24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSILPerseus.Generic Sample 6be5521895fe… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6be5521895fe…. Malware family: MSILPerseus.Generic. Threat score 100/100. 13/28 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6be5521895fea9416f75165b9e8dfaf8412ef4b7a89b9a3da3a438b8acd73588","keywords":["Malicious","MSILPerseus.Generic","malware analysis","sandbox report","threat intelligence","6be5521895fea9416f75165b9e8dfaf8412ef4b7a89b9a3da3a438b8acd73588"],"about":{"@type":"SoftwareApplication","name":"yaga.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"6be5521895fea9416f75165b9e8dfaf8412ef4b7a89b9a3da3a438b8acd73588","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSILPerseus.Generic","antivirusDetections":{"malicious":13,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta8a,"" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\7D7F4414CCEF168ADF6BF40753B5BECD78375931"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: "CERTIFICATES") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\BE36A4562FB2EE05DBB3D32323ADF445084ED656"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\CDD4EEAE6000AC7F40C3802C171E30148030C072"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\02FAF3E291435468607857694DF5E45B68851868"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\2796BAE63F1801E277261BA0D77770028F20EEE4"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25"; Key: "BLOB")26:T5f4,"" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\machine.config" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "" touched file "%WINDIR%\assembly\NativeImages_v2.0.50727_32\index141.dat" "" touched file "%WINDIR%\system32\l_intl.nls" "" touched file "%WINDIR%\assembly\pubpol47.dat" "" touched file "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp"27:T901,"" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")28:T11c5,"" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")29:Td94,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAnDSURBVFhHvVdpbFTnFc3P/u3fVpWqqlIbqVLUSk3atFXStIkqUJqVGDDGxkBsdjcQIBjMYrPZwUCggYTFYByz2MGOwYbxMt6xPePZZzwznn1fPPvyZp/T+96YmCi2U6lSn3T1RrO875xzzz3fN8/h/3Tlc7lFV3puufUZJoFQOIJwOMrdv61QGEG2gmyFuAqwFQg+UwHudTAYRCLBcMvkFgGxJIBMJovBkSkoVFrIFGqupPIZSOQqiGVKiCQKiMQyTItkEIqkEEyLIRCIMCWYxuSUEBOTUxBOi3Cn7T5uNrcgEg5yILLZ7Hc4LwkgkUxBIpv5nxv0ZEIIpSGE6003SJG574FYEkA6nYZYqpgHwPbvaeXnXxckXaqeMh3gD8PiyUJnS6KxsRG+Odd3QHAA7nT5UHveRmXF4UYTquu1+LhWgcr9AmytFmLT7nGU7hhC8RYe1lT04K2SNtSd6Zt/EAvo+1c+X3h/eGQcJlcac1FAqAqgtrYW/jnPt57gAFxqdqN7IAiDJQGlJg65OgaJIoxpeRRjwgCGJ0LoHw3j0aAfQxN+fFynRsXurnkAi7v7qeF4vXzwJ/QYnDKi74kJze1PULGpDG6nnfs9B+CzJgdGpiL/db+b7lpQvquD+/5TpotowL0lFktRe/IcamobsHP3J9i6cy/+sWIltleWLABovGLhAPBHbWhp16OlbRYXLwvgdIZx/rIQj/oMuHpLjuq6MRxrmMTbZb3Ytr8AIBrPgElmEadKpApqJNN5RJgcookcEhnAGcjDPpeGK5CDn1rBGzNh29ZNCwDqL+kxNBnCvQ4lLjZZaaF+VB9sRn+fBO+tb8OXV/vQ3qHCm6tuoWj95yjexsO6Hbfhi2ZhcMRgdjMwuhg4fEnuoQPSCCbUUQzJIhiQUOuEIVxtFyGVLgDsHVFjS2X5AoDjn6nRP+aHzxcihtM4WtsCk9GKQyeG8d7GPpw7344bzXz86g+15ORTuPKVBu+UXi4owJACxJxVIUkLZHN5TJCP2OTTWfwQzfjRPmDGhZZJUoumhrz5eFiLyopnABxpVKKHH4DfH6ZFJ/BRVQNqjt5B+T4dXi0awJsrN+ON4mH8+qUt0M8q0XBRjpWrLyBChE2uOKzeBI0aA6cvwYHiCf0Yl9gxLHLhbLMIp68LcXEeAHUE3UMaVFRsWFDgYL0Enb0+zHl82FdDo1ZyHkWVI/jrOzexatMD/HFlO372wjFsr6rmfnT41DBWFp3lXgejKUTIB6FoGuFYmksL3nQA3aMOdAzaca1Di7Mtcly6LUQolkOagvABfxYVHz4DYP/xKbQ99MPjdKFyVzNK9+rx8sp/k1EOYcUHN/D8K334+W/WQDglRo4ofFI3gFffrgN5jNhT7+eSsJICjjmGWgDwZTFc61Tj4h0Vvryvo7san7cKEYiQUdNAZ78OmzeXLSiw5/AoWjv9cNodKKu4RQveQs3xFoyNTOMXL5zEj36yA1V7DlCU5hGL5CikevHK28e4B7h9DLyBBFx091BlCGBzj56kn0bjzWmcviZAzYVxnLw8BH84ixi17eteAkBZwF5cDlQd5ONmm5sU8ODlP2/Bn/62Cy5XGF3dQvz4p6/h+d/+Hk+eSGB3pBAOpVF1uAsvrqgGu63YOQXIA+QFJ93Za0bnhUTlgkzjgVTthljlhnzWBw+NYZg2xns8PTZufAbArgM8NN21cT8Oh6LIpAo7ViyaQcAfQjSUALujBoOshYDqU7146fX9oAGA0R6GyRGBwRaG1hyEVOOFSheAkhaUqL2YVroxIXVCIHeTSbMIxoDbPUaUl5cuKFBJsfrWhhHsPyEldkJsPTBG+d+Lyj08lGx9gDUf3sP7m5rxZukX+KD8Cn75u4/x4mu7kKGRsnninAJWygKzI05gYpg1h6E2hqAgIDItjaLKC7HaB5s3Cx8FbstDIzZseAZAZ7ccxxv7UNfIx7FPH+NwfTf2Hr2Lkg/PYd+ROyjbdRkr1p/D68UN+PuqE/jLP2vwr8NN9MAkLeLjimUuIrYCuQtPpHaMTlsxJDCDP2mi5DPQXmCFxZ2FJwjc6DKhtGx9QYGlsxxQKKTclxa72Ga4/EkyXxIOmgCrOw6zMwaDPYpZS4RTQKkPkgJBiNR+UoA2O0caTj9wtcOM9aXzANiHZ2l2MpmnlaU9nrI8GgN/aJxb2xtgoDIEqUhS6q2Y7S0ZSzTjxRTLmEJnhBgPTplpxzOAN6pHz5AODwZn0UUz39GvRfeIkc4EaVIN+OJrC0rWswDyhSlY7GLPg0PDBQBMktwby1LYZBEIZ+ALZQhUGh5/iks/u4edAob6H4feFiMzRjFjjEKhj0Cmi0CsCUGsJV+Y0zB78rjUZsW6EnY3zC0PgD84xgHwkNRijR8SjQ8CpZdz9ajIjkGBldvjWcbdxLhrQIP7vWq082bQ9ngG9x4VqvWhkmZ/FipTCnpnDhfu2FC8jgWQ/WEA7LkmytD4UIoFKEg49jSObpb9XIrYJ4l9AkYHQ+wZYs9AbYpDZYyRAlFSIEbgoxBRSXUpaG05nGu1Y23xOupAZmkA7FG6f2CEU8DqinGMR8UOYm1B37gJj0b01GMtxWqB8d0eJW4/VBBbqgcKfNWlQAvVrW8UuNEhQ2u3GiJtCjOWLD5tcWDN2mLqQHoZAAyDvv4RsJkUpEBaYE5OpsOFzZuisUrC5EyS85PQWRloLAxmSAGlgYFcz0Cii9OicQhmYphSsvcklKYs6pudKFpdjHw2tTwAXu8Q2DPErDWMx6NGrroGdejo06CNpyLWxLZLTixlaGarU4abxJZl3HRfhutfS3GN6so9CX2uwqQqRcCyOHXThQ+K1tLGlly+BY8JQJQi2OMvsLZ70zTvKWKdopkm1rYEtNYEuTtBBktAQcxlxFysZSDUMMQ4jkliPi6PY0zGYFSWIFWyqLvhwioCkMkkfgAAbxi03XPnOB/VXJjABCmAAnTOo0Cx+8gf9F/DQqdsozsPgzOPWUceGjKa2pKHypyDwpiD3JCDzJCFeDZDnwP1LXNYtXodAWCWb0FHVy8d090Ym1RjTKCn47ke/HED+kYNeDRkxMNBI5nQTO0wo7XHglsPrbj+jZXOADZ83m7DhXsOnL3txJmvXLSoGydI+vpWL8qO6fDOu+8inV5GAdb9nZ3f4LNzn3J19kwDzjScQv3p4zh5ohZ1tUdw9EgNDh06iAOfHMC+vfuwe/duVFVVYfuOndiyZRs2V1SifNNmyv2NFDwbsGZdKYrWluLd997Hno8qEY/Hl1ZgqYRc/P35v2v5HP1PyFJlKM7peEYuZ42WpcoQ20yaDixU6RTDLZ5MJvAf4T7yNESqSnoAAAAASUVORK5CYII=2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"6be5521895fea9416f75165b9e8dfaf8412ef4b7a89b9a3da3a438b8acd73588","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790441612443,"unified_at":"2026-09-26T16:53:32.443Z","metadata":{"hashes":{"sha256