23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 22:T462,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample c89944f9ec70… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c89944f9ec70…. Malware family: Malware. Threat score 100/100. 1/1 AV engines flagged this file. 13 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5"],"about":{"@type":"SoftwareApplication","name":"16874","applicationCategory":["peexe","executable"],"identifier":"c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":1,"total":1},"behavioralIndicators":{"malicious":13,"suspicious":34},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T6cc,"" touched file "C:\Windows\Globalization\Sorting\sortdefault.nls" "" touched file "C:\Users\L9MIZr2\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\L9MIZr2\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\L9MIZr2\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\system32\en-US\PROPSYS.dll.mui" "" touched file "C:\Windows\system32\cmd.exe" "" touched file "C:\Windows\system32\en-US\SETUPAPI.dll.mui" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\desktop.ini" "nRansom.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "nRansom.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "nRansom.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "nRansom.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "nRansom.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "nRansom.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "nRansom.exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "nRansom.exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\config\machine.config"25:T43a,"NRansom.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "NRansom.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "nRansom.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")26:Tb07,"NRansom.exe" touched "Computer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32") "NRansom.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\INPROCSERVER32") "NRansom.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "NRansom.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "NRansom.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "NRansom.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "NRansom.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "NRansom.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\INPROCSERVER32") "NRansom.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\INPROCSERVER32") "nRansom.exe" touched "Windows Media Player" (Path: "HKCU\WOW6432NODE\CLSID\{6BF52A52-394A-11D3-B153-00C04F79FAA6}") "nRansom.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\TREATAS") "nRansom.exe" touched "JScript Language" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\INPROCSERVER32") "nRansom.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "nRansom.exe" touched "Windows Media Player Effects Activate" (Path: "HKCU\WOW6432NODE\CLSID\{777D0CFF-0375-43B9-8532-FB04A4903593}\TREATAS") "nRansom.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "nRansom.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "nRansom.exe" touched "Shell File System Folder" (Path: "HKCU\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "nRansom.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "nRansom.exe" touched "MF MP3 Property Handler" (Path: "HKCU\WOW6432NODE\CLSID\{C120DE80-FDE4-49F5-A713-E902EF062B8A}\INSTANCE") "nRansom.exe" touched "Shell Oplock Provider" (Path: "HKCU\WOW6432NODE\CLSID\{E2EB4CA4-C96E-4DA4-94B1-673C8334A5BB}\TREATAS")27:Tea5,"c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.bin" file has an entrypoint instructions - "push0x12c,push0,push0x413454,call0x405070,addesp, 0xc,push0,call0x405076,movdword ptr [0x413458], eax,push0,push0x1000,push0,call0x40507c,movdword ptr [0x413454], eax,call0x405000,moveax, 0x41230e,movdword ptr [0x413488], eax,call0x40efc0,call0x40edac,call0x40d2b3,call0x40cde3," "AxInterop.WMPLib.dll" file has an entrypoint instructions - "jmpdword ptr [0x10002000],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al," "nRansom.exe" file has an entrypoint instructions - "jmpdword ptr [0x402000],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al," "Interop.WMPLib.dll" file has an entrypoint instructions - "jmpdword ptr [0x402000],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,"28:T504,"NRansom.