24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 40:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ursu.Generic Sample 527da5fd4e50… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 527da5fd4e50…. Malware family: Ursu.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 18 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/527da5fd4e501765cdd1bccb2f7c5ac76c0b22dfaf7c24e914df4e1cb8029d71","keywords":["Malicious","Ursu.Generic","malware analysis","sandbox report","threat intelligence","527da5fd4e501765cdd1bccb2f7c5ac76c0b22dfaf7c24e914df4e1cb8029d71"],"about":{"@type":"SoftwareApplication","name":"Neris.exe","applicationCategory":["peexe","executable"],"identifier":"527da5fd4e501765cdd1bccb2f7c5ac76c0b22dfaf7c24e914df4e1cb8029d71","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ursu.Generic","antivirusDetections":{"malicious":21,"total":26},"behavioralIndicators":{"malicious":18,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4e8,"Neris.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000018000000d9cc891b932fec7280000f01687d6c7628f00f01705fec729d006868feffffff44ef0f01e248eb72e8ee0f010000a676e0ef0f01fb48eb72e0dfbb7608000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000070ef0f010000000008000000000000000000000000000000000000000000000000000000c1cc891b00000000b0ef0f0169921276ffffffff3400000070ef0f0108000000000000000000a676e0ef0f012794127678ef0f010b00000000000000c8ef0f01 (UID: 00000000-00001980) "Neris.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001980)26:T1180,"Neris.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001980) "Neris.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001980)27:T520,"Neris.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Neris.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Neris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Neris.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "Neris.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Neris.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "Neris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Neris.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Neris.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "Neris.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "Neris.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")28:T9cc,"Neris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Neris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "NERIS.EXE"; Value: "") "Neris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Neris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "Neris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "Neris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Neris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Neris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "Neris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "Neris.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "Neris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "Neris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "Neris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "Neris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "Neris.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "Neris.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "Neris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "Neris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "Neris.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "")29:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001980.00000000.153965.031B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001980.00000000.153965.031B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001980.00000000.153965.031B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001980.00000000.153965.031B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001980.00000000.153965.031B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001980.00000000.153965.031B0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001980.00000000.153965.031B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001980.00000000.153965.031B0000.00000004.mdmp")2a:Tbb2,"csrss.exe" queries volume information of "%WINDIR%\winsxs\Manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest" at 00013608-00000368-0000010C-37698000 "csrss.exe" queries volume information of "%WINDIR%\winsxs\Manifests\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9.manifest" at 00013608-00000368-0000010C-37698934 "csrss.exe" queries volume information of "%WINDIR%\winsxs\Manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest" at 00013608-00000368-0000010C-37906022 "csrss.exe" queries volume information of "%WINDIR%\winsxs\Manifests\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9.manifest" at 00013608-00000368-0000010C-37907096 "csrss.exe" queries volume information of "%WINDIR%\winsxs\Manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest" at 00013608-00000368-0000010C-37952698 "csrss.exe" queries volume information of "%WINDIR%\winsxs\Manifests\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9.manifest" at 00013608-00000368-0000010C-37953768 "winlogon.exe" queries volume information of "C:\" at 00013609-00000408-0000010C-37669420 "svchost.exe" queries volume information of "C:" at 00013633-00000856-0000010C-98119875 "svchost.exe" queries volume information of "%WINDIR%\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb" at 00013645-00001124-0000010C-54387792 "svchost.exe" queries volume information of "%WINDIR%\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb" at 00013645-00001124-0000010C-54398909 "svchost.exe" queries volume information of "%WINDIR%\System32\catroot2\edb.chk" at 00013645-00001124-0000010C-54417987 "svchost.exe" queries volume information of "%WINDIR%\System32\catroot2\edb.log" at 00013645-00001124-0000010C-54419288 "svchost.exe" queries volume information of "%WINDIR%\System32\catroot2\edb.log" at 00013645-00001124-0000010C-54420432 "svchost.exe" queries volume information of "%WINDIR%\System32\catroot2\edb.log" at 00013645-00001124-0000010C-54422219 "svchost.exe" queries volume information of "%WINDIR%\System32\catroot2\edb.log" at 00013645-00001124-0000010C-54425040 "svchost.exe" queries volume information of "%WINDIR%\System32\catroot2\edb.chk" at 00013645-00001124-0000010C-54425903 "svchost.exe" queries volume information of "%WINDIR%\System32\catroot2\edb.log" at 00013645-00001124-0000010C-54427071 "svchost.exe" queries volume information of "%WINDIR%\System32\catroot2\edb.log" at 00013645-00001124-0000010C-54429745 "svchost.exe" queries volume information of "%WINDIR%\System32\catroot2\edb.log" at 00013645-00001124-0000010C-54431219 "svchost.exe" queries volume information of "%WINDIR%\System32\catroot2\edb.log" at 00013645-00001124-0000010C-544331212b:T1083,Process "csrss.exe" (UID: 00013608-00000368) was launched with modified environment variables: "TMP, PROCESSOR_REVISION, USERNAME, PROCESSOR_LEVEL, PROCESSOR_IDENTIFIER, TEMP" Process "csrss.exe" (UID: 00013608-00000368) was launched with missing environment variables: "ALLUSERSPROFILE, ProgramData, HOMEPATH, PUBLIC, PROMPT, LOGONSERVER, LOCALAPPDATA, USERDOMAIN, COMPUTERNAME, CommonProgramFiles, ProgramFiles, HOMEDRIVE, USERPROFILE, APPDATA" Process "winlogon.exe" (UID: 00013609-00000408) was launched with new environment variables: "ALLUSERSPROFILE="C:\ProgramData", ProgramData="C:\ProgramData", COMPUTERNAME="3QAEjOAhY9", PUBLIC="%APPDATA%\", Process "svchost.exe" (UID: 00013633-00000856) was launched with modified environment variables: "PROCESSOR_REVISION USERNAME PROCESSOR_LEVEL PROCESSOR_IDENTIFIER", Process "svchost.exe" (UID: 00013644-00000888) was launched with new environment variables: "LOCALAPPDATA="%WINDIR%\system32\config\systemprofile\AppData\Local" USERDOMAIN="3QAEjOAhY" APPDATA="%WINDIR%\system32\config\systemprofile\AppData\Roaming"", Process "svchost.exe" (UID: 00013644-00000888) was launched with modified environment variables: "USERNAME Path", Process "svchost.exe" (UID: 00013645-00001124) was launched with modified environment variables: "LOCALAPPDATA TMP USERDOMAIN USERPROFILE TEMP APPDATA", Process "svchost.exe" (UID: 00013645-00001124) was launched with missing environment variables: "LOGONSERVER HOMEPATH HOMEDRIVE", Process "dwm.exe" (UID: 00013646-00001256) was launched with new environment variables: "LOGONSERVER="\\PSPUBWS-PC" HOMEPATH="\Users\IIPqsf3" HOMEDRIVE="C:"", Process "dwm.exe" (UID: 00013646-00001256) was launched with modified environment variables: "LOCALAPPDATA TMP USERDOMAIN USERPROFILE TEMP APPDATA", Process "explorer.exe" (UID: 00013646-00001272) was launched with new environment variables: "LOGONSERVER="\\PSPUBWS-PC" HOMEPATH="\Users\IIPqsf3" SESSIONNAME="Console" HOMEDRIVE="C:"", Process "explorer.exe" (UID: 00013646-00001272) was launched with modified environment variables: "LOCALAPPDATA TMP USERDOMAIN USERPROFILE TEMP APPDATA", Process "spoolsv.exe" (UID: 00013647-00001312) was launched with modified environment variables: "LOCALAPPDATA TMP USERPROFILE TEMP APPDATA", Process "svchost.exe" (UID: 00013648-00001372) was launched with new environment variables: "ALLUSERSPROFILE="C:\ProgramData" LOCALAPPDATA="%WINDIR%\ServiceProfiles\LocalService\AppData\Local" ProgramData="C:\ProgramData" USERDOMAIN="3QAEjOAhY9" COMPUTERNAME="3QAEjOAhY9" PUBLIC="%APPDATA%\" Process "svchost.exe" (UID: 00013648-00001372) was launched with modified environment variables: "TMP, PROCESSOR_REVISION, USERNAME, PROCESSOR_LEVEL, PROCESSOR_IDENTIFIER, TEMP" Process "taskhost.exe" (UID: 00013648-00001384) was launched with new environment variables: "LOGONSERVER="\\PSPUBWS-PC", HOMEPATH="\Users\IIPqsf3", HOMEDRIVE="C:"" Process "taskhost.exe" (UID: 00013648-00001384) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERDOMAIN, USERPROFILE, TEMP, APPDATA" Process "svchost.exe" (UID: 00013649-00002016) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERDOMAIN, USERPROFILE, TEMP, APPDATA" Process "svchost.exe" (UID: 00013649-00002016) was launched with missing environment variables: "LOGONSERVER, HOMEPATH, HOMEDRIVE" Process "taskhost.exe" (UID: 00013650-00000808) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERDOMAIN, Path, USERPROFILE, TEMP, APPDATA" Process "WmiPrvSE.exe" (UID: 00013651-00003712) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERPROFILE, TEMP, APPDATA" Process "OSPPSVC.EXE" (UID: 00013651-00003976) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERDOMAIN, USERPROFILE, TEMP, APPDATA" Process "conhost.exe" (UID: 00013652-00002248) was launched with modified environment variables: "TMP, PROCESSOR_REVISION, USERNAME, PROCESSOR_LEVEL, PROCESSOR_IDENTIFIER, TEMP" Process "conhost.exe" (UID: 00013652-00002248) was launched with missing environment variables: "ALLUSERSPROFILE, LOCALAPPDATA, ProgramData, USERDOMAIN, COMPUTERNAME, PUBLIC, USERPROFILE, APPDATA"2c:T547,"hosts" has type "ASCII text with CRLF line terminators" "RacWmiEventData.dat" has type "data" "lastalive1.dat" has type "data" "RacMetaData.dat" has type "data" "Microsoft-Windows-WindowsUpdateClient%4Operational.evtx" has type "MS Windows Vista Event Log 6 chunks (no. 5 in use) next record no. 802" "SVCHOST.EXE-007FEA55.pf" has type "data" "lastalive0.dat" has type "data" "qmgr1.dat" has type "data" "Microsoft-Windows-CodeIntegrity%4Operational.evtx" has type "MS Windows Vista Event Log 1 chunks (no. 0 in use) next record no. 2 DIRTY" "cache.dat" has type "data" "qmgr0.dat" has type "data" "RacDatabase.sdf" has type "data" "Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx" has type "MS Windows Vista Event Log 1 chunks (no. 0 in use) next record no. 27 DIRTY" "ngen_service.log" has type "UTF-8 Unicode (with BOM) text with very long lines with CRLF line terminators" "tokens.dat" has type "data" "Security.evtx" has type "MS Windows Vista Event Log 26 chunks (no. 25 in use) next record no. 2411 DIRTY" "RacWmiDataBookmarks.dat" has type "dBase III DBT version number 0 next free block index 65567" "RacWmiDatabase.sdf" has type "data" "sqlA30A.tmp" has type "data" "Microsoft-Windows-WindowsBackup%4ActionCenter.evtx" has type "MS Windows Vista Event Log 1 chunks (no. 0 in use) next record no. 6 DIRTY"2d:T7c9,Injected into "csrss.exe" at 2017-7-25.01:28:24.534 (UID: 00013608-00000368) Injected into "winlogon.exe" at 2017-7-25.01:28:24.534 (UID: 00013609-00000408) Injected into "services.exe" at 2017-7-25.01:28:24.694 (UID: 00013612-00000452) Injected into "lsass.exe" at 2017-7-25.01:28:24.694 (UID: 00013614-00000460) Injected into "lsm.exe" at 2017-7-25.01:28:45.770 (UID: 00013615-00000468) Injected into "svchost.exe" at 2017-7-25.01:28:45.670 (UID: 00013617-00000576) Injected into "svchost.exe" at 2017-7-25.01:28:25.015 (UID: 00013623-00000688) Injected into "svchost.exe" at 2017-7-25.01:28:25.395 (UID: 00013627-00000740) Injected into "svchost.exe" at 2017-7-25.01:28:25.826 (UID: 00013633-00000856) Injected into "svchost.exe" at 2017-7-25.01:28:24.884 (UID: 00013644-00000888) Injected into "svchost.exe" at 2017-7-25.01:28:25.405 (UID: 00013645-00001000) Injected into "svchost.exe" at 2017-7-25.01:28:25.005 (UID: 00013645-00001124) Injected into "dwm.exe" at 2017-7-25.01:28:25.005 (UID: 00013646-00001256) Injected into "explorer.exe" at 2017-7-25.01:28:25.025 (UID: 00013646-00001272) Injected into "spoolsv.exe" at 2017-7-25.01:32:25.752 (UID: 00013647-00001312) Injected into "svchost.exe" at 2017-7-25.01:28:25.465 (UID: 00013648-00001372) Injected into "taskhost.exe" at 2017-7-25.01:29:12.779 (UID: 00013648-00001384) Injected into "taskeng.exe" at 2017-7-25.01:28:56.245 (UID: 00013649-00001440) Injected into "svchost.exe" at 2017-7-25.01:29:24.311 (UID: 00013649-00002016) Injected into "taskhost.exe" at 2017-7-25.01:28:25.826 (UID: 00013650-00000808) Injected into "WmiPrvSE.exe" at 2017-7-25.01:28:56.105 (UID: 00013651-00003712) Injected into "OSPPSVC.EXE" at 2017-7-25.01:28:46.531 (UID: 00013651-00003976) Injected into "conhost.exe" at 2017-7-25.01:28:25.445 (UID: 00013652-00002248) Injected into "conhost.exe" at 2017-7-25.01:28:25.505 (UID: 00013652-00002352) Injected into "mscorsvw.exe" at 2017-7-25.01:28:25.826 (UID: 00013653-00002492)2e:T69c,Found malicious artifacts related to "148.81.111.121" (ASN: , Owner: ): ... URL: http://ilo.brenz.pl/ (AV positives: 8/65 scanned on 07/24/2017 21:34:13) URL: http://www.brenz.pl/ (AV positives: 10/65 scanned on 07/24/2017 11:46:02) URL: http://148.81.111.121/ (AV positives: 2/66 scanned on 07/24/2017 08:11:09) URL: http://irc.zief.pl/ (AV positives: 7/65 scanned on 07/24/2017 06:01:15) URL: http://ant.trenz.pl/ (AV positives: 10/66 scanned on 07/24/2017 04:58:21) File SHA256: 8abed8163675bce72e5f51a634cdba2862ce316e02cf7691b23c6fd61b4a4d29 (AV positives: 51/61 scanned on 07/25/2017 00:33:39) File SHA256: 104df615fee22d700535a9cffb82f5ec2ee997f789c6ae018a35b6a5ed55f95e (AV positives: 54/64 scanned on 07/25/2017 00:31:16) File SHA256: b739d6bec386f0d1faf45f45c4a576ad6a679c2bf0f9b9bd72b47e27f8f47a8e (AV positives: 55/64 scanned on 07/25/2017 00:30:29) File SHA256: 6f84044c5d4f13e80f568e121052a3b8901e3f5a73ae08ff784d571b388d3679 (AV positives: 51/64 scanned on 07/25/2017 00:29:47) File SHA256: 8454e6a7627d3fe2106db0b6eaf442b7cf691ae8f411bdd70106f135a1ed4edf (AV positives: 55/63 scanned on 07/25/2017 00:27:54) File SHA256: 73b2b18d03a61638f3e4ebc4b83f9d05be98f43668b8eb4c3cc1cd9aafcad8ab (Scanned on 07/25/2017 00:53:46) File SHA256: 43966617768532e43ca097ecf2ebc88f33cfbf23a15c0eb9a9988175f329cdde (Scanned on 07/24/2017 20:53:12) File SHA256: 7d35c3ade26e1bf3d308fdb24a66af706c01d49dc4654596fb0b7c8af7c8efe1 (Scanned on 07/24/2017 20:44:37) File SHA256: b948cb6279a280abffae900fe01bf411e12fca36db26f7246acd22d9d0b40e95 (Scanned on 07/24/2017 03:33:56) File SHA256: a22df352193bdbe24e844dfe2bf0ed3777b2a413943c90c9d6610cc07f626876 (Scanned on 07/24/2017 