":"6be5521895fea9416f75165b9e8dfaf8412ef4b7a89b9a3da3a438b8acd73588","sha1":"5d9d123afd4ac92b0213104cc01a8cf9c38c5675","md5":"de21798038d9bf4e626b9c41d2ea8f5b","sha512":"c555ac4a642e0232e42a1be8794ef6731fc06b63dcb2e0257d69e73966876fd1c340fe1c7e1a10c06e6bf8c5ffe54b197ba1601d203a66eb837dcd261c94a44d","ssdeep":"1536:79qA5oeH5U2K6mOMbWj9j81KIsfmw06lw9:7F5oeHzVMbWj9cbw06O9","ssdeep_chunks":["1536:79qA5oe","1536:9qA5oeH","1536:qA5oeH5","1536:A5oeH5U","1536:5oeH5U2","1536:oeH5U2K","1536:eH5U2K6","1536:H5U2K6m","1536:5U2K6mO","1536:U2K6mOM","1536:2K6mOMb","1536:K6mOMbW","1536:6mOMbWj","1536:mOMbWj9","1536:OMbWj9j","1536:MbWj9j8","1536:bWj9j81","1536:Wj9j81K","1536:j9j81KI","1536:9j81KIs","1536:j81KIsf","1536:81KIsfm","1536:1KIsfmw","1536:KIsfmw0","1536:Isfmw06","1536:sfmw06l","1536:fmw06lw","1536:mw06lw9","3072:79qA5oe","3072:9qA5oeH","3072:qA5oeH5","3072:A5oeH5U","3072:5oeH5U2","3072:oeH5U2K","3072:eH5U2K6","3072:H5U2K6m","3072:5U2K6mO","3072:U2K6mOM","3072:2K6mOMb","3072:K6mOMbW","3072:6mOMbWj","3072:mOMbWj9","3072:OMbWj9j","3072:MbWj9j8","3072:bWj9j81","3072:Wj9j81K","3072:j9j81KI","3072:9j81KIs","3072:j81KIsf","3072:81KIsfm","3072:1KIsfmw","3072:KIsfmw0","3072:Isfmw06","3072:sfmw06l","3072:fmw06lw","3072:mw06lw9","1536:7F5oeHz","1536:F5oeHzV","1536:5oeHzVM","1536:oeHzVMb","1536:eHzVMbW","1536:HzVMbWj","1536:zVMbWj9","1536:VMbWj9c","1536:MbWj9cb","1536:bWj9cbw","1536:Wj9cbw0","1536:j9cbw06","1536:9cbw06O","1536:cbw06O9"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"yaga.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":53248,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499289903000,"last_seen":1677369751000,"last_multi_scan":1677369751000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":11,"suspicious_count":13,"malicious_count":5,"total":29},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.FileCoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1227380","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.MSILPerseus.494","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.MSILPerseus.494 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Filecoder.AC trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004d3df31 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Deshacop.btd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Filecoder.eiybfm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.Win32.1554617","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"MSILPerseus.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"fv13.failiem.lv\"\n \"files.fm\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"87.110.219.224:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll\" at 6A570000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"informative","category":"General","name":"Reads System Certificates Settings","description":"$25","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/C cd %WINDIR%\\System32 & s.bat\" on 2016-11-27.13:56:00.090","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/C cd %WINDIR%\\System32 & s.bat\" (UID: 00019008-00002496)\n Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00019302-00002584)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"readMe!.txt\" has type \"ISO-8859 text with no line terminators\"\n \"BBhrpau[1].jpg\" has type \"data\"\n \"tileimage.bmp\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"PSPUBWS.bmp\" containing the Windows username \"PSPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"185554:0:0:5.19.0.2930\"\n Heuristic match: \"Confuser v1.9.0.0\"\n \"1.0.2.1\"\n Heuristic match: \"mscorlib,2.0.0.0,,b77a5c561934e089,x86\"\n Heuristic match: \"System,2.0.0.0,,b77a5c561934e089,MSIL\"\n Heuristic match: \"System.Xml,2.0.0.0,,b77a5c561934e089,MSIL\"\n Heuristic match: \"System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL\"\n Heuristic match: \"System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL\"\n Heuristic match: \"System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL\"\n Heuristic match: \"System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL\"\n Heuristic match: \"System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL\"\n Heuristic match: \"Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL\"\n Heuristic match: \"System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\PDFSigQFormalRep.pdf\" with delete access\n \"\" opened \"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf\" with delete access\n \"\" opened \"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf\" with delete access\n \"\" opened \"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf\" with delete access\n \"\" opened \"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"16/57 Antivirus vendors marked sample as malicious (28% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"16/57 Antivirus vendors marked sample as malicious (28% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"87.110.219.224\" (ASN: 12578, Owner: LATTELEKOM-APOLLO): ...