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "NRansom.exe" trying to access non-existent file "C:\NRANSOM.EXE.LOCAL" "NRansom.exe" trying to access non-existent file "C:\WINMM.DLL" "NRansom.exe" trying to access non-existent file "C:\WINMMBASE.DLL" "NRansom.exe" trying to access non-existent file "C:\FLTLIB.DLL" "NRansom.exe" trying to access non-existent file "C:\MSIMG32.DLL" "NRansom.exe" trying to access non-existent file "C:\msimg32.dll" "NRansom.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "NRansom.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "NRansom.exe" trying to access non-existent file "C:\AxInterop.WMPLib.dll" "NRansom.exe" trying to access non-existent file "C:\Tools\your-mom-gay.mp3" "NRansom.exe" trying to access non-existent file "C:\Windows\System32\CMD" "NRansom.exe" trying to access non-existent file "C:\PROPSYS.DLL" "NRansom.exe" trying to access non-existent file "C:\PROPSYS.dll" "NRansom.exe" trying to access non-existent file "C:\EDPUTIL.DLL" "NRansom.exe" trying to access non-existent file "C:\edputil.dll" "NRansom.exe" trying to access non-existent file "C:\URLMON.DLL" "NRansom.exe" trying to access non-existent file "C:\urlmon.dll"29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA////////////////////////////////////////////d3d3d3d3d3d3d3d3d3f//3d3d3d3d3d3d3d3d3d3//93////////////////d///d////////////////3f//3f///////////////93//93////////////////d///d////////////////3f//3f///////////////93//93////////////////d///d////////////////3f//3f///////////////93//93////////////////d///d////////////////3f//3f///////////////93//93////////////////d///d////////////////3f//3f///////////////93//93d3d3d3d3d3d3d3d3d///d3d3d3d3d3d3d3d3d3f//3d3d3d3d3d3d3d3d3d3//93d3d3d3d3d3d3d3d3d///d3d3d3d3d3d3d3d3d3f//3d3d3d3d3d3d3d3d3d3////////////////////////////////////////////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////w==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790266448673,"unified_at":"2026-09-24T16:14:08.673Z","metadata":{"hashes":{"sha256":"c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5","sha1":"3ae8d97461fb08c4327431c0589322e3cbb1e3de","md5":"9a60890fc062d10d826c31d049706ab7","sha512":"03de8351ab6ab1e46c4f1792f4caeeaaee4b8a18b407839c1697890032aa813cae9174e1a27cb582ef5286be0b47d23966a71e0b740feb6b1814137b779fcdcc","ssdeep":"24576:DDSANUv0/NUvKLpkr2dY/aBcjJOBHOBIQBajMtWvoJiLE1+XgRKz89G/4ZSb0FuH:T80/8KLpkr2dY/aBcjJOBHOBIQBajMtA","ssdeep_chunks":["24576:DDSANUv","24576:DSANUv0","24576:SANUv0/","24576:ANUv0/N","24576:NUv0/NU","24576:Uv0/NUv","24576:v0/NUvK","24576:0/NUvKL","24576:/NUvKLp","24576:NUvKLpk","24576:UvKLpkr","24576:vKLpkr2","24576:KLpkr2d","24576:Lpkr2dY","24576:pkr2dY/","24576:kr2dY/a","24576:r2dY/aB","24576:2dY/aBc","24576:dY/aBcj","24576:Y/aBcjJ","24576:/aBcjJO","24576:aBcjJOB","24576:BcjJOBH","24576:cjJOBHO","24576:jJOBHOB","24576:JOBHOBI","24576:OBHOBIQ","24576:BHOBIQB","24576:HOBIQBa","24576:OBIQBaj","24576:BIQBajM","24576:IQBajMt","24576:QBajMtW","24576:BajMtWv","24576:ajMtWvo","24576:jMtWvoJ","24576:MtWvoJi","24576:tWvoJiL","24576:WvoJiLE","24576:voJiLE1","24576:oJiLE1+","24576:JiLE1+X","24576:iLE1+Xg","24576:LE1+XgR","24576:E1+XgRK","24576:1+XgRKz","24576:+XgRKz8","24576:XgRKz89","24576:gRKz89G","24576:RKz89G/","24576:Kz89G/4","24576:z89G/4Z","24576:89G/4ZS","24576:9G/4ZSb","24576:G/4ZSb0","24576:/4ZSb0F","24576:4ZSb0Fu","24576:ZSb0FuH","49152:DDSANUv","49152:DSANUv0","49152:SANUv0/","49152:ANUv0/N","49152:NUv0/NU","49152:Uv0/NUv","49152:v0/NUvK","49152:0/NUvKL","49152:/NUvKLp","49152:NUvKLpk","49152:UvKLpkr","49152:vKLpkr2","49152:KLpkr2d","49152:Lpkr2dY","49152:pkr2dY/","49152:kr2dY/a","49152:r2dY/aB","49152:2dY/aBc","49152:dY/aBcj","49152:Y/aBcjJ","49152:/aBcjJO","49152:aBcjJOB","49152:BcjJOBH","49152:cjJOBHO","49152:jJOBHOB","49152:JOBHOBI","49152:OBHOBIQ","49152:BHOBIQB","49152:HOBIQBa","49152:OBIQBaj","49152:BIQBajM","49152:IQBajMt","49152:QBajMtW","49152:BajMtWv","49152:ajMtWvo","49152:jMtWvoJ","49152:MtWvoJi","49152:tWvoJiL","49152:WvoJiLE","49152:voJiLE1","49152:oJiLE1+","49152:JiLE1+X","49152:iLE1+Xg","49152:LE1+XgR","49152:E1+XgRK","49152:1+XgRKz","49152:+XgRKz8","49152:XgRKz89","49152:gRKz89G","49152:RKz89G/","49152:Kz89G/4","49152:z89G/4Z","49152:89G/4ZS","49152:9G/4ZSb","49152:G/4ZSb0","49152:/4ZSb0F","49152:4ZSb0Fu","49152:ZSb0FuH","24576:T80/8KL","24576:80/8KLp","24576:0/8KLpk","24576:/8KLpkr","24576:8KLpkr2","24576:QBajMtA"],"imphash":"47b0da2d13e0214f54c3bd05550e8319"},"file_info":{"file_name":"16874","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1258496,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1506026380000,"last_seen":1677255077000,"last_multi_scan":1677255077000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware","lockscreen","sapnupuas"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":1},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":21},"sandbox_signatures":{"informative_count":41,"suspicious_count":34,"malicious_count":13,"total":88},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"malicious","value":"Contains