03:33:09)2f:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==30:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==31:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzMzMzMzMzMzMzMzMAAAAAA4iIiIiIiIiIiIiAAAAAAAODMzMzM4MzMzMzgAAAAAADgEREREOARPREQ4AAAAAAA4BERERDgEREREOAAAAAAAOA9EREQ4BERERDgAAAAAADgERET0OAREREQ4AAAAAAA4BERERDgEREREOAAAAAAAOAT0REQ4BERPRDgAAAAAADgEREREOAREREQ4AAAAAAA4AAAAADgAAAAAOAAAAAAAOIiIiIiIiIiIiIgAAAAAADgzMzMzODMzMzM4AAAAAAA4BES7uzgHu3REOAAAAAAAOAREu7c4BEe0RDgAAAAAADgES7t0OARESEQ4AAAAAAA4BEu7dDgEREtEOAAAAAAAOARLt0Q4BERERDgAAAAAADgES7dEOAT0REQ4AAAAAAA4BEu3RDgEREREOAAAAAAAOIBEt0Q4BEREQ4gAAAAAAAOARLt0OAREREOAAAAAAAADgERLtDgE9ERDgAAAAAAAA4AEREs4BEREN4AAAAAAAAA4BEREOARERDgAAAAAAAAAA4APRDgERDOAAAAAAAAAAAA4gAQ4BDN4AAAAAAAAAAAAA4iAODOIgAAAAAAAAAAAAAAzOIiIAAAAAAAAAAAAAAAAAAMzMwAAAAAAAAD/////4AAAD+AAAA/wAAAf8AAAH/AAAB/wAAAf8AAAH/AAAB/wAAAf8AAAH/AAAB/wAAAf8AAAH/AAAB/wAAAf8AAAH/AAAB/wAAAf8AAAH/AAAB/wAAAf8AAAH/gAAD/4AAA/+AAAP/wAAH/+AAD//wAB//+AA///wAf///g//w==32:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==33:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==34:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==35:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==36:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==37:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==38:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==39:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==3a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==3b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==3c:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==3d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAABmZmZgAAAAAAZmZmYAAAAGeIiIZgAAAAAGiIiGYAB3d3iIiHd3d3d3dod3hnd3iPiIiIh4iIiIiIaIiIa7t4+IiIiIeIiIiIu2iIiGu7ePiIiIiHiIiIiIhoiIh7u3j4iIiIiId3d3d2eIiIiLt4+IiIiIiIiIiIiIiIj4i7ePiIiP/4iIiIiIiIiI+Iu3j4+P//+IiIiIiIiIiPiLh4+Pj////////4iIiIj4i4eP/4///4iIiIiIiIj/iIiHj//4iI+IiIh3d3d3d4iIh4/////4+IiIiIiIiIiIiIeP////iI+IiIiIiIiIiIiHj/////iI+IiIiIiIiIiIh4//////iIiIiIiIiIiIiIeP//////+IiIiIiIiIiIiHj///////+IiIiIiIiIiIh4/////////4j///////iIeP//////////+IiIiHd3eHiP/////////4iIiIiIiIh4iIiIiIiIiIiIjub///iIeIiIiIiIiIiIiI7u///4iHiIiIiIiImZ//iIh3d3d3dwiIiIiIiJmf///4iIiIiHAIiKov/4iIiIiId3d3d3dwCIiqr///+Ih3AAAAAAAAAACIiIiIiIiHcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwH/gP4A/4BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAGAAD//wAB//////////////////w==3e:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==3f:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"527da5fd4e501765cdd1bccb2f7c5ac76c0b22dfaf7c24e914df4e1cb8029d71","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790267856751,"unified_at":"2026-09-24T16:37:36.751Z","metadata":{"hashes":{"sha256":"527da5fd4e501765cdd1bccb2f7c5ac76c0b22dfaf7c24e914df4e1cb8029d71","sha1":"5c2ba68d78471ff02adcdab12b2f82db8efe2104","md5":"bf08e6b02e00d2bc6dd493e93e69872f","sha512":"b1bd7a96ded16fdbe3e7501125e08dc84de75020a9301516b9501045485f551e4fbdd7a0a9146d8d86677f98312e223c68e3410e703faa85d9d5a29922a9cf01","ssdeep":"768:3uKuCkdC2D5z4oWV0OCAB4Rld8Inv47erVe6ARm6v+kM8yR+4V:3Tjkdjl8WK4RP84vkeIzvlM8yR+2","ssdeep_chunks":["768:3uKuCkd","768:uKuCkdC","768:KuCkdC2","768:uCkdC2D","768:CkdC2D5","768:kdC2D5z","768:dC2D5z4","768:C2D5z4o","768:2D5z4oW","768:D5z4oWV","768:5z4oWV0","768:z4oWV0O","768:4oWV0OC","768:oWV0OCA","768:WV0OCAB","768:V0OCAB4","768:0OCAB4R","768:OCAB4Rl","768:CAB4Rld","768:AB4Rld8","768:B4Rld8I","768:4Rld8In","768:Rld8Inv","768:ld8Inv4","768:d8Inv47","768:8Inv47e","768:Inv47er","768:nv47erV","768:v47erVe","768:47erVe6","768:7erVe6A","768:erVe6AR","768:rVe6ARm","768:Ve6ARm6","768:e6ARm6v","768:6ARm6v+","768:ARm6v+k","768:Rm6v+kM","768:m6v+kM8","768:6v+kM8y","768:v+kM8yR","768:+kM8yR+","768:kM8yR+4","768:M8yR+4V","1536:3uKuCkd","1536:uKuCkdC","1536:KuCkdC2","1536:uCkdC2D","1536:CkdC2D5","1536:kdC2D5z","1536:dC2D5z4","1536:C2D5z4o","1536:2D5z4oW","1536:D5z4oWV","1536:5z4oWV0","1536:z4oWV0O","1536:4oWV0OC","1536:oWV0OCA","1536:WV0OCAB","1536:V0OCAB4","1536:0OCAB4R","1536:OCAB4Rl","1536:CAB4Rld","1536:AB4Rld8","1536:B4Rld8I","1536:4Rld8In","1536:Rld8Inv","1536:ld8Inv4","1536:d8Inv47","1536:8Inv47e","1536:Inv47er","1536:nv47erV","1536:v47erVe","1536:47erVe6","1536:7erVe6A","1536:erVe6AR","1536:rVe6ARm","1536:Ve6ARm6","1536:e6ARm6v","1536:6ARm6v+","1536:ARm6v+k","1536:Rm6v+kM","1536:m6v+kM8","1536:6v+kM8y","1536:v+kM8yR","1536:+kM8yR+","1536:kM8yR+4","1536:M8yR+4V","768:3Tjkdjl","768:Tjkdjl8","768:jkdjl8W","768:kdjl8WK","768:djl8WK4","768:jl8WK4R","768:l8WK4RP","768:8WK4RP8","768:WK4RP84","768:K4RP84v","768:4RP84vk","768:RP84vke","768:P84vkeI","768:84vkeIz","768:4vkeIzv","768:vkeIzvl","768:keIzvlM","768:eIzvlM8","768:IzvlM8y","768:zvlM8yR","768:vlM8yR+","768:lM8yR+2"]},"file_info":{"file_name":"Neris.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":586240,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499288088000,"last_seen":1714683587000,"last_multi_scan":1714683587000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["agent"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":26},"sandbox_signatures":{"informative_count":56,"suspicious_count":26,"malicious_count":18,"total":100},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Worm/Win32.AutoRun","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HTML/Virut.DC.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ursu.951389","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Virut.CE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ursu.951389 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Virut.NBM virus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Virus/Virut.ba","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004bcce41 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"W32/Virut.n.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Virut.hpeg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"W32/Scribble-B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Genome.586240.C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Virut.A.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Virus.Virut.05","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Genome.Win32.29802","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ursu.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"Replication Through Removable Media","attack_id":"T1091","attack_id_wiki":"https://attack.mitre.org/techniques/T1091","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Persistence","technique":"AppInit DLLs","attack_id":"T1546.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/010","identifiers":[{"type":"informative","value":"Contains ability to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has a section name known to be used by a packer/protector"},{"type":"suspicious","value":"PE file contains unusual section name"},{"type":"suspicious","value":"PE file is packed with UPX"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify System Firewall","attack_id":"T1562.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/004","identifiers":[{"type":"informative","value":"Found registry location string related to firewall policy"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Creates mutants","description":"\"L0aR\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b83"},{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"},{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly checks for the presence of an Antivirus engine","description":"\"arcabit\" (Indicator: \"arcabit\")\n \"emsisoft\" (Indicator: \"emsisoft\")\n \"ikarus\" (Indicator: \"ikarus\")\n \"fortinet\" (Indicator: \"fortinet\")\n \"clamav\" (Indicator: \"clamav\")\n \"comodo\" (Indicator: \"comodo\")\n \"quickheal\" (Indicator: \"quickheal\")\n \"avira\" (Indicator: \"avira\")\n \"avast\" (Indicator: \"avast\")\n \"ahnlab\" (Indicator: \"ahnlab\")","origin":"File/Memory","relevance":3,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b83"},{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"Section name UPX0\n Section name UPX1\n Section name UPX2","origin":"Static Parser","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b83"},{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"},{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"},{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Creates a mutant that has been seen in the context of malware","description":"\"L0aR\"","origin":"Created Mutant","relevance":6,"id":"mutant-2","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b83"},{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"46/56 Antivirus vendors marked sample as malicious (82% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b83"},{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"},{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"46/56 Antivirus vendors marked sample as malicious (82% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b83"},{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"},{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Entrypoint points to uncommon section","description":"UPX2","origin":"Static Parser","relevance":5,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b83"},{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"\"\" loaded module \"C:\\WINDOWS\\system32\\faultrep.dll\" at 69450000","origin":"Loaded Module","id":"module-1","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"},{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"23.61.181.163:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"},{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"NTDLL.DLL\" at base 77DD0000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"},{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"CreateProcessAsUserSecure@ADVAPI32.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"level":"informative","category":"General","name":"Writes to file(s) in the user home directory","description":"\"\" wrote 2 bytes to file \"C:\\DOCUME~1\\PSPUBWS\\LOCALS~1\\Temp\\bf87_appcompat.txt\"","origin":"API Call","relevance":5,"id":"api-3","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is protecting 1048576 bytes with PAGE_GUARD access rights in foreign process (Handle: 192)","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a child process (PID: 00002324, Name: \"dwwin.exe\")\n \"\" is creating a child process (PID: 00001508, Name: \"drwtsn32.exe\")","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\WINDOWS\\system32\\drwtsn32.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 23.61.181.163 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":10,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Possibly tries to hide a process launching it with different user credentials","description":"CreateProcessAsUserSecure@ADVAPI32.DLL at 07317662-00003520-7C917E88-7346613","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-42","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00001916 bytes of memory in \"drwtsn32.exe\" (Protection: \"read/write\")\n \"\" allocated 00001700 bytes of memory in \"drwtsn32.exe\" (Protection: \"read/write\")\n \"\" allocated 00000388 bytes of memory in \"drwtsn32.exe\" (Protection: \"read/write\")\n \"\" allocated 00262144 bytes of memory in \"drwtsn32.exe\" (Protection: \"read/write\")\n \"\" allocated 00008192 bytes of memory in \"drwtsn32.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 1916 bytes to a foreign process \"dwwin.exe\" (PID: 00002324)\n \"\" wrote 1668 bytes to a foreign process \"dwwin.exe\" (PID: 00002324)\n \"\" wrote 4 bytes to a foreign process \"dwwin.exe\" (PID: 00002324)\n \"\" wrote 388 bytes to a foreign process \"dwwin.exe\" (PID: 00002324)\n \"\" wrote 1916 bytes to a foreign process \"drwtsn32.exe\" (PID: 00001508)\n \"\" wrote 1700 bytes to a foreign process \"drwtsn32.exe\" (PID: 00001508)\n \"\" wrote 4 bytes to a foreign process \"drwtsn32.exe\" (PID: 00001508)\n \"\" wrote 388 bytes to a foreign process \"drwtsn32.exe\" (PID: 00001508)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"},{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"Neris.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001980.00000000.153965.031B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$25","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"Neris.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Neris.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindow\"; File: \"Neris.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"tlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00001980.00000000.153965.031B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to firewall policy","description":"Found string \"SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List\" (Indicator: \"services\\sharedaccess\\parameters\\firewallpolicy\"; File: \"Neris.exe\")","origin":"File/Memory","mitre_attack_id":"T1562.004","relevance":1,"id":"string-415","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"Neris.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001980)\n \"Neris.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001980)\n \"Neris.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001980)\n \"Neris.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00001980)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$26","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"LoadLibraryA\"; File: \"Neris.exe\")\n Found reference to API (Indicator: \"GetProcAddress\"; File: \"Neris.exe\")\n Found reference to API (Indicator: \"ExitProcess\"; File: \"Neris.exe\")\n Found reference to API (Indicator: \"GetUserNameA\"; File: \"Neris.exe\")\n Found reference to API (Indicator: \"FindWindowA\"; File: \"Neris.exe\")\n Found reference to API (Indicator: \"MessageBoxA\"; File: \"Neris.exe\")\n Found reference to API (Indicator: \"LookupPrivilegeValueA\"; File: \"Neris.exe\")\n Found reference to API (Indicator: \"wsprintfA\"; File: \"Neris.exe\")\n Found reference to API (Indicator: \"SetFileSecurityA\"; File: \"Neris.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"General","name":"Contains ability to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read PEB structure (dword ptr fs:[00000030h]) (Offset: 566261)","origin":"Binary File","mitre_attack_id":"T1546.010","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List\" in Source: Neris.exe\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\" in Source: Neris.exe","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Neris.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 772B0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Neris.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76480000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Neris.exe\" was detected as \"VMProtect\" and name: \"Protector\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Neris.exe\" has an executable section named \"UPX0\"\n \"Neris.exe\" has an executable section named \"UPX1\"\n \"Neris.exe\" has an executable section named \"UPX2\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Neris.exe\" has an writable section named \"UPX0\"\n \"Neris.exe\" has an writable section named \"UPX1\"\n \"Neris.exe\" has an writable section named \"UPX2\"\n \"Neris.exe\" has an writable section named \".idata2\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"Neris.exe\" file has an entrypoint instructions - \"or\tbh, 0,call\t0x48eae9,lea\teax, [eax],cld\t,not\tesp,not\tesp,pushal\t,lea\tebx, [esp + 0xd],dec\tecx,and\tebp, 0,jmp\t0x48ee88,sub\tal, 0xe6,mov\tedx, 0x7a9e86e5,xchg\tah, ah,sub\tesp, 0x14,and\tdl, bl,cmp\tdh, 0xc9,not\tdh,xchg\tdh, ch,mov\tedx, esi,call\t0x48ece8,nop\t,not\tesp,not\tesp,add\tedi, ebp,sub\tedi, ebp,lea\tecx, [ebp + 0x1d8],jmp\t0x48eb48,push\tebx,ret\t0x5962,cmc\t,clc\t,adc\tedi, edx,xor\tedi, 0xffffff80,xchg\tdh, ch,xchg\tdh, ch,not\tch,not\tch,inc\tecx,nop\t,lodsd\teax, dword ptr [esi],not\tebp,not\tebp,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"Neris.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"},{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 440 -p 1980 -ip 1980\" (UID: 00000000-00005096)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1980 -s 384\" (UID: 00000000-00000704)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1980 -s 384\" (UID: 00000000-00007572)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"},{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 440 -p 1980 -ip 1980\" (UID: 00000000-00005096)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1980 -s 384\" (UID: 00000000-00000704)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1980 -s 384\" (UID: 00000000-00007572)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Neris.