\nURL: http://fv2.failiem.lv/down.php?i=nfrxpyg (AV positives: 2/68 scanned on 11/14/2016 13:38:22)\n URL: http://fv2.failiem.lv/down.php?i=ujcrqnt&n=YigitSro.rar (AV positives: 1/68 scanned on 11/09/2016 07:24:15)\n URL: https://fv2.failiem.lv/down.php?i=66z254w6&n=Install+2.1.exe&PHPSESSID=nmbav1r7se9e026ukd7rrtpjs4 (AV positives: 1/68 scanned on 11/07/2016 20:41:47)\n URL: http://fv2.failiem.lv/down.php?i=sbrclaa&n=FamilyOnline.rar (AV positives: 1/68 scanned on 11/06/2016 09:10:54)\n URL: http://fv2.failiem.lv/down.php (AV positives: 1/68 scanned on 11/04/2016 04:35:38)\n File SHA256: daddc833bffcade36b432b21046487b29dcd2a162d91b503334a52caee9c1fd2 (AV positives: 19/56 scanned on 11/07/2016 20:41:56)\n File SHA256: ae30bd4bc5a8f4852547f52ec0774cfbdcd9a57b467be449b5878af5411ed8cc (AV positives: 27/58 scanned on 05/01/2016 15:49:16)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by Ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00019302-00002584)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"$28","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by Ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":90,"dropped_files_count":0,"extracted_files_count":23,"files_written_count":507,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"583ad284aac2edf92d0bc2f5","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["LVA","USA"],"submit_name":"yaga.exe","analysis_start_time":"2016-11-27T13:33:35+00:00","indicators_count":{"informative":11,"suspicious":15,"malicious":7},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"87.110.219.224","port":443,"protocol":"TCP","country":"Latvia","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]}],"dns_resolutions":[{"domain":"fv13.failiem.lv","address":"87.110.219.224","country":"Latvia","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"domain":"files.fm","address":"104.25.80.116","country":"United States","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}],"processes":[{"pid":2216,"ppid":0,"name":"yaga.exe","command_line":"","normalized_path":"C:\\yaga.exe","uid":"00017719-00002216","icon":"$29"},{"pid":2496,"ppid":2216,"name":"cmd.exe","command_line":"/C cd %WINDIR%\\System32 & s.bat","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00017719-00002216","uid":"00019008-00002496","icon":"$2a"},{"pid":2584,"ppid":2496,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00019008-00002496","uid":"00019302-00002584"}],"all_imported_dlls":["mswsock.dll","wship6.dll","IconCodecService.dll","mscorlib.ni.dll","Wldap32.dll","credssp.dll","cryptbase.dll","devobj.dll","ntmarta.dll","sechost.dll","System.Drawing.ni.dll","oleaccrc.dll","urlmon.dll","nsi.dll","msvcrt.dll","lpk.dll","imm32.dll","rsaenh.dll","apphelp.dll","ws2_32.dll","dnsapi.dll","ncrypt.dll","KernelBase.dll","advapi32.dll","wininet.dll","WSHTCPIP.DLL","winhttp.dll","security.dll","secur32.dll","vssapi.dll","mscorjit.dll","ieframe.dll","sspicli.dll","webio.dll","WindowsCodecs.dll","shlwapi.dll","usp10.dll","profapi.dll","dwmapi.dll","System.Configuration.ni.dll","tzres.dll","winnsi.dll","dhcpcsvc.dll","System.Windows.Forms.dll","rasadhlp.dll","bcryptprimitives.dll","vss_ps.dll","gdi32.dll","mscorwks.dll","clbcatq.dll","rtutils.dll","winbrand.dll","ole32.dll","System.ni.dll","System.Windows.Forms.ni.dll","oleacc.dll","crypt32.dll","setupapi.dll","cfgmgr32.dll","RpcRtRemote.dll","kernel32.dll","msctf.dll","uxtheme.dll","bcrypt.dll","propsys.dll","rasman.dll","schannel.dll","userenv.dll","ntdll.dll","rpcrt4.dll","psapi.dll","IPHLPAPI.DLL","gpapi.dll","user32.dll","shell32.dll","oleaut32.dll","dhcpcsvc6.dll","atl.dll","mscoree.dll","msvcr80.dll","rasapi32.dll","FWPUCLNT.DLL","vsstrace.dll","mscoreei.dll","System.Xml.ni.dll","cryptsp.dll","GdiPlus.dll","comctl32.dll","iertutil.dll","msasn1.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"s.bat","sha256":"373316657d5cd18bb86cb6e08445ef96ab5c3d57e458cec86476775686c1e8ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"AdobeID.pdf","sha256":"aab10dd25c01319e95ee64b7288c0d45b338aaa6a705df22bddfa8dcc3723377","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"DefaultID.pdf","sha256":"fab13463967ad76eb3b1be1df2f3ca257b8e5b1f94b815515b9bc185de32f483","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"readMe!.txt","sha256":"5a17ad7f5b142b8c397869a5f0dc7040e9f574f93afe9f77a592b966c688328c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"BBhrpau[1].jpg","sha256":"58b0a4b9046c80af05af1320f95b8ddadcf319099a9299c7a7b60c78eeebfe88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"tileimage.bmp","sha256":"a373fdb18b9334286d4c8723824ef9762b48138035ab6680fde552ca6a574005","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"BBswyLy[1].jpg","sha256":"19bc5ebb2b26a7841e9389e43e0ff0ee88253468fd4d98a598a419f07d643738","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"history3.jpg","sha256":"de8dfadbee2bfc56518c2366d2db61e52919486ce3908c9a01141a4ea1d4505e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"AA8UM5m[1].jpg","sha256":"4d1717b9ad123e787d7362a17515c0a6b183a2179a0e3acf4c28ed2fe881a4c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"125ffa03-7e1c-4609-a37c-8b7236ac3eb9_14[1].png","sha256":"bc462eecd4479b70e7b2b4e3dac2b1ff825c7b359a75c523e36b8203b7709eb8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"BBsAeox[1].jpg","sha256":"ff9877eea4255ffdba30a181107dab144ff6058b231ea803aae7469036ea4e0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"SampleMusicBundle.zip","sha256":"7c1d825cac745a74a92c7f38483b2d147ed9ea271bcaeee519c22b0e7ed8fdc0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"Torus.png","sha256":"3a8c0c4a4cbf580eb569af73d23d11e9c9b17532bacf2b0b719165c0fa4a8e1b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"BBsDBqh[1].jpg","sha256":"6ba70dd98d9ea69a247adf9c594d17c0628f42a14b6cad320d5ee786da62472b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"play_hov.png","sha256":"2a8a64c98331b0e0eea683f5d358632fb7a79f957f22fef7f79092971a63c57c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"BBjUeSq[1].jpg","sha256":"1e7a75f8d5e5db7d119ca422edcefc8a56529f7f2adb82f7568a6e7476a1a231","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"BBjBDJq[1].jpg","sha256":"c91fd50583f305aa1ed8ef90865f60da10d61ad23c421cbc373c3c4fe9cb0f72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"BBjTALW[1].jpg","sha256":"2a