native function calls"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to dynamically load libraries"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Drops or executes a batch file"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"malicious","value":"PE file contains executable resources"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Imports GetEnvironmentVariable API"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"suspicious","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"suspicious","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Calls an API's typically used for searching a directory for a files"},{"type":"suspicious","value":"Tries to access non-existent files"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"malicious","value":"Contains ability to capture the screen"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"nRansom.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\NRANSOM.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\nRansom\\nRansom\\obj\\Debug\\nRansom.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\3F33.tmp\\3F34.bat\"\n \"\" created file \"%TEMP%\\3F33.tmp\\nRansom.exe\"\n \"\" created file \"%TEMP%\\3F33.tmp\\Interop.WMPLib.dll\"\n \"\" created file \"%TEMP%\\3F33.tmp\\AxInterop.WMPLib.dll\"\n \"\" created file \"%TEMP%\\3F33.tmp\\Tools\\?\"\n \"\" created file \"%TEMP%\\3F33.tmp\\Tools\\your-mom-gay.mp3\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!l9mizr2!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!l9mizr2!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!l9mizr2!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"3F34.bat\" as clean (type is \"ASCII text with CRLF line terminators\")\n Antivirus vendors marked dropped file \"AxInterop.WMPLib.dll\" as clean (type is \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows\"), Antivirus vendors marked dropped file \"Interop.WMPLib.dll\" as clean (type is \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"nRansom.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 69A90000\n \"nRansom.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 68F30000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00014719-00002792) was launched with new environment variables: \"b2eprogramfilename=\"c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.exe\", b2eincfile1=\"nRansom.exe\", b2eprogramshortname=\"C:\\C89944~1.EXE\", b2eprogrampathname=\"C:\\\", b2eincfile4=\"Tools\\your-mom-gay.mp3\", b2eincfile3=\"AxInterop.WMPLib.dll\", b2eincfilepath=\"%TEMP%\\3F33.tmp\\\", b2etempfile=\"%TEMP%\\3F49.tmp\", b2eprogramname=\"C:\\c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.exe\", b2eincfile2=\"Interop.WMPLib.dll\", b2eincfilecount=\"4\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c \"%TEMP%\\3F33.tmp\\3F34.bat C:\\c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.exe\" on 2017-9-21.21:30:17.889","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c \"%TEMP%\\3F33.tmp\\3F34.bat C:\\c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.exe\" (UID: 00014719-00002792), Spawned process \"nRansom.exe\" (UID: 00014730-00003388)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"3F34.bat\" has type \"ASCII text with CRLF line terminators\"\n \"AxInterop.WMPLib.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"Interop.WMPLib.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"nRansom.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"CurrentDatabase_372.wmdb\" has type \"data\"\n \"your-mom-gay.mp3\" has type \"Audio file with ID3 version 2.4.0 contains: MPEG ADTS layer III v1 64 kbps 48 kHz Stereo\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$24","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"nRansom.My\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.exe.bin\" was detected as \"PureBasic 4.x -> Neil Hodgson\"\n \"AxInterop.WMPLib.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"Interop.WMPLib.dll\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"nRansom.