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"Neris.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$27","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Neris.exe\" queries basic process information of the \"C:\\Neris.exe\" (UID: 1980)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$28","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Neris.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"Neris.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"Neris.exe\" trying to touch file \"C:\\Neris.exe\"\n \"Neris.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"Neris.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"Neris.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"Neris.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"Neris.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"Neris.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"Neris.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"127.0.0.1\" found in string \"127.0.0.1 jL.chura.pl#\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"},{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"irc.zief.pl\"\n Heuristic match: \"proxim.ircgalaxy.pl\"\n Pattern match: \"http://jL.chura.pl/rc/\"\n Pattern match: \"http://www.w3.org/2001/XMLSchema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"},{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Neris.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"Neris.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; File: \"Neris.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\PhysicalMemory\" (Indicator: \"\\Device\\\"; File: \"Neris.exe\")\n Found string \"\\DRIVERS\\ETC\" (Indicator: \"\\drivers\\\"; File: \"Neris.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; File: \"Neris.exe\")\n Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; File: \"Neris.exe\")\n Found reference to API \"SeBackupPrivilege\" (Indicator: \"SeBackupPrivilege\"; File: \"Neris.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"Neris.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeTakeOwnershipPrivilege\" (Indicator: \"SeTakeOwnershipPrivilege\"; File: \"Neris.exe\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; File: \"Neris.exe\")\n Found reference to API \"SeChangeNotifyPrivilege\" (Indicator: \"SeChangeNotifyPrivilege\"; File: \"Neris.exe\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Neris.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"Neris.exe\" queried SystemProcessInformation at 00000000-00001980-00000C13-1404358193 [PID: 1980]\n \"Neris.exe\" queried SystemProcessInformation at 00000000-00001980-00000C13-1404381938 [PID: 1980]\n \"Neris.exe\" queried SystemProcessInformation at 00000000-00001980-00000C13-1404616519 [PID: 1980]\n \"Neris.exe\" queried SystemProcessInformation at 00000000-00001980-00000C13-1404625116 [PID: 1980]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"Neris.exe queries ProcessDebugPort (UID: 1980)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"Neris.exe\" has an entrypoint in section \"UPX2\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"},{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"Neris.exe\" has a section named \"UPX0\"\n \"Neris.exe\" has a section named \"UPX1\"\n \"Neris.exe\" has a section named \"UPX2\"\n \"Neris.exe\" has a section named \".idata2\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file has a section name known to be used by a packer/protector","description":"\"Neris.exe\" has a section named \"UPX0\" which is known to be used by \"UPX packer\"\n \"Neris.exe\" has a section named \"UPX1\" which is known to be used by \"UPX packer\"\n \"Neris.exe\" has a section named \"UPX2\" which is known to be used by \"UPX packer\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-75","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2a","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"winlogon.exe\" queries volume information of \"C:\\\" at 00013609-00000408-0000010C-37669420","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"irc.zief.pl\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$2b","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"explorer.exe\" searching for class \"Shell_TrayWnd\"\n \"explorer.exe\" searching for class \"SystemTray_Main\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$2c","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"csrss.exe\" touched file \"%WINDIR%\\WinSxS\\manifests\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest\"\n \"csrss.exe\" touched file \"%WINDIR%\\WinSxS\\manifests\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9.manifest\"\n \"winlogon.exe\" touched file \"%WINDIR%\\system32\\DRIVERS\\ETC\\HOSTS\"\n \"winlogon.exe\" touched file \"%WINDIR%\\system32\\config\\systemprofile\"\n \"winlogon.exe\" touched file \"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Local\"\n \"winlogon.exe\" touched file \"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\"\n \"winlogon.exe\" touched file \"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Roaming\"\n \"winlogon.exe\" touched file \"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"mscorsvw.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"svchost.exe\" sleeping for \"00121000\" milliseconds\n \"svchost.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"5/65 reputation engines marked \"http://proxim.ircgalaxy.pl\" as malicious (7% detection rate)\n 10/65 reputation engines marked \"http://jl.chura.pl\" as malicious (15% detection rate)\n 7/65 reputation engines marked \"http://irc.zief.pl\" as malicious (10% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"svchost.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"svchost.exe\" called \"OpenService\" to access the \" \" service\n \"svchost.exe\" called \"OpenService\" to access the \"FontCache\" service\n \"svchost.exe\" called \"OpenService\" to access the \"]\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"suspicious","category":"Network Related","name":"Reads the hosts file","description":"\"svchost.exe\" read 4096 bytes from file \"%WINDIR%\\System32\\drivers\\etc\\hosts\"","origin":"API Call","relevance":10,"id":"api-33","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"winlogon.exe\" had access to \"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat\" (Type: \"FileHandle\")\n \"winlogon.exe\" had access to \"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"winlogon.exe\" had access to \"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"%WINDIR%\\System32\\taskhost.exe\" marked \"%ALLUSERSPROFILE%\\Microsoft\\RAC\\Temp\\sqlA31F.tmp\" for deletion\n \"%WINDIR%\\System32\\taskhost.exe\" marked \"%ALLUSERSPROFILE%\\Microsoft\\RAC\\Temp\\sqlA30A.tmp\" for deletion\n \"%COMMONPROGRAMFILES%\\microsoft shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\" marked \"%ALLUSERSPROFILE%\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat.bak\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"svchost.exe\" opened \"%WINDIR%\\system32\\CatRoot2\\edbtmp.log\" with delete access\n \"svchost.exe\" opened \"%WINDIR%\\system32\\CatRoot2\\res1.log\" with delete access\n \"svchost.exe\" opened \"%WINDIR%\\system32\\CatRoot2\\res2.log\" with delete access\n \"taskhost.exe\" opened \"%ALLUSERSPROFILE%\\Microsoft\\RAC\\Temp\\sqlA31F.tmp\" with delete access\n \"taskhost.exe\" opened \"%ALLUSERSPROFILE%\\Microsoft\\RAC\\Temp\\sqlA30A.tmp\" with delete access\n \"OSPPSVC.EXE\" opened \"%ALLUSERSPROFILE%\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat.bak\" with delete access\n \"mscorsvw.exe\" opened \"%WINDIR%\\Microsoft.NET\\ngenserviceclientlock.dat\" with delete access\n \"mscorsvw.exe\" opened \"%WINDIR%\\Microsoft.NET\\ngenservice_pri0_lock.dat\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"winlogon.exe\" (Access type: \"SETVAL\"; Path: \"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"winlogon.exe\" (Access type: \"DELETEVAL\"; Path: \"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"winlogon.exe\" (Access type: \"DELETEVAL\"; Path: \"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"explorer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"mscorsvw.exe\" wrote bytes \"273e4476efb2487651c1427694984276ee9c427675dc44760000000046ba8e7792bb8e770abf8e77013d8f7738ed8f77cfcd8e7731238e77de2f8f77c4ca8e7780bb8e77aa6e8f7746ce8e779fbb8e7700000000ef52ce77f764ce7700000000\" to virtual address \"0x6BB01000\" (part of module \"MSIDLE.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET TROJAN Reply Sinkhole - irc-sinkhole.cert.pl\" (SID: 2019354, Rev: 1, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"malicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines","description":"5/65 reputation engines marked \"http://proxim.ircgalaxy.pl\" as malicious (7% detection rate)\n 10/65 reputation engines marked \"http://jl.chura.pl\" as malicious (15% detection rate)\n 7/65 reputation engines marked \"http://irc.zief.pl\" as malicious (10% detection rate)","origin":"External System","relevance":10,"id":"avtest-7","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00013646-00001272)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into remote processes","description":"$2d","origin":"Monitored Target","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2e","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 148.81.111.121 on port 65520","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"malicious","category":"Network Related","name":"Writes to the hosts file","description":"\"winlogon.exe\" wrote 24 bytes to file \"%WINDIR%\\System32\\drivers\\etc\\hosts\" (Byte Offset: 0): 127.0.0.1 jL.chura.pl\n#\n \"winlogon.exe\" wrote to file \"%WINDIR%\\System32\\drivers\\etc\\hosts\"\n \"svchost.exe\" wrote to file \"%WINDIR%\\System32\\drivers\\etc\\hosts\"","origin":"API Call","relevance":10,"id":"api-32","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"mimikatz_lsass_mdmp\" matched process \"lsass.exe\" as \"LSASS minidump file for mimikatz\" based on indicators: \"System32\\lsass.exe\" (Author: Benjamin DELPY (gentilkiwi))","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"Modifies firewall settings","origin":"Registry Access","relevance":9,"id":"registry-12","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"\"%SystemRoot%\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16\"","origin":"File/Memory","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"winlogon.exe\" touched \"K:\"\n \"winlogon.exe\" touched \"L:\"\n \"winlogon.exe\" touched \"M:\"\n \"winlogon.exe\" touched \"N:\"\n \"winlogon.exe\" touched \"O:\"\n \"winlogon.exe\" touched \"P:\"\n \"winlogon.exe\" touched \"Q:\"\n \"winlogon.exe\" touched \"R:\"\n \"winlogon.exe\" touched \"S:\"\n \"winlogon.exe\" touched \"T:\"\n \"winlogon.exe\" touched \"U:\"\n \"winlogon.exe\" touched \"V:\"\n \"winlogon.exe\" touched \"W:\"\n \"winlogon.exe\" touched \"X:\"\n \"winlogon.exe\" touched \"Y:\"","origin":"API Call","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"},{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"},{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"PE file has a section name known to be used by a packer/protector"}],"sources":[{"report_type":"sandbox","report_id":"6633fec3731376ae750ca38a"},{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"Remote Access","details_count":2,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Writes to the hosts file"},{"detail":"Injects into remote processes"},{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"Spreading","details_count":2,"details":[{"detail":"Tries to access unusual system drive letters"},{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]}]},"activity":{"stats":{"process_count":27,"spawned_processes_count":27,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":23,"imported_dlls_count":109,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":950,"files_deleted_count":0,"registry_keys_created_count":45,"registry_keys_modified_count":0,"registry_keys_deleted_count":3,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":48,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["agent"],"sample_flags":["Sample Crashed","Sample not shared","User Comment","Network Traffic","Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6633fec3731376ae750ca38a","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"Neris.exe","analysis_start_time":"2024-05-02T20:59:47+00:00","indicators_count":{"informative":45,"suspicious":9,"malicious":1},"tags":["Sample Crashed","User Comment"],"is_in_unified_schema":true},{"id":"5ca68089038838a330f26b98","environment_id":120,"environment_description":"Windows 7 64 bit","state":"ERROR","error_type":"Internal error has occurred (Code: DSM:TIMED-OUT)","verdict":"undetected","threat_score":100,"malware_family":"Virus.Virut","submit_name":"Neris.exe","analysis_start_time":"2019-10-28T06:03:19+00:00","indicators_count":{"informative":2,"suspicious":10,"malicious":4},"is_in_unified_schema":false},{"id":"5882ac65aac2ed2a1653a092","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Virus.Virut","contacted_countries":["POL","USA"],"submit_name":"Neris.exe","analysis_start_time":"2017-07-25T01:27:23+00:00","indicators_count":{"informative":12,"suspicious":26,"malicious":17},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"56250c240e316ddb42e35b85","environment_id":6,"environment_description":"Windows XP - Accepts PE only","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Virus.Virut","contacted_countries":["USA"],"submit_name":"Neris.exe","analysis_start_time":"2015-10-19T11:49:05+00:00","indicators_count":{"informative":6,"suspicious":8,"malicious":8},"tags":["Network Traffic","Sample not shared","User Comment"],"is_in_unified_schema":true},{"id":"56250c240e316ddb42e35b83","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":92,"malware_family":"Virus.Virut","submit_name":"Neris.exe","analysis_start_time":"2015-10-19T12:04:23+00:00","indicators_count":{"informative":1,"suspicious":3,"malicious":3},"tags":["Sample Crashed","Sample not shared","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"23.61.181.163","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"address":"148.81.111.121","port":65520,"protocol":"TCP","country":"Poland","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"address":"216.58.206.238","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]}],"dns_resolutions":[{"domain":"irc.zief.pl","address":"148.81.111.121","country":"Poland","registrar_creation_date":"2005-07-25T15:58:55+00:00","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}],"processes":[{"pid":2544,"ppid":0,"name":"Neris.exe","command_line":"","sha256":"527da5fd4e501765cdd1bccb2f7c5ac76c0b22dfaf7c24e914df4e1cb8029d71","normalized_path":"C:\\Neris.exe","uid":"00013496-00002544","icon":"$2f"},{"pid":368,"ppid":2544,"name":"csrss.exe","command_line":"%SystemRoot%\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16","sha256":"f9112b88fec5ef10a7aedf88dcee61956d1fcde7cb42197216e8265578713786","normalized_path":"%WINDIR%\\System32\\csrss.exe","parent_uid":"00013496-00002544","uid":"00013608-00000368","icon":"$30"},{"pid":408,"ppid":2544,"name":"winlogon.exe","command_line":"","sha256":"be40e84a824cb201f9c54db4f860f3937630fda3423940d44fcf4ac5dff44271","normalized_path":"%WINDIR%\\System32\\winlogon.exe","parent_uid":"00013496-00002544","uid":"00013609-00000408","icon":"$31"},{"pid":452,"ppid":2544,"name":"services.exe","command_line":"","sha256":"d7bc4ed605b32274b45328fd9914fb0e7b90d869a38f0e6f94fb1bf4e9e2b407","normalized_path":"%WINDIR%\\System32\\services.exe","parent_uid":"00013496-00002544","uid":"00013612-00000452","icon":"$32"},{"pid":2472,"ppid":452,"name":"svchost.exe","command_line":"-k