2d612daeda53496aaa92e4a26f1a844652f778779daf311934f6d634d110d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"BBqwWqw[1].jpg","sha256":"7be3e73e922e5d47469474c521b1fca196834519619c23d8e72239f75f67855a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"Jellyfish.jpg","sha256":"7d33f3576c83dda835fe7f00dd7e61e108d6f3fc4d3e66b1d0c16b3ab93284b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"_Excel1.xls","sha256":"5dafd0b9e0aa211d934fa70476bd92ae968ed334973ce7944b639460df1e0fc6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"DbgSpec.doc","sha256":"f16128742169dee0061c3817cbfbdbc56a163c162f57e643c0bf0c3b013c5f40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"themes.doc","sha256":"04516a7157cca370758e13011e5085ba9de717ed0cfd1ced754844a08cc90f5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\yaga.exe.config","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index141.dat","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\yaga.exe","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MARLETT.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ARIAL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ARIALI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ARIALBD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ARIALBI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BATANG.TTC","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\COUR.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\COURI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\COURBD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\COURBI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\DAUNPENH.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\DOKCHAMP.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ESTRE.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\EUPHEMIA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GAUTAMI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GAUTAMIB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\VANI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\VANIB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GULIM.TTC","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\IMPACT.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ISKPOTA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ISKPOTAB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\KALINGA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\KALINGAB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\KARTIKA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\KARTIKAB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\KHMERUI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\KHMERUIB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LAOUI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LAOUIB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LATHA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LATHAB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LUCON.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MALGUN.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MALGUNBD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MANGAL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MANGALB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MEIRYO.TTC","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MEIRYOB.TTC","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\HIMALAYA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MSJH.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MSJHBD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MSYH.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MSYHBD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MINGLIU.TTC","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MINGLIUB.TTC","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MONBAITI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MSGOTHIC.TTC","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MSMINCHO.TTC","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MVBOLI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\NTAILU.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\NTAILUB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\NYALA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\PHAGSPA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\PHAGSPAB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\PLANTC.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\RAAVI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\RAAVIB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SEGOESC.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SEGOESCB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUII.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIZ.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SEGUISB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SEGUISYM.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SHRUTI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SHRUTIB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SIMSUN.TTC","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SIMSUNB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SYLFAEN.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TAILE.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TAILEB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TIMES.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TIMESI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TIMESBD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TIMESBI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TUNGA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TUNGAB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\VRINDA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\VRINDAB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SHONAR.