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"nRansom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"nRansom.exe\" is protecting 8192 bytes with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc\n .text with unusual entropies 7.48540162368\n 7.80469490575","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"nRansom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"nRansom.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"nRansom.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"nRansom.exe\" called \"OpenService\" to access the \"rasman\" service\n \"nRansom.exe\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"nRansom.exe\" called \"OpenService\" to access the \"RASMAN\" service\n \"nRansom.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_CONFIG\" (0X1) access rights\n \"nRansom.exe\" called \"OpenService\" to access the \"AudioSrv\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 500)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"AxInterop.WMPLib.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"Interop.WMPLib.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"nRansom.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"\" opened \"MountPointManager\"\n \"nRansom.exe\" opened \"MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.56.20/32, ...\"","origin":"Network Traffic","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"nRansom.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"nRansom.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"nRansom.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetVersionExA\n GetModuleFileNameA\n LoadLibraryA\n CreateDirectoryA\n DeleteFileA\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n GetModuleHandleA\n WriteFile\n GetTempFileNameA\n TerminateProcess\n Sleep\n CreateFileA\n FindResourceA\n GetFileSize\n ShellExecuteExA\n GetWindowThreadProcessId","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"c4ca6b7580bb6b75aa6e6c759fbb6b7508bb6b7546ce6b7561386c75de2f6c75d0d96b75000000001779b7764f91b7767f6fb776f4f7b77611f7b776f283b776857eb77600000000\" to virtual address \"0x6A761000\" (part of module \"MSIMG32.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"nRansom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"22/65 Antivirus vendors marked sample as malicious (33% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"22/65 Antivirus vendors marked sample as malicious (33% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"4/65 Antivirus vendors marked dropped file \"nRansom.exe\" as malicious (classified as \"Malware.Heuristic\" with 6% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"4/65 Antivirus vendors marked spawned process \"nRansom.exe\" (PID: 3388) as malicious (classified as \"Malware.Heuristic\" with 6% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"nRansom.exe\" queries volume information of \"%TEMP%\\7F96.tmp\\nRansom.exe\" at 00010519-00001824-00000046-48818761\n \"nRansom.exe\" queries volume information of \"%TEMP%\\7F96.tmp\\AxInterop.WMPLib.dll\" at 00010519-00001824-00000046-49027319","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"crl3.digicert.com\"\n \"crl4.digicert.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"66.225.197.197:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /sha2-ha-cs-g1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl3.digicert.com\"\n \"GET /sha2-ha-cs-g1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl4.digicert.com\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"nRansom.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"nRansom.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"nRansom.exe\" at 00010519-00001824-00000033-49030957","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"nRansom.exe\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.exe\" marked \"%TEMP%\\7F96.tmp\" for deletion\n \"C:\\c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.exe\" marked \"%TEMP%\\7F96.tmp\\7F97.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\7F96.tmp\" with delete access\n \"\" opened \"%TEMP%\\7F96.tmp\\7F97.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"nRansom.exe\" touched \"K:\\\"\n \"nRansom.exe\" touched \"L:\\\"\n \"nRansom.exe\" touched \"M:\\\"\n \"nRansom.exe\" touched \"N:\\\"\n \"nRansom.exe\" touched \"O:\\\"\n \"nRansom.exe\" touched \"P:\\\"\n \"nRansom.exe\" touched \"Q:\\\"\n \"nRansom.exe\" touched \"R:\\\"\n \"nRansom.exe\" touched \"S:\\\"\n \"nRansom.exe\" touched \"T:\\\"\n \"nRansom.exe\" touched \"U:\\\"\n \"nRansom.exe\" touched \"V:\\\"\n \"nRansom.exe\" touched \"W:\\\"\n \"nRansom.exe\" touched \"X:\\\"\n \"nRansom.exe\" touched \"Y:\\\"","origin":"API Call","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005640-30405-185-004094B0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005640-30405-198-00409600","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00000000-00005640-30405-221-0040B821","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$25","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"NRansom.