LocalServiceAndNoImpersonation","sha256":"121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00013612-00000452","uid":"00013975-00002472","icon":"$33"},{"pid":460,"ppid":2544,"name":"lsass.exe","command_line":"","sha256":"29b0a8889857cebfa6cbd795d5eecddffa04e794bd3c73fc488725b2a160f326","normalized_path":"%WINDIR%\\System32\\lsass.exe","parent_uid":"00013496-00002544","uid":"00013614-00000460","icon":"$34"},{"pid":468,"ppid":2544,"name":"lsm.exe","command_line":"","sha256":"939903f93ff37525a6c4b5cba29cdeee6d6055c42d605e80ae787f2a76f9870e","normalized_path":"%WINDIR%\\System32\\lsm.exe","parent_uid":"00013496-00002544","uid":"00013615-00000468"},{"pid":576,"ppid":2544,"name":"svchost.exe","command_line":"-k DcomLaunch","sha256":"121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00013496-00002544","uid":"00013617-00000576","icon":"$35"},{"pid":688,"ppid":2544,"name":"svchost.exe","command_line":"-k RPCSS","sha256":"121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00013496-00002544","uid":"00013623-00000688","icon":"$36"},{"pid":740,"ppid":2544,"name":"svchost.exe","command_line":"-k LocalServiceNetworkRestricted","sha256":"121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00013496-00002544","uid":"00013627-00000740","icon":"$37"},{"pid":856,"ppid":2544,"name":"svchost.exe","command_line":"-k LocalSystemNetworkRestricted","sha256":"121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00013496-00002544","uid":"00013633-00000856","icon":"$38"},{"pid":888,"ppid":2544,"name":"svchost.exe","command_line":"-k netsvcs","sha256":"121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00013496-00002544","uid":"00013644-00000888","icon":"$39"},{"pid":1000,"ppid":2544,"name":"svchost.exe","command_line":"-k LocalService","sha256":"121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00013496-00002544","uid":"00013645-00001000","icon":"$3a"},{"pid":1124,"ppid":2544,"name":"svchost.exe","command_line":"-k NetworkService","sha256":"121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00013496-00002544","uid":"00013645-00001124","icon":"$3b"},{"pid":1256,"ppid":2544,"name":"dwm.exe","command_line":"","sha256":"526f07768471f4457cbeab7093af0b0242044c89a80a347db47f44ebadeea68d","normalized_path":"%WINDIR%\\System32\\dwm.exe","parent_uid":"00013496-00002544","uid":"00013646-00001256","icon":"$3c"},{"pid":1272,"ppid":2544,"name":"explorer.exe","command_line":"","sha256":"0a8ce026714e03e72c619307bd598add5f9b639cfd91437cb8d9c847bf9f6894","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00013496-00002544","uid":"00013646-00001272","icon":"$3d"},{"pid":1312,"ppid":2544,"name":"spoolsv.exe","command_line":"","sha256":"b2be846b5167a2ecd1e30c69a81385fcc6eae6033394d08458a5583d311c4d82","normalized_path":"%WINDIR%\\System32\\spoolsv.exe","parent_uid":"00013496-00002544","uid":"00013647-00001312"},{"pid":1372,"ppid":2544,"name":"svchost.exe","command_line":"-k LocalServiceNoNetwork","sha256":"121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00013496-00002544","uid":"00013648-00001372","icon":"$3e"},{"pid":1384,"ppid":2544,"name":"taskhost.exe","command_line":"","sha256":"65e3d8ce737896647065103fbb4d58e6a34171d0a48662a832cfdac3cf469701","normalized_path":"%WINDIR%\\System32\\taskhost.exe","parent_uid":"00013496-00002544","uid":"00013648-00001384"},{"pid":1440,"ppid":2544,"name":"taskeng.exe","command_line":"{E7DA545A-EC35-4F86-8C59-F25D1266842E}","sha256":"9e70685b73b3eab78c55863babceecc7cca89475b508b2a9c651ade6fde0751a","normalized_path":"%WINDIR%\\System32\\taskeng.exe","parent_uid":"00013496-00002544","uid":"00013649-00001440"},{"pid":2016,"ppid":2544,"name":"svchost.exe","command_line":"-k NetworkServiceNetworkRestricted","sha256":"121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00013496-00002544","uid":"00013649-00002016","icon":"$3f"},{"pid":808,"ppid":2544,"name":"taskhost.exe","command_line":"$$(Arg0)","sha256":"65e3d8ce737896647065103fbb4d58e6a34171d0a48662a832cfdac3cf469701","normalized_path":"%WINDIR%\\System32\\taskhost.exe","parent_uid":"00013496-00002544","uid":"00013650-00000808"},{"pid":3712,"ppid":2544,"name":"WmiPrvSE.exe","command_line":"","sha256":"cbe2392792d209e15e44ac29e906ffdd5fbf6eed8bab0d97d66e109ab2c5c56e","normalized_path":"%WINDIR%\\System32\\wbem\\WmiPrvSE.exe","parent_uid":"00013496-00002544","uid":"00013651-00003712"},{"pid":3976,"ppid":2544,"name":"OSPPSVC.EXE","command_line":"","sha256":"f342100e2e9001f11fdf93f856b50fa43f9b85d2c6b5706ec0433e77206498da","normalized_path":"%COMMONPROGRAMFILES%\\microsoft shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE","parent_uid":"00013496-00002544","uid":"00013651-00003976"},{"pid":2248,"ppid":2544,"name":"conhost.exe","command_line":"","sha256":"b3bbcd2ff46233d6f64776b83048f58c8459e76327ad77a2132b471d389fe04c","normalized_path":"%WINDIR%\\System32\\conhost.exe","parent_uid":"00013496-00002544","uid":"00013652-00002248"},{"pid":2352,"ppid":2544,"name":"conhost.exe","command_line":"","sha256":"b3bbcd2ff46233d6f64776b83048f58c8459e76327ad77a2132b471d389fe04c","normalized_path":"%WINDIR%\\System32\\conhost.exe","parent_uid":"00013496-00002544","uid":"00013652-00002352"},{"pid":2492,"ppid":2544,"name":"mscorsvw.exe","command_line":"","sha256":"48e6ad65eefd6c54f938f5753ef58377cda77adbb41cd8635f0040d61efb92a4","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","parent_uid":"00013496-00002544","uid":"00013653-00002492"}],"all_imported_dlls":["msvcrt.dll","OLEAUT32.dll","CFGMGR32.dll","KERNELBASE.dll","RPCRT4.dll","SspiCli.dll","USP10.dll","PSAPI.DLL","kernel32.dll","LPK.dll","ntdll.dll","VERSION.dll","sechost.dll","IMM32.DLL","ADVAPI32.dll","SETUPAPI.dll","ole32.dll","USER32.dll","DEVOBJ.dll","MSCTF.dll","GDI32.dll","faultrep.dll","SHLWAPI.dll","Apphelp.dll","Secur32.dll","wow64win.dll","apphelp.dll","VxSSL32.dll","sspicli.dll","bcryptprimitives.dll","win32u.dll","advapi32.dll","combase.dll","wow64.dll","user32.dll","cryptbase.dll","fltLib.dll","gdi32.dll","msvcp_win.dll","wow64cpu.dll","KernelBase.dll","ucrtbase.dll","oleaut32.dll","imm32.dll","ws2_32.dll","rpcrt4.dll","gdi32full.dll","NapiNSP.dll","mscoreei.dll","wtsapi32.dll","rtutils.dll","rasman.dll","FntCache.dll","ktmw32.dll","cryptsvc.dll","ieproxy.dll","clr.dll","Wldap32.dll","framedynos.dll","nsi.dll","crypt32.dll","IPHLPAPI.DLL","mswsock.dll","FWPUCLNT.DLL","werconcpl.dll","msidle.dll","System.Xaml.dll","shlwapi.dll","wsock32.dll","rasapi32.dll","pnrpnsp.dll","mscorrc.dll","System.Workflow.Activities.dll","System.Workflow.ComponentModel.dll","XamlBuildTask.dll","urlmon.dll","RacEngn.dll","wscinterop.dll","XsdBuildTask.dll","msasn1.dll","WSHTCPIP.DLL","iertutil.dll","comctl32.dll","SensApi.dll","nlaapi.dll","msctf.dll","psapi.dll","winsta.dll","shell32.dll","winnsi.dll","powrprof.dll","UIAutomationClientsideProviders.dll","hcproviders.dll","setupapi.dll","cfgmgr32.dll","WindowsBase.dll","ntmarta.dll","devobj.dll","System.WorkflowServices.dll","wscapi.dll","wininet.dll","winrnr.dll","rasadhlp.dll","Sens.dll","wercplsupport.dll","dnsapi.dll","lpk.dll","usp10.dll","esent.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"qmgr0.dat","sha256":"fa8d5c100e1dd00db75cc6b445fb0d5c1dc6a8d2163d93eae2e10997c05bfdfa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"qmgr1.dat","sha256":"00ae447b4d40b64d2a241fd4a45896df51c766dd57917f1582947899e9d8024a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"cache.dat","sha256":"3fc8c5a24f60a15fe3080f6a626db67dbd4f146e098da5c3e6059178853d01e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"tokens.dat","sha256":"38d49425d3506cec373f0d17bdf96cc96df4c5a42bfcf112285ce112efbbadb7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"RacWmiDatabase.sdf","sha256":"a070db1ed452eea3a93b8a5649c824ad018cfffcacc79b905dcd116aff6ac80b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"RacDatabase.sdf","sha256":"64248e52efae75b0a291e38e479353519f1a2e180e9890bf1b0acc092b00147e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"RacMetaData.dat","sha256":"3465c2b485a4bf81275339119be1a79c7313fc900d2e29ff93cde1bdffc64404","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"RacWmiDataBookmarks.dat","sha256":"ebb4e2cda7611f842a1c16b82c8cf22e12e8c867da361c61f19eee0d9169eeb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"RacWmiEventData.dat","sha256":"cc26c3e0d4d0b517007289fec8ce2910a3ac7ca13eef37fd8082fe338127a593","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"sqlA30A.tmp","sha256":"2b05b083cf44347fbf795c7b9165e6b5defb2e016bac5368dc2d710c066811ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"sqlA31F.tmp","sha256":"84bf0cb960cc5e25cff2604c04a593f4f36aceef9a8c2589739c1588c9107eea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"ngen_service.log","sha256":"16d497bbfc48b2dce0185bd94b77137a1bff2022d06af53862a495a186350cd3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"SVCHOST.EXE-007FEA55.pf","sha256":"8ddc277000333842480eed09f1373431edcf350913dbf8681cb1b00481503b63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"lastalive0.dat","sha256":"f9cc1677947fa05ab725e01bd1e5ef26219dcf9333adcbd95f506ad84b749fcb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"lastalive1.dat","sha256":"52a0f0f5ebe420ac78480be79841b1decb7d9a38c49c42c1202294aae02a0134","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"hosts","sha256":"a9558f2987f3d54e4a3e2417cab147f302ae50f3a2e5860ff6eceb202df7a6a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"Microsoft-Windows-CodeIntegrity%4Operational.evtx","sha256":"00ed0a954d3c8adbce7844c772764d11e3d2cd561938b9cfd3810aa64022190b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx","sha256":"0df589c3b55c12c84e66be59c60ead36c6dd2532ee07dd717108e1e3e6482b90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"Microsoft-Windows-WindowsBackup%4ActionCenter.evtx","sha256":"49b7a56b001e5780cb16a8b87c78485aaa045899c492d2a173e4efb29b6cdb64","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"Microsoft-Windows-WindowsUpdateClient%4Operational.evtx","sha256":"9d67bc137ba510163a9db27872326adf70837d5d428199cdc4f919e7c065ae4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]}],"files_written":[{"path":"PIPE\\lsarpc","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"path":"%WINDIR%\\system32\\user32.dll","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"path":"C:\\DOCUME~1\\PSPUBWS\\LOCALS~1\\Temp\\bf87_appcompat.txt","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"path":"%WINDIR%\\system32\\kernel32.dll","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"path":"%WINDIR%\\system32\\dwwin.exe","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"path":"\\SystemRoot\\AppPatch\\systest.sdb","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"path":"\\Device\\NamedPipe\\ShimViewer","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"path":"%WINDIR%\\system32\\drwtsn32.exe","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"path":"%WINDIR%\\system32\\DRIVERS\\ETC\\HOSTS","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\System32\\drivers\\etc\\hosts","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\WinSxS\\manifests\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\WinSxS\\manifests\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9.manifest","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\drivers\\etc\\hosts","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\drivers\\etc\\hosts.ics","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\System32\\en-US\\wscui.cpl.mui","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\System32\\sens.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\System32\\en-US\\hcproviders.dll.mui","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%APPDATA%\\Microsoft\\Protect\\S-1-5-21-4162757579-3804539371-4239455898-1000\\3b32d189-b412-4cc9-a3a6-68fd03570dd5","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%APPDATA%\\Microsoft\\Protect\\CREDHIST","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\System32\\en-US\\Actioncenter.dll.mui","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\System32\\Winevt\\Logs\\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\System32\\winevt\\Logs\\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Prefetch\\TSHARK.EXE-FDDC3357.pf","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%APPDATA%\\Microsoft\\Protect\\S-1-5-21-4162757579-3804539371-4239455898-1000\\Preferred","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\System32\\Winevt\\Logs\\Microsoft-Windows-NetworkAccessProtection%4WHC.evtx","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\System32\\Winevt\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\System32\\Winevt\\Logs\\Microsoft-Windows-Diagnosis-Scheduled%4Operational.evtx","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Prefetch\\AUTOIT3.EXE-78A7ED50.pf","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\en-US\\svchost.exe.mui","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\MSCORSVW.EXE","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Prefetch\\DUMPCAP.EXE-32EEE998.pf","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache-System.dat","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ARIAL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ARIALI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ARIALBD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ARIALBI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BATANG.TTC","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\COUR.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\COURI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\COURBD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\COURBI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\DAUNPENH.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\DOKCHAMP.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ESTRE.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\EUPHEMIA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GAUTAMI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GAUTAMIB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\VANI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\VANIB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GULIM.TTC","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\IMPACT.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ISKPOTA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ISKPOTAB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\KALINGA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\KALINGAB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\KARTIKA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\KARTIKAB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\KHMERUI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\KHMERUIB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LAOUI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LAOUIB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LATHA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LATHAB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LUCON.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MALGUN.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MALGUNBD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MANGAL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MANGALB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MEIRYO.TTC","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MEIRYOB.TTC","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\HIMALAYA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MSJH.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MSJHBD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MSYH.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MSYHBD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MINGLIU.TTC","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MINGLIUB.TTC","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MONBAITI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MSGOTHIC.TTC","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MSMINCHO.TTC","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MVBOLI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\NTAILU.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\NTAILUB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\NYALA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\PHAGSPA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\PHAGSPAB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\PLANTC.