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SHONARB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MSYI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TAHOMA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TAHOMABD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MICROSS.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ANGSA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ANGSAI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ANGSAB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ANGSAZ.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\APARAJ.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\APARAJB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\APARAJBI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\APARAJI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CORDIA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CORDIAI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CORDIAB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CORDIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\EBRIMA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\EBRIMABD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GISHA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GISHABD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\KOKILA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\KOKILAB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\KOKILABI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\KOKILAI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LEELAWAD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LEELAWDB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MSUIGHUR.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MOOLBOR.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SYMBOL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UTSAAH.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHBI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\VIJAYA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\VIJAYAB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\WINGDING.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MODERN.FON","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ROMAN.FON","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SCRIPT.FON","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ANDLSO.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ARABTYPE.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SIMPO.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SIMPBDO.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SIMPFXO.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MAJALLA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MAJALLAB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TRADO.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TRADBDO.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\AHRONBD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\DAVID.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\DAVIDBD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\FRANK.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LVNM.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LVNMBD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MRIAM.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MRIAMC.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\NRKIS.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ROD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SIMFANG.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SIMHEI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SIMKAI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ANGSAU.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BROWA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BROWAI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BROWAB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BROWAZ.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BROWAU.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BROWAUI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BROWAUB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BROWAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CORDIAU.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCDL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCDI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCDB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCDBI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCEL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCEI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCEB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCEBI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCFL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCFI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCFB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCFBI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCIL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCII.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCIB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCIBI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCJL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCJI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCJB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCJBI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCKL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCKI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCKB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCKBI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCLL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCLI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCLB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\UPCLBI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\KAIU.