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\776A.tmp (UID: 00000000-00005640)\n \"NRansom.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\776A.tmp\\Tools (UID: 00000000-00005640)","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"NRansom.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\sysnative\\cmd.exe\" /c \"%TEMP%\\776A.tmp\\776B.bat C:\\NRansom.exe\"\" - (UID: 00000000-00005640)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"nRansom.exe\" - (UID: 00000000-00007940)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 24898-329-004080FF\n Sleep@KERNEL32.DLL at 00000000-00005640-30405-203-0040EB96\n Sleep@KERNEL32.DLL at 00000000-00005640-30405-246-004080FF\n Sleep@KERNEL32.DLL at 00000000-00005640-30405-43-0040A702","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00005640-30405-203-0040EB96\n LoadLibraryA@KERNEL32.DLL at 00000000-00005640-30405-75-0040C4AD\n LoadLibraryA@KERNEL32.DLL at 00000000-00005640-30405-221-0040B821\n LoadLibraryA@KERNEL32.DLL at 00000000-00005640-30405-140-00408143","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"General","name":"Drops or executes a batch file","description":"Process \"cmd.exe\" with commandline \"/c \"%TEMP%\\776A.tmp\\776B.bat C:\\NRansom.exe\"\" (UID: 00000000-00007940)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"DllGetVersion\" (Indicator: \"GetVersion\")\n \"?GetLongPathNameA\" (Indicator: \"GetLongPathNameA\")\n \"GetModuleHandleA\" (Indicator: \"GetModuleHandleA\")\n \"HeapCreate\" (Indicator: \"HeapCreate\")\n \"HeapDestroy\" (Indicator: \"HeapDestroy\")\n \"ExitProcess\" (Indicator: \"ExitProcess\")\n \"GetCommandLineA\" (Indicator: \"GetCommandLineA\")\n \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\")\n \"FindResourceA\" (Indicator: \"FindResourceA\")\n \"LoadResource\" (Indicator: \"LoadResource\")\n \"SizeofResource\" (Indicator: \"SizeofResource\")\n \"GetWindowsDirectoryA\" (Indicator: \"GetWindow\")\n \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectoryA\")\n \"HeapAlloc\" (Indicator: \"HeapAlloc\")\n \"LoadLibraryA\" (Indicator: \"LoadLibraryA\")\n \"GetProcAddress\" (Indicator: \"GetProcAddress\")\n \"FreeLibrary\" (Indicator: \"FreeLibrary\")\n \"GetCurrentThreadId\" (Indicator: \"GetCurrentThread\")\n \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\")\n \"CloseHandle\" (Indicator: \"CloseHandle\")","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$26","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.bin\" has an executable section named \".code\"\n \"c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.bin\" has an executable section named \".text\"\n \"AxInterop.WMPLib.dll\" has an executable section named \".text\"\n \"nRansom.exe\" has an executable section named \".text\"\n \"Interop.WMPLib.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.bin\" has an writable section named \".data\"\n \"nRansom.exe\" has an writable section named \".sdata\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$27","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/c \"%TEMP%\\776A.tmp\\776B.bat C:\\NRansom.exe\"\" (UID: 00000000-00007940)\n Spawned process \"nRansom.exe\" (UID: 00000000-00001068)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Observed api string:\"GetKeyState\" [Source: c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.bin]","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current system (API string)","description":"Observed api string:\"GetNativeSystemInfo\" [Source: c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Observed api string:\"GetEnvironmentVariableA\" [Source: c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed api string:\"GetSystemMetrics\" [Source: c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.bin]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetEnvironmentVariable API","description":"Observed import api \"GetEnvironmentVariable\" which can \"read the host's architecture\" [Source: c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.bin]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-81","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"NRansom.