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\RAAVI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\RAAVIB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SEGOESC.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SEGOESCB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUII.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIZ.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SEGUISB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SEGUISYM.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SHRUTI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SHRUTIB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SIMSUN.TTC","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SIMSUNB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SYLFAEN.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TAILE.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TAILEB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TIMES.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TIMESI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TIMESBD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TIMESBI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TUNGA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TUNGAB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\VRINDA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\VRINDAB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SHONAR.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SHONARB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MSYI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TAHOMA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TAHOMABD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MICROSS.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ANGSA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ANGSAI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ANGSAB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ANGSAZ.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\APARAJ.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\APARAJB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\APARAJBI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\APARAJI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CORDIA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CORDIAI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CORDIAB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CORDIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\EBRIMA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\EBRIMABD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GISHA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GISHABD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\KOKILA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\KOKILAB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\KOKILABI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\KOKILAI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LEELAWAD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LEELAWDB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MSUIGHUR.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MOOLBOR.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SYMBOL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UTSAAH.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHBI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\VIJAYA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\VIJAYAB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\WINGDING.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MODERN.FON","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ROMAN.FON","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SCRIPT.FON","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ANDLSO.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ARABTYPE.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SIMPO.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SIMPBDO.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SIMPFXO.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MAJALLA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MAJALLAB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TRADO.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TRADBDO.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\AHRONBD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\DAVID.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\DAVIDBD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\FRANK.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LVNM.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LVNMBD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MRIAM.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MRIAMC.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\NRKIS.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ROD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SIMFANG.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SIMHEI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SIMKAI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ANGSAU.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BROWA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BROWAI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BROWAB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BROWAZ.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BROWAU.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BROWAUI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BROWAUB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BROWAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CORDIAU.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCDL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCDI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCDB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCDBI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCEL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCEI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCEB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCEBI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCFL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCFI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCFB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCFBI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCIL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCII.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCIB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCIBI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCJL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCJI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCJB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCJBI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCKL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCKI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCKB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCKBI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCLL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCLI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCLB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\UPCLBI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\KAIU.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\L_10646.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ARIBLK.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CALIBRI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CALIBRII.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CALIBRIB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CALIBRIZ.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIA.TTC","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CANDARA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CANDARAI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CANDARAB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CANDARAZ.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\COMIC.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\COMICBD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CONSOLA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAZ.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CONSTAN.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CONSTANI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CONSTANB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CONSTANZ.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CORBEL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CORBELI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CORBELB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CORBELZ.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\FRAMD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\FRAMDIT.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GABRIOLA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GEORGIA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\PALA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\PALAI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\PALAB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\PALABI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SEGOEPR.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SEGOEPRB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TREBUC.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TREBUCIT.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TREBUCBD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TREBUCBI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\VERDANA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\VERDANAI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\VERDANAB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\VERDANAZ.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\WEBDINGS.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\COURE.FON","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SERIFE.FON","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SSERIFE.FON","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SMALLE.FON","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SMALLF.FON","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\HATTEN.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ANTQUAB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ANTQUABI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ANTQUAI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BKANT.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GOTHIC.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GOTHICB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GOTHICBI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GOTHICI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ARIALN.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ARIALNB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ARIALNBI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ARIALNI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GARA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GARABD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GARAIT.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MTCORSVA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\AGENCYB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\AGENCYR.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ARLRDBD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ITCBLKAD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BOD_B.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BOD_BI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BOD_I.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BOD_R.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BOD_BLAI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BOD_BLAR.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BOD_CB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BOD_CBI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BOD_CI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BOD_CR.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BOOKOS.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSBI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BRADHITC.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CALIST.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CALISTB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CALISTBI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CALISTI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CASTELAR.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CENSCBK.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKBI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\COPRGTB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\COPRGTL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CURLZ___.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ITCEDSCR.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ELEPHNT.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ELEPHNTI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ENGR.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ERASBD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ERASDEMI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ERASLGHT.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ERASMD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\FELIXTI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\FORTE.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\FRABK.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\FRABKIT.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\FRADM.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\FRADMIT.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\FRADMCN.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\FRAHV.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\FRAHVIT.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\FRAMDCN.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\FRSCRIPT.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GIGI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GILBI___.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GILB____.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GILI____.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GIL_____.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GILC____.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GILSANUB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GILLUBCD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GLSNECB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GLECB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GOUDOS.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GOUDOSB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GOUDOSI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\GOUDYSTO.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\IMPRISHA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LSANS.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LSANSD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LSANSDI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LSANSI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LTYPE.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LTYPEB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\System32\\winevt\\Logs\\Microsoft-Windows-WindowsBackup%4ActionCenter.evtx","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LTYPEBO.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LTYPEO.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MAIAN.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\OCRAEXT.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\PALSCRI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\PAPYRUS.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\PERBI___.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\PERB____.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\PERI____.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\PER_____.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\PERTIBD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\PERTILI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\PRISTINA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\RAGE.