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\L_10646.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ARIBLK.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CALIBRI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CALIBRII.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CALIBRIB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CALIBRIZ.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIA.TTC","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CANDARA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CANDARAI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CANDARAB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CANDARAZ.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\COMIC.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\COMICBD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CONSOLA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAZ.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CONSTAN.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CONSTANI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CONSTANB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CONSTANZ.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CORBEL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CORBELI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CORBELB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CORBELZ.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\FRAMD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\FRAMDIT.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GABRIOLA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GEORGIA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\PALA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\PALAI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\PALAB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\PALABI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SEGOEPR.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SEGOEPRB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TREBUC.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TREBUCIT.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TREBUCBD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TREBUCBI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\VERDANA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\VERDANAI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\VERDANAB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\VERDANAZ.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\WEBDINGS.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\COURE.FON","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SERIFE.FON","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SSERIFE.FON","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SMALLE.FON","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SMALLF.FON","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\HATTEN.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ANTQUAB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ANTQUABI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ANTQUAI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BKANT.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GOTHIC.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GOTHICB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GOTHICBI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GOTHICI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ARIALN.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ARIALNB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ARIALNBI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ARIALNI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GARA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GARABD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GARAIT.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MTCORSVA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\AGENCYB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\AGENCYR.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ARLRDBD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ITCBLKAD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BOD_B.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BOD_BI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BOD_I.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BOD_R.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BOD_BLAI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BOD_BLAR.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BOD_CB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BOD_CBI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BOD_CI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BOD_CR.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BOOKOS.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSBI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BRADHITC.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CALIST.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CALISTB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CALISTBI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CALISTI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CASTELAR.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CENSCBK.