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"36FF3F060E08D90100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"AxInterop.WMPLib.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%TEMP%\\776A.tmp\\AxInterop.WMPLib.dll]- [targetUID: 00000000-00001068]\n \"nRansom.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%TEMP%\\776A.tmp\\nRansom.exe]- [targetUID: 00000000-00001068]\n \"Interop.WMPLib.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%TEMP%\\776A.tmp\\Interop.WMPLib.dll]- [targetUID: 00000000-00001068]","origin":"Binary File","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"nRansom.exe\" queried SystemProcessInformation at 00000000-00001068-00000036-2267945\n \"nRansom.exe\" queried SystemProcessInformation at 00000000-00001068-00000036-2269585","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LoadResource@KERNEL32.DLL at 00000000-00005640-30405-120-004033E3","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"NRansom.exe\" wrote 62976 bytes starting with PE header signature to file \"%TEMP%\\776A.tmp\\nRansom.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...\n \"NRansom.exe\" wrote 3072 bytes starting with PE header signature to file \"%TEMP%\\776A.tmp\\Interop.WMPLib.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"11.0.0.0\"\n \"4.0.0.0\"\n \"1.0.0.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"nRansom.exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00007940)\n \"nRansom.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00001068)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"NRansom.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00005640)\n \"nRansom.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00001068)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"nRansom.exe\" called \"FindFirstFileW\" (UID: 00000000-00001068)\n \"nRansom.exe\" called \"FindNextFileW\" (UID: 00000000-00001068)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.DLL at 00000000-00005640-30405-142-004084AB\n GetCommandLineA@KERNEL32.DLL at 00000000-00005640-30405-181-00402EA8\n GetCommandLineA@KERNEL32.DLL at 00000000-00005640-30405-112-00403DE5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"nRansom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":8,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access non-existent files","description":"$28","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"NRansom.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"NRansom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"NRansom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"NRansom.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\sysnative\\cmd.exe\" /c \"%TEMP%\\776A.tmp\\776B.bat C:\\NRansom.exe\"\" - (UID: 00000000-00005640)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"nRansom.exe\" - (UID: 00000000-00007940)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"PE file contains executable resources","description":"c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.bin has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32 executable (GUI) Intel 80386 Mono/.Net assembly\n for MS Windows","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 4024 bytes to a remote process \"%TEMP%\\776A.tmp\\nRansom.exe\" (Handle: 276)\n \"cmd.exe\" wrote 8 bytes to a remote process \"%TEMP%\\776A.tmp\\nRansom.exe\" (Handle: 276)\n \"cmd.exe\" wrote 4 bytes to a remote process \"%TEMP%\\776A.tmp\\nRansom.exe\" (Handle: 276)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Contains ability to capture the screen","description":"CreateCompatibleDC@GDI32.DLL at 24898-369-0040B8BC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1113","relevance":3,"id":"stream-72","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00005640-30405-369-0040CD69\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00005640-30405-280-0040A3B0\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00005640-30405-300-0040FD25\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00005640-30405-285-0040B300","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":96,"imported_dlls_count":165,"dropped_files_count":0,"extracted_files_count":8,"files_written_count":545,"files_deleted_count":0,"registry_keys_created_count":8,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":8,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["ransomware","lockscreen","sapnupuas"],"sample_flags":["Multi-Process","Extracted Files","Sample Crashed","Network Traffic","Sample not