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ROCK.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ROCKB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ROCKBI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ROCKI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ROCCB___.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ROCC____.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ROCKEB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SCRIPTBL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TCBI____.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TCB_____.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TCCM____.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TCCB____.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TCCEB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TCMI____.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TCM_____.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ALGER.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BASKVILL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BAUHS93.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BELL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BELLB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BELLI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BRLNSB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BRLNSDB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BRLNSR.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BERNHC.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BOD_PSTC.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BRITANIC.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BROADW.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BRUSHSCI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CALIFB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CALIFI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CALIFR.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CENTAUR.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CHILLER.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\COLONNA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\COOPBL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\FTLTLT.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\FREESCPT.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\HARLOWSI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\HARNGTON.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\HTOWERT.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\HTOWERTI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\JOKERMAN.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\JUICE___.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ITCKRIST.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\KUNSTLER.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LBRITE.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LBRITED.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LBRITEDI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LBRITEI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LCALLIG.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LFAX.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LFAXD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LFAXDI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LFAXI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LHANDW.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MAGNETOB.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MATURASC.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MISTRAL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MOD20.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\NIAGENG.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\NIAGSOL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\OLDENGL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ONYX.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\PARCHM.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\PLAYBILL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\POORICH.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\RAVIE.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\INFROMAN.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SHOWG.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\SNAP____.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\STENCIL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\TEMPSITC.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\VINERITC.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\VIVALDII.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\VLADIMIR.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\LATINWD.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\CENTURY.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\WINGDNG2.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\WINGDNG3.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\ARIALUNI.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MSMINCHO.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\MICROSOFT SHARED\\EQUATION\\MTEXTRA.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\OUTLOOK.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\BSSYM7.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\REFSAN.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\REFSPCL.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\FONTS\\MARLETT.TTF","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Prefetch\\SVCHOST.EXE-007FEA55.pf","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\PresentationCore.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\PresentationCore\\3.0.0.0__31bf3856ad364e35\\PresentationCore.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\PresentationCore\\v4.0_4.0.0.0__31bf3856ad364e35\\PresentationCore.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\PresentationCore\\v4.0_4.0.0.0__31bf3856ad364e35\\PresentationCore.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\PresentationFramework\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\PresentationFramework\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\PresentationFramework\\v4.0_4.0.0.0__31bf3856ad364e35\\PresentationFramework.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\PresentationFramework\\v4.0_4.0.0.0__31bf3856ad364e35\\PresentationFramework.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.Aero.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.Aero.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\v4.0_4.0.0.0__31bf3856ad364e35\\PresentationFramework.Aero.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\PresentationFramework.Aero\\v4.0_4.0.0.0__31bf3856ad364e35\\PresentationFramework.Aero.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.Classic.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\PresentationFramework.Classic\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.Classic.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.Luna.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\PresentationFramework.Luna\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.Luna.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.Royale.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\PresentationFramework.Royale\\3.0.0.0__31bf3856ad364e35\\PresentationFramework.Royale.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Configuration\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Configuration.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Configuration\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Configuration.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Configuration.Install\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Configuration.Install\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Design\\2.0.0.0__b03f5f7f11d50a3a\\System.Design.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Design\\2.0.0.0__b03f5f7f11d50a3a\\System.Design.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.DirectoryServices\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.DirectoryServices.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.DirectoryServices\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.DirectoryServices.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Drawing.Design\\2.0.0.0__b03f5f7f11d50a3a\\System.Drawing.Design.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Drawing.Design\\2.0.0.0__b03f5f7f11d50a3a\\System.Drawing.Design.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Management.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Management.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\v4.0_4.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\v4.0_4.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.ServiceProcess\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.ServiceProcess.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.ServiceProcess\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.ServiceProcess.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Web.Services\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Web.Services.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Web.Services\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Web.Services.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Workflow.Activities\\3.0.0.0__31bf3856ad364e35\\System.Workflow.Activities.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Workflow.Activities\\3.0.0.0__31bf3856ad364e35\\System.Workflow.Activities.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Workflow.ComponentModel\\3.0.0.0__31bf3856ad364e35\\System.Workflow.ComponentModel.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Workflow.ComponentModel\\3.0.0.0__31bf3856ad364e35\\System.Workflow.ComponentModel.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Workflow.Runtime\\3.0.0.0__31bf3856ad364e35\\System.Workflow.Runtime.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Workflow.Runtime\\3.0.0.0__31bf3856ad364e35\\System.Workflow.Runtime.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Xaml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xaml.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Xaml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xaml.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.Xml.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.Xml.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Xml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xml.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Xml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xml.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\WindowsBase\\3.0.0.0__31bf3856ad364e35\\WindowsBase.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\WindowsBase\\3.0.0.0__31bf3856ad364e35\\WindowsBase.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\WindowsBase\\v4.0_4.0.0.0__31bf3856ad364e35\\WindowsBase.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\WindowsBase\\v4.0_4.0.0.0__31bf3856ad364e35\\WindowsBase.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Network\\Downloader\\qmgr1.dat","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\System32\\winevt\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Network\\Downloader\\qmgr0.dat","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"PIPE\\samr","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\CatRoot2\\edb0046E.log","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\CatRoot2\\edb.log","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\CatRoot2\\edb.chk","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\CatRoot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\CatRoot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\System32\\winevt\\Logs\\Security.evtx","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\racengn.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\System32\\Winevt\\Logs\\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\System32\\winevt\\Logs\\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\RAC\\StateData","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\RAC\\StateData\\RacWmiDataBookmarks.dat","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\RAC\\StateData\\RacDatabase.sdf","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\RAC\\StateData\\RacMetaData.dat","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\system32\\logfiles\\scm\\a1cfa52f-06f2-418d-addb-cd6456d66f43","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ngenofflinequeuelock.dat","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ngenrootstorelock.dat","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\ngenservice_pri3_lock.dat","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\ngennicupdatelock.dat","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Accessibility\\2.0.0.0__b03f5f7f11d50a3a\\Accessibility.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Accessibility\\2.0.0.0__b03f5f7f11d50a3a\\Accessibility.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\AspNetMMCExt\\2.0.0.0__b03f5f7f11d50a3a\\AspNetMMCExt.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\AspNetMMCExt\\2.0.0.0__b03f5f7f11d50a3a\\AspNetMMCExt.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\AspNetMMCExt\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\AspNetMMCExt.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\AspNetMMCExt\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\AspNetMMCExt.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\BDATunePIA\\6.1.0.0__31bf3856ad364e35\\BDATunePIA.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\BDATunePIA\\6.1.0.0__31bf3856ad364e35\\BDATunePIA.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\MSEnv\\PublicAssemblies\\envdte.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\MSEnv\\PublicAssemblies\\envdte.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\AddInSideAdapters\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\AddInViews\\Microsoft.Office.Tools.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\AddInViews\\Microsoft.Office.Tools.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\AddInViews\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\AddInViews\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\AddInViews\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\AddInViews\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\Contracts\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\Contracts\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\Contracts\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\Contracts\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\Contracts\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\Contracts\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\Contracts\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\Contracts\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VSTA\\Pipeline.v10.0\\HostSideAdapters\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ComSvcConfig.exe.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\COMSVCCONFIG.EXE","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ComSvcConfig.exe","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\dfsvc.exe.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\SMSvcHost.exe.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\SMSVCHOST.EXE","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\SMSvcHost.exe","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\WsatConfig.exe.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\WSATCONFIG.EXE","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\WsatConfig.exe","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ComSvcConfig\\3.0.0.0__b03f5f7f11d50a3a\\ComSvcConfig.exe.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\ASSEMBLY\\GAC_MSIL\\COMSVCCONFIG\\3.0.0.0__B03F5F7F11D50A3A\\COMSVCCONFIG.EXE","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ComSvcConfig\\3.0.0.0__b03f5f7f11d50a3a\\ComSvcConfig.exe","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\dfsvc\\2.0.0.0__b03f5f7f11d50a3a\\dfsvc.exe.