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKBI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\COPRGTB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\COPRGTL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CURLZ___.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ITCEDSCR.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ELEPHNT.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ELEPHNTI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ENGR.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ERASBD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ERASDEMI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ERASLGHT.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ERASMD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\FELIXTI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\FORTE.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\FRABK.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\FRABKIT.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\FRADM.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\FRADMIT.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\FRADMCN.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\FRAHV.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\FRAHVIT.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\FRAMDCN.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\FRSCRIPT.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GIGI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GILBI___.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GILB____.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GILI____.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GIL_____.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GILC____.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GILSANUB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GILLUBCD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GLSNECB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GLECB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GOUDOS.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GOUDOSB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GOUDOSI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\GOUDYSTO.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\IMPRISHA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LSANS.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LSANSD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LSANSDI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LSANSI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LTYPE.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LTYPEB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LTYPEBO.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LTYPEO.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MAIAN.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\OCRAEXT.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\PALSCRI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\PAPYRUS.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\PERBI___.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\PERB____.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\PERI____.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\PER_____.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\PERTIBD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\PERTILI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\PRISTINA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\RAGE.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ROCK.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ROCKB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ROCKBI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ROCKI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ROCCB___.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ROCC____.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ROCKEB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SCRIPTBL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TCBI____.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TCB_____.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TCCM____.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TCCB____.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TCCEB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TCMI____.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TCM_____.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ALGER.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BASKVILL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BAUHS93.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BELL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BELLB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BELLI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BRLNSB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BRLNSDB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BRLNSR.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BERNHC.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BOD_PSTC.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BRITANIC.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BROADW.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BRUSHSCI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CALIFB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CALIFI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CALIFR.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CENTAUR.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CHILLER.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\COLONNA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\COOPBL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\FTLTLT.