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\FELIXTI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\FORTE.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\FRABK.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\FRABKIT.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\FRADM.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\FRADMIT.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\FRADMCN.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\FRAHV.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\FRAHVIT.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\FRAMDCN.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\FRSCRIPT.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GIGI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GILBI___.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GILB____.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GILI____.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GIL_____.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GILC____.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GILSANUB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GILLUBCD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GLSNECB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GLECB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GOUDOS.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GOUDOSB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GOUDOSI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\GOUDYSTO.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\IMPRISHA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LSANS.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LSANSD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LSANSDI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LSANSI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LTYPE.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LTYPEB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LTYPEBO.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LTYPEO.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MAIAN.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\OCRAEXT.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\PALSCRI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\PAPYRUS.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\PERBI___.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\PERB____.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\PERI____.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\PER_____.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\PERTIBD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\PERTILI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\PRISTINA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\RAGE.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ROCK.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ROCKB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ROCKBI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ROCKI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ROCCB___.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ROCC____.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ROCKEB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SCRIPTBL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TCBI____.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TCB_____.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TCCM____.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TCCB____.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TCCEB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TCMI____.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TCM_____.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ALGER.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BASKVILL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BAUHS93.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BELL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BELLB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BELLI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BRLNSB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BRLNSDB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BRLNSR.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BERNHC.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BOD_PSTC.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BRITANIC.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BROADW.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BRUSHSCI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CALIFB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CALIFI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CALIFR.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CENTAUR.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CHILLER.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\COLONNA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\COOPBL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\FTLTLT.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\FREESCPT.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\HARLOWSI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\HARNGTON.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\HTOWERT.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\HTOWERTI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\JOKERMAN.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\JUICE___.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ITCKRIST.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\KUNSTLER.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LBRITE.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LBRITED.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LBRITEDI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LBRITEI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LCALLIG.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LFAX.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LFAXD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LFAXDI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LFAXI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LHANDW.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MAGNETOB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MATURASC.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MISTRAL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MOD20.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\NIAGENG.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\NIAGSOL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\OLDENGL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ONYX.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\PARCHM.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\PLAYBILL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\POORICH.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\RAVIE.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\INFROMAN.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SHOWG.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SNAP____.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\STENCIL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TEMPSITC.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\VINERITC.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\VIVALDII.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\VLADIMIR.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\LATINWD.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\CENTURY.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\WINGDNG2.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\WINGDNG3.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\ARIALUNI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MSMINCHO.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%COMMONPROGRAMFILES%\\MICROSOFT SHARED\\EQUATION\\MTEXTRA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\OUTLOOK.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\BSSYM7.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\REFSAN.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\REFSPCL.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%APPDATA%\\Spotify","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"C:\\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.exe","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"C:\\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\system32\\reg.exe","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\system32\\PING.EXE","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\adobe\\reader 11.0\\reader\\locale\\de_de\\rdlang32.deu","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_rdlang32.deu","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%APPDATA%\\Spotify\\SpotifyWebHelper\\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.pdf","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\services_rdr.dat","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\services_rdri.dat","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\services_rdrk.dat","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\DEXEchoSign.spi","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\DEXShare.spi","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\files.acx","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\files.asfx","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\DEXEchoSign.asfx","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\DEXShare.asfx","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\Services.cfg","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\Services.asfx","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\adobe\\reader 11.0\\reader\\locale\\de_de\\Annots.DEU","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_Annots.DEU","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annots.api","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeComFnt11.lst","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeCMapFnt11.lst","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeSysFnt11.lst","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\AcroFnt11.lst","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\system32\\spool\\drivers\\color\\sRGB Color Space Profile.icm","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\adobe\\reader 11.0\\reader\\locale\\de_de\\Updater.DEU","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_Updater.DEU","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\IA32.api","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\UserCache.bin","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Updater.api","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%TEMP%\\A9R937B.tmp","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\adobe\\reader 11.0\\reader\\locale\\de_de\\AcroForm.DEU","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_AcroForm.DEU","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\adobe\\reader 11.0\\reader\\locale\\de_de\\EScript.DEU","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_EScript.DEU","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\JSCache\\GlobData","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\JSCache\\GlobSettings","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\JavaScripts\\JSByteCodeWin.bin","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\adobe\\reader 11.0\\reader\\locale\\de_de\\DigSig.DEU","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_DigSig.DEU","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\adobe\\reader 11.0\\reader\\locale\\de_de\\PPKLite.DEU","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_PPKLite.DEU","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\PPKLite.api","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\cryptocme.sig","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\cryptocme.dll","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"C:\\entropy","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_ecc_non_fips.dll","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_ecc_accel_fips.dll","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_ecc_accel_non_fips.dll","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_error_info.dll","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23b.dat","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\system32\\en-US\\PROPSYS.dll.mui","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%APPDATA%\\Spotify\\SpotifyWebHelper","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%APPDATA%\\Spotify\\SpotifyWebHelper\\Spotify.vbs","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\system32\\en-US\\reg.exe.mui","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.pdf","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%USERPROFILE%\\Searches\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"C:\\Users\\Wd8oO7T","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\system32\\en-US\\PING.EXE.mui","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\System32\\en-US\\PROPSYS.dll.mui","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\AppPatch\\pcamain.sdb","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe.config","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23c.dat","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%APPDATA%\\Spotify\\SpotifyWebHelper\\SpotifyWebHelper.exe","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\TAHOMA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MSJH.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MSYH.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MALGUN.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\MICROSS.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\VERDANA.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\VERDANAB.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\VERDANAI.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\FONTS\\VERDANAZ.TTF","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"key":"HKLM\\SYSTEM\\ACROBATVIEWERCPP477\\","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"key":"HKLM\\SOFTWARE\\ADOBE\\","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"key":"HKCU\\SOFTWARE\\ADOBE\\ACROBAT READER\\11.0\\EXITSECTION\\","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"key":"HKLM\\SYSTEM\\ACROBATVIEWERCPP477\\","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\-=Reyptson=-","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"-=Reyptson=-","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!wd8oo7t!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!wd8oo7t!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!wd8oo7t!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"Local\\c:!users!wd8oo7t!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCFKJGAAGAAAAA","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"Local\\c:!users!wd8oo7t!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"Local\\c:!users!wd8oo7t!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCFKJGAAGAAAAA","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"596a277f7ca3e15023254fb3"}]}]}},"report_ids":{"sandbox_job_ids":["596a277f7ca3e15023254fb3"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 1d2968648d8e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 1d2968648d8e…. Malware family: Trojan.Generic. Threat score 100/100. 21/29 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 1d2968648d8e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 1d2968648d8e…. Malware family: Trojan.Generic. Threat score 100/100. 21/29 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 1d2968648d8e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 1d2968648d8e…. Malware family: Trojan.Generic. Threat score 100/100. 21/29 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L58","11",{}]]