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\ASSEMBLY\\GAC_MSIL\\DFSVC\\2.0.0.0__B03F5F7F11D50A3A\\DFSVC.EXE","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\dfsvc\\2.0.0.0__b03f5f7f11d50a3a\\dfsvc.exe","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehCIR\\6.1.0.0__31bf3856ad364e35\\ehCIR.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehCIR\\6.1.0.0__31bf3856ad364e35\\ehCIR.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehexthost\\6.1.0.0__31bf3856ad364e35\\ehexthost.exe.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiActivScp\\6.1.0.0__31bf3856ad364e35\\ehiActivScp.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiActivScp\\6.1.0.0__31bf3856ad364e35\\ehiActivScp.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiBmlDataCarousel\\6.1.0.0__31bf3856ad364e35\\ehiBmlDataCarousel.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiBmlDataCarousel\\6.1.0.0__31bf3856ad364e35\\ehiBmlDataCarousel.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiExtens\\6.1.0.0__31bf3856ad364e35\\ehiExtens.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiExtens\\6.1.0.0__31bf3856ad364e35\\ehiExtens.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiiTV\\6.1.0.0__31bf3856ad364e35\\ehiiTV.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiiTV\\6.1.0.0__31bf3856ad364e35\\ehiiTV.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiProxy\\6.1.0.0__31bf3856ad364e35\\ehiProxy.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiProxy\\6.1.0.0__31bf3856ad364e35\\ehiProxy.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiTVMSMusic\\6.1.0.0__31bf3856ad364e35\\ehiTVMSMusic.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiTVMSMusic\\6.1.0.0__31bf3856ad364e35\\ehiTVMSMusic.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiUPnP\\6.1.0.0__31bf3856ad364e35\\ehiUPnP.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiUPnP\\6.1.0.0__31bf3856ad364e35\\ehiUPnP.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiUserXp\\6.1.0.0__31bf3856ad364e35\\ehiUserXp.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiUserXp\\6.1.0.0__31bf3856ad364e35\\ehiUserXp.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiVidCtl\\6.1.0.0__31bf3856ad364e35\\ehiVidCtl.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiVidCtl\\6.1.0.0__31bf3856ad364e35\\ehiVidCtl.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiwmp\\6.1.0.0__31bf3856ad364e35\\ehiwmp.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiwmp\\6.1.0.0__31bf3856ad364e35\\ehiwmp.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiWUapi\\6.1.0.0__31bf3856ad364e35\\ehiWUapi.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehiWUapi\\6.1.0.0__31bf3856ad364e35\\ehiWUapi.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehRecObj\\6.1.0.0__31bf3856ad364e35\\ehRecObj.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehRecObj\\6.1.0.0__31bf3856ad364e35\\ehRecObj.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehshell\\6.1.0.0__31bf3856ad364e35\\ehshell.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\ehshell\\6.1.0.0__31bf3856ad364e35\\ehshell.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC\\EnvDTE\\8.0.0.0__b03f5f7f11d50a3a\\EnvDTE.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC\\EnvDTE\\8.0.0.0__b03f5f7f11d50a3a\\EnvDTE.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC\\EnvDTE80\\8.0.0.0__b03f5f7f11d50a3a\\EnvDTE80.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC\\EnvDTE80\\8.0.0.0__b03f5f7f11d50a3a\\EnvDTE80.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC\\EnvDTE90\\9.0.0.0__b03f5f7f11d50a3a\\EnvDTE90.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC\\EnvDTE90\\9.0.0.0__b03f5f7f11d50a3a\\EnvDTE90.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\EventViewer\\6.1.0.0__31bf3856ad364e35\\EventViewer.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\EventViewer\\6.1.0.0__31bf3856ad364e35\\EventViewer.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\loadmxf\\6.1.0.0__31bf3856ad364e35\\loadmxf.exe.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\ASSEMBLY\\GAC_MSIL\\LOADMXF\\6.1.0.0__31BF3856AD364E35\\LOADMXF.EXE","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\loadmxf\\6.1.0.0__31bf3856ad364e35\\loadmxf.exe","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\mcepg\\6.1.0.0__31bf3856ad364e35\\mcepg.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\mcepg\\6.1.0.0__31bf3856ad364e35\\mcepg.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\MCESidebarCtrl\\6.1.0.0__31bf3856ad364e35\\MCESidebarCtrl.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\MCESidebarCtrl\\6.1.0.0__31bf3856ad364e35\\MCESidebarCtrl.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\mcglidhostobj\\6.1.0.0__31bf3856ad364e35\\mcglidhostobj.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\mcglidhostobj\\6.1.0.0__31bf3856ad364e35\\mcglidhostobj.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\mcplayerinterop\\6.1.0.0__31bf3856ad364e35\\mcplayerinterop.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\mcplayerinterop\\6.1.0.0__31bf3856ad364e35\\mcplayerinterop.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\mcstore\\6.1.0.0__31bf3856ad364e35\\mcstore.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\mcstore\\6.1.0.0__31bf3856ad364e35\\mcstore.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mcstoredb\\6.1.0.0__31bf3856ad364e35\\mcstoredb.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mcstoredb\\6.1.0.0__31bf3856ad364e35\\mcstoredb.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mcupdate\\6.1.0.0__31bf3856ad364e35\\mcupdate.exe.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\ASSEMBLY\\GAC_32\\MCUPDATE\\6.1.0.0__31BF3856AD364E35\\MCUPDATE.EXE","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mcupdate\\6.1.0.0__31bf3856ad364e35\\mcupdate.exe","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\Mcx2Dvcs\\6.1.0.0__31bf3856ad364e35\\Mcx2Dvcs.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\Mcx2Dvcs\\6.1.0.0__31bf3856ad364e35\\Mcx2Dvcs.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\\6.1.0.0__31bf3856ad364e35\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\\6.1.0.0__31bf3856ad364e35\\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Activities.Build\\v4.0_4.0.0.0__31bf3856ad364e35\\Microsoft.Activities.Build.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Activities.Build\\v4.0_4.0.0.0__31bf3856ad364e35\\Microsoft.Activities.Build.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Build\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Microsoft.Build.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Build\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Microsoft.Build.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Build.Conversion.v3.5\\3.5.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Conversion.v3.5.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Build.Conversion.v3.5\\3.5.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Conversion.v3.5.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Build.Conversion.v4.0\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Conversion.v4.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Build.Conversion.v4.0\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Conversion.v4.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Build.Engine\\2.0.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Engine.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Build.Engine\\2.0.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Engine.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Build.Engine\\3.5.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Engine.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Build.Engine\\3.5.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Engine.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Build.Engine\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Engine.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Build.Engine\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Engine.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Build.Framework\\2.0.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Framework.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Build.Framework\\2.0.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Framework.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Build.Framework\\3.5.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Framework.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Build.Framework\\3.5.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Framework.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Build.Framework\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Framework.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Build.Framework\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Framework.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Build.Tasks\\2.0.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Tasks.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Build.Tasks\\2.0.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Tasks.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Build.Tasks.v3.5\\3.5.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Tasks.v3.5.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Build.Tasks.v3.5\\3.5.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Tasks.v3.5.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Build.Tasks.v4.0\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Tasks.v4.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Build.Tasks.v4.0\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Tasks.v4.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Build.Utilities\\2.0.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Utilities.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Build.Utilities\\2.0.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Utilities.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Build.Utilities.v3.5\\3.5.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Utilities.v3.5.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Build.Utilities.v3.5\\3.5.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Utilities.v3.5.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Build.Utilities.v4.0\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Utilities.v4.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Build.Utilities.v4.0\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Microsoft.Build.Utilities.v4.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.CSharp\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Microsoft.CSharp.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.CSharp\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Microsoft.CSharp.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\Microsoft.Ink.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\Microsoft.Ink\\6.1.0.0__31bf3856ad364e35\\Microsoft.Ink.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Internal.Tasks.Dataflow\\v4.0_4.0.0.0__b77a5c561934e089\\Microsoft.Internal.Tasks.Dataflow.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Internal.Tasks.Dataflow\\v4.0_4.0.0.0__b77a5c561934e089\\Microsoft.Internal.Tasks.Dataflow.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC\\Microsoft.Internal.VisualStudio.Shell.Interop.9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.Internal.VisualStudio.Shell.Interop.9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC\\Microsoft.Internal.VisualStudio.Shell.Interop.9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.Internal.VisualStudio.Shell.Interop.9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.ManagementConsole\\3.0.0.0__31bf3856ad364e35\\Microsoft.ManagementConsole.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.ManagementConsole\\3.0.0.0__31bf3856ad364e35\\Microsoft.ManagementConsole.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.MediaCenter\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.MediaCenter.Bml\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.Bml.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.MediaCenter.Bml\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.Bml.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.Interop.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\Microsoft.MediaCenter.Interop\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.Interop.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.MediaCenter.iTV\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.iTV.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.MediaCenter.iTV\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.iTV.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.MediaCenter.iTv.Hosting\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.iTv.Hosting.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.MediaCenter.iTv.Hosting\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.iTv.Hosting.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.iTV.Media.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\Microsoft.MediaCenter.iTV.Media\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.iTV.Media.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.MediaCenter.ITVVM\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.ITVVM.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.MediaCenter.ITVVM\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.ITVVM.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.Mheg.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\Microsoft.MediaCenter.Mheg\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.Mheg.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.Playback.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\Microsoft.MediaCenter.Playback\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.Playback.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.MediaCenter.Shell\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.Shell.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.MediaCenter.Shell\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.Shell.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.MediaCenter.Sports\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.Sports.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.MediaCenter.Sports\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.Sports.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\Microsoft.MediaCenter.TV.Tuners.Interop\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.TV.Tuners.Interop.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\Microsoft.MediaCenter.TV.Tuners.Interop\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.TV.Tuners.Interop.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.UI.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.MediaCenter.UI\\6.1.0.0__31bf3856ad364e35\\Microsoft.MediaCenter.UI.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Common.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.Office.Tools.Common.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Common.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.Office.Tools.Common.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Excel.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.Office.Tools.Excel.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Excel.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.Office.Tools.Excel.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Outlook.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.Office.Tools.Outlook.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Outlook.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.Office.Tools.Outlook.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.Office.Tools.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.Office.Tools.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Word.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.Office.Tools.Word.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Office.Tools.Word.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.Office.Tools.Word.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Editor\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Editor.