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\FREESCPT.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\HARLOWSI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\HARNGTON.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\HTOWERT.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\HTOWERTI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\JOKERMAN.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\JUICE___.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ITCKRIST.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\KUNSTLER.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LBRITE.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LBRITED.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LBRITEDI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LBRITEI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LCALLIG.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LFAX.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LFAXD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LFAXDI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LFAXI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LHANDW.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MAGNETOB.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MATURASC.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MISTRAL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MOD20.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\NIAGENG.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\NIAGSOL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\OLDENGL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ONYX.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\PARCHM.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\PLAYBILL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\POORICH.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\RAVIE.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\INFROMAN.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SHOWG.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\SNAP____.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\STENCIL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\TEMPSITC.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\VINERITC.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\VIVALDII.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\VLADIMIR.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\LATINWD.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\CENTURY.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\WINGDNG2.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\WINGDNG3.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\ARIALUNI.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\MSMINCHO.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%COMMONPROGRAMFILES%\\MICROSOFT SHARED\\EQUATION\\MTEXTRA.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\OUTLOOK.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\BSSYM7.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\REFSAN.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\FONTS\\REFSPCL.TTF","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\$Recycle.Bin\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-4162757579-3804539371-4239455898-1000\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\Config.Msi\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\MSOCache\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\MSOCache\\All Users\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\PerfLogs\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"C:\\PerfLogs\\Admin\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%PROGRAMFILES%\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%PROGRAMFILES%\\Adobe\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Esl\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\locales\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AIR\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Browser\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\DEU\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Javascripts\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\DEU\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\ENU\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\readMe!.txt","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\System32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"path":"%WINDIR%\\System32\\s.bat","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"583ad284aac2edf92d0bc2f5"}]}]}},"report_ids":{"sandbox_job_ids":["583ad284aac2edf92d0bc2f5"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious MSILPerseus.Generic Sample 6be5521895fe… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6be5521895fe…. Malware family: MSILPerseus.Generic. Threat score 100/100. 13/28 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6be5521895fea9416f75165b9e8dfaf8412ef4b7a89b9a3da3a438b8acd73588"}],["$","meta","4",{"property":"og:title","content":"Malicious MSILPerseus.Generic Sample 6be5521895fe… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6be5521895fe…. Malware family: MSILPerseus.Generic. Threat score 100/100. 13/28 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6be5521895fea9416f75165b9e8dfaf8412ef4b7a89b9a3da3a438b8acd73588"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious MSILPerseus.Generic Sample 6be5521895fe… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6be5521895fe…. Malware family: MSILPerseus.Generic. Threat score 100/100. 13/28 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]