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Editor\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Editor.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.GPowerShell\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.GPowerShell.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.GPowerShell\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.GPowerShell.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.GraphicalHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.GraphicalHost.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.GraphicalHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.GraphicalHost.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Transactions.Bridge\\3.0.0.0__b03f5f7f11d50a3a\\Microsoft.Transactions.Bridge.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Transactions.Bridge\\3.0.0.0__b03f5f7f11d50a3a\\Microsoft.Transactions.Bridge.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Transactions.Bridge\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Microsoft.Transactions.Bridge.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Transactions.Bridge\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Microsoft.Transactions.Bridge.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\Microsoft.Transactions.Bridge.Dtc.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\3.0.0.0__b03f5f7f11d50a3a\\Microsoft.Transactions.Bridge.Dtc.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Microsoft.Transactions.Bridge.Dtc.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\Microsoft.Transactions.Bridge.Dtc\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Microsoft.Transactions.Bridge.Dtc.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\Microsoft.VisualBasic.Activities.Compiler\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.Activities.Compiler.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\Microsoft.VisualBasic.Activities.Compiler\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.Activities.Compiler.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.VisualBasic.Compatibility\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.Compatibility.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.VisualBasic.Compatibility\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.Compatibility.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.VisualBasic.Compatibility.Data\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.Compatibility.Data.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.VisualBasic.Compatibility.Data\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.Compatibility.Data.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.VisualC\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualC.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.VisualC\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualC.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualC\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualC.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualC\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualC.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Help 9\\dexplore.exe.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC\\Microsoft.VisualStudio.OLE.Interop\\7.1.40304.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.OLE.Interop.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC\\Microsoft.VisualStudio.OLE.Interop\\7.1.40304.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.OLE.Interop.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Shell\\2.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Shell.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Shell\\2.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Shell.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Shell.9.0\\2.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Shell.9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Shell.9.0\\2.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Shell.9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC\\Microsoft.VisualStudio.Shell.Interop.8.0\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Shell.Interop.8.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC\\Microsoft.VisualStudio.Shell.Interop.8.0\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Shell.Interop.8.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC\\Microsoft.VisualStudio.Shell.Interop.9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Shell.Interop.9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC\\Microsoft.VisualStudio.Shell.Interop.9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Shell.Interop.9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"C:\\BVTBin\\Tests\\installpackage\\csilogfile.log","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\\9.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\\10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\Microsoft.Windows.Diagnosis.SDEngine\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDEngine.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\Microsoft.Windows.Diagnosis.SDEngine\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDEngine.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.SDHost\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.SDHost.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.Windows.Diagnosis.TroubleshootingPack\\6.1.0.0__31bf3856ad364e35\\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Workflow.Compiler\\v4.0_4.0.0.0__31bf3856ad364e35\\Microsoft.Workflow.Compiler.exe.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\MICROSOFT.WORKFLOW.COMPILER\\V4.0_4.0.0.0__31BF3856AD364E35\\MICROSOFT.WORKFLOW.COMPILER.EXE","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.Workflow.Compiler\\v4.0_4.0.0.0__31bf3856ad364e35\\Microsoft.Workflow.Compiler.exe","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MiguiControls.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\MiguiControls\\1.0.0.0__31bf3856ad364e35\\MiguiControls.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\MMCEx\\3.0.0.0__31bf3856ad364e35\\MMCEx.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\MMCFxCommon\\3.0.0.0__31bf3856ad364e35\\MMCFxCommon.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\MSBuild\\3.5.0.0__b03f5f7f11d50a3a\\MSBuild.exe.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\napcrypt\\6.1.0.0__31bf3856ad364e35\\napcrypt.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\napcrypt\\6.1.0.0__31bf3856ad364e35\\napcrypt.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\naphlpr\\6.1.0.0__31bf3856ad364e35\\naphlpr.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\naphlpr\\6.1.0.0__31bf3856ad364e35\\naphlpr.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\napinit.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\napinit\\6.1.0.0__31bf3856ad364e35\\napinit.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\napsnap.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\napsnap\\6.1.0.0__31bf3856ad364e35\\napsnap.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\ASSEMBLY\\GAC_MSIL\\NARRATOR\\6.1.0.0__31BF3856AD364E35\\NARRATOR.EXE","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Narrator\\6.1.0.0__31bf3856ad364e35\\Narrator.exe","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35\\PresentationBuildTasks.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\PresentationBuildTasks\\3.0.0.0__31bf3856ad364e35\\PresentationBuildTasks.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\PresentationBuildTasks\\v4.0_4.0.0.0__31bf3856ad364e35\\PresentationBuildTasks.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\PresentationBuildTasks\\v4.0_4.0.0.0__31bf3856ad364e35\\PresentationBuildTasks.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\PresentationCFFRasterizer\\3.0.0.0__31bf3856ad364e35\\PresentationCFFRasterizer.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\ASSEMBLY\\GAC_MSIL\\PRESENTATIONFONTCACHE\\3.0.0.0__31BF3856AD364E35\\PRESENTATIONFONTCACHE.EXE","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\PresentationFontCache\\3.0.0.0__31bf3856ad364e35\\PresentationFontCache.exe","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\PresentationFramework-SystemCore\\v4.0_4.0.0.0__b77a5c561934e089\\PresentationFramework-SystemCore.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\PresentationFramework-SystemCore\\v4.0_4.0.0.0__b77a5c561934e089\\PresentationFramework-SystemCore.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\PresentationFramework-SystemData\\v4.0_4.0.0.0__b77a5c561934e089\\PresentationFramework-SystemData.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\PresentationFramework-SystemData\\v4.0_4.0.0.0__b77a5c561934e089\\PresentationFramework-SystemData.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\PresentationFramework-SystemDrawing\\v4.0_4.0.0.0__b77a5c561934e089\\PresentationFramework-SystemDrawing.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\PresentationFramework-SystemDrawing\\v4.0_4.0.0.0__b77a5c561934e089\\PresentationFramework-SystemDrawing.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\PresentationFramework-SystemXml\\v4.0_4.0.0.0__b77a5c561934e089\\PresentationFramework-SystemXml.dll.config","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\PresentationFramework-SystemXml\\v4.0_4.0.0.0__b77a5c561934e089\\PresentationFramework-SystemXml.dll","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\PCHEALTH\\ERRORREPORTING\\","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\PCHEALTH\\ERRORREPORTING\\EXCLUSIONLIST\\","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\PCHEALTH\\ERRORREPORTING\\INCLUSIONLIST\\","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\WINLOGON_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\WINLOGON_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\\AUTHORIZEDAPPLICATIONS\\LIST\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\MPSSVC\\PARAMETERS\\PORTKEYWORDS\\DHCP\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKLM\\SOFTWARE\\CLASSES\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\CHECKS\\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.CHECK.0\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\CHECKS\\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.106\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\CHECKS\\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.101\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\CHECKS\\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.103\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\CHECKS\\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.100\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\CHECKS\\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.102\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\CHECKS\\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.104\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\CHECKS\\{852FB1F8-5CC6-4567-9C0E-7C330F8807C2}.CHECK.100\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\CHECKS\\{852FB1F8-5CC6-4567-9C0E-7C330F8807C2}.CHECK.101\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\PROVIDERS\\EVENTLOG\\{01979C6A-42FA-414C-B8AA-EEE2C8202018}\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\CHECKS\\{01979C6A-42FA-414C-B8AA-EEE2C8202018}.CHECK.100\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\CHECKS\\{01979C6A-42FA-414C-B8AA-EEE2C8202018}.CHECK.101\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\PROVIDERS\\EVENTLOG\\{945A8954-C147-4ACD-923F-40C45405A658}\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\CHECKS\\{945A8954-C147-4ACD-923F-40C45405A658}.CHECK.42\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\PROVIDERS\\EVENTLOG\\{DAB69A6A-4D2A-4D44-94BF-E0091898C881}\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\CHECKS\\{DAB69A6A-4D2A-4D44-94BF-E0091898C881}.CHECK.100\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\PROVIDERS\\EVENTLOG\\{11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78}\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\CHECKS\\{11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78}.CHECK.101\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\PROVIDERS\\EVENTLOG\\{A5268B8E-7DB5-465B-BAB7-BDCDA39A394A}\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\CHECKS\\{A5268B8E-7DB5-465B-BAB7-BDCDA39A394A}.CHECK.100\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SESSIONINFO\\1\\WHCICONSTARTUP\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3G2\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3GP\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3GP2\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3GPP\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AAC\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ADT\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ADTS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\.NETFRAMEWORK\\V2.0.50727\\NGENSERVICE\\LISTENEDSTATE\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\.NETFRAMEWORK\\V2.0.50727\\NGENSERVICE\\STATE\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\.NETFRAMEWORK\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\.NETFRAMEWORK\\V2.0.50727\\","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]}]},"mutex_activity":{"mutex_created":[{"name":"L0aR","sources":[{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b83"},{"report_type":"sandbox","report_id":"56250c240e316ddb42e35b85"},{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\L0aR","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!windows!system32!config!systemprofile!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!windows!system32!config!systemprofile!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!windows!system32!config!systemprofile!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"Local\\c:!windows!system32!config!systemprofile!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"Local\\c:!windows!system32!config!systemprofile!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"Local\\c:!windows!system32!config!systemprofile!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"\\BaseNamedObjects\\Global\\{ea7c0dff-5099-4d1d-835d-6297f0f7f461}:sqlce_se_lck:1","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"\\BaseNamedObjects\\Global\\{7eca29ff-8ad9-4b5a-8c8c-2fa9c1611be6}:sqlce_se_lck:1","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"\\BaseNamedObjects\\Global\\{e2105eff-4520-4b0b-8731-f2d6163e749f}:sqlce_se_lck:1","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"\\BaseNamedObjects\\Global\\{7eca29ff-8ad9-4b5a-8c8c-2fa9c1611be6}:sqlce_se_lck:3","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"\\BaseNamedObjects\\Global\\{ea7c0dff-5099-4d1d-835d-6297f0f7f461}:sqlce_se_lck:3","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]},{"name":"\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5882ac65aac2ed2a1653a092"}]}]}},"report_ids":{"sandbox_job_ids":["6633fec3731376ae750ca38a","5882ac65aac2ed2a1653a092","56250c240e316ddb42e35b85","56250c240e316ddb42e35b83"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Ursu.Generic Sample 527da5fd4e50… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 527da5fd4e50…. Malware family: Ursu.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 18 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/527da5fd4e501765cdd1bccb2f7c5ac76c0b22dfaf7c24e914df4e1cb8029d71"}],["$","meta","4",{"property":"og:title","content":"Malicious Ursu.Generic Sample 527da5fd4e50… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 527da5fd4e50…. Malware family: Ursu.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 18 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/527da5fd4e501765cdd1bccb2f7c5ac76c0b22dfaf7c24e914df4e1cb8029d71"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ursu.Generic Sample 527da5fd4e50… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 527da5fd4e50…. Malware family: Ursu.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 18 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L40","11",{}]]