shared"],"sandbox_reports":[{"id":"638ce53000418a13e74e7f54","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Ransom","submit_name":"NRansom.exe","analysis_start_time":"2022-12-04T18:21:37+00:00","indicators_count":{"informative":36,"suspicious":45,"malicious":10},"tags":["Multi-Process","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"5a421d177ca3e15c7f724494","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Ransom","contacted_countries":["EU","USA"],"submit_name":"OTX_c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5","analysis_start_time":"2017-12-26T11:17:08+00:00","indicators_count":{"informative":19,"suspicious":19,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true},{"id":"59c4219f7ca3e158c73f7803","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Malware.Heuristic","submit_name":"16874","analysis_start_time":"2017-09-21T21:29:30+00:00","indicators_count":{"informative":13,"suspicious":18,"malicious":5},"tags":["Multi-Process","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"66.225.197.197","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]}],"dns_resolutions":[{"domain":"crl4.digicert.com","address":"66.225.197.197","country":"United States","registrar_name":"GODADDY.COM, LLC","registrar_organization":"DigiCert, Inc.","registrar_name_servers":"NS1.P03.DYNECT.NET","registrar_creation_date":"1996-12-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"domain":"crl3.digicert.com","address":"93.184.220.29","country":"European Union","registrar_name":"GODADDY.COM, LLC","registrar_organization":"DigiCert, Inc.","registrar_name_servers":"NS1.P03.DYNECT.NET","registrar_creation_date":"1996-12-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]}],"http_requests":[{"host":"crl3.digicert.com","host_ip":"93.184.220.29:80","url":"/sha2-ha-cs-g1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /sha2-ha-cs-g1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl3.digicert.com","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}],"processes":[{"pid":2736,"ppid":0,"name":"c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.exe","command_line":"","sha256":"c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5","normalized_path":"C:\\c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.exe","uid":"00014610-00002736","icon":"$29"},{"pid":2792,"ppid":2736,"name":"cmd.exe","command_line":"/c \"%TEMP%\\3F33.tmp\\3F34.bat C:\\c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014610-00002736","uid":"00014719-00002792","icon":"$2a"},{"pid":3388,"ppid":2792,"name":"nRansom.exe","command_line":"","sha256":"9e4f9175ef942d0e84f7f9c64dc89505c4c8ffb20787513e02b4eaaf502f5ec4","normalized_path":"%TEMP%\\3F33.tmp\\nRansom.exe","parent_uid":"00014719-00002792","uid":"00014730-00003388","icon":"$2b"}],"all_imported_dlls":["mscorlib.dll","nlssorting.dll","cryptsp.dll","rsaenh.dll","Interop.WMPLib.dll","wmp.dll","avrt.dll","msvcrt.dll","clr.dll","Microsoft.VisualBasic.ni.dll","tzres.dll","jscript.dll","SensApi.dll","advapi32.dll","cfgmgr32.dll","devobj.dll","mscorrc.dll","nsi.dll","wmpeffects.dll","evr.dll","comctl32.dll","sfc_os.dll","winbrand.dll","System.ni.dll","msdmo.dll","powrprof.dll","mfps.dll","msimg32.dll","cryptbase.dll","System.Windows.Forms.ni.dll","AxInterop.WMPLib.dll","MP3DMOD.DLL","dnsapi.dll","rasman.dll","kernel32.dll","winmm.dll","Wldap32.dll","wininet.dll","GdiPlus.dll","mlang.dll","ole32.dll","shell32.dll","profapi.dll","System.Runtime.Remoting.ni.dll","IPHLPAPI.DLL","rtutils.dll","provsvc.dll","mscoreei.dll","RESAMPLEDMO.DLL","winnsi.dll","rasapi32.dll","ntdll.dll","System.Core.ni.dll","clrjit.dll","mfplat.dll","wintrust.dll","uxtheme.dll","sfc.dll","sxs.dll","ws2_32.dll","usp10.dll","rpcrt4.dll","oleaut32.dll","dwmapi.dll","rpcss.dll","mscoree.dll","System.Drawing.ni.dll","mf.dll","user32.dll","gdi32.dll","msasn1.dll","RpcRtRemote.dll","IconCodecService.dll","ksuser.dll","wtsapi32.dll","winsta.dll","msctf.dll","crypt32.dll","WindowsCodecs.dll","wmploc.DLL","pcwum.dll","KernelBase.dll","lpk.dll","clbcatq.dll","iertutil.dll","setupapi.dll","MMDevAPI.dll","AudioSes.dll","atl.dll","shlwapi.dll","propsys.dll","sechost.dll","sspicli.dll","System.Windows.Forms.dll","version.dll","slc.dll","imm32.dll","ntmarta.dll","urlmon.dll","apphelp.dll","mscorlib.ni.dll","mpvis.DLL","msvcr120_clr0400.dll","wow64win.dll","api-ms-win-downlevel-version-l1-1-0.dll","System.Configuration.ni.dll","secur32.dll","userenv.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","devrtl.dll","WMVCORE.DLL","wow64.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-core-xstate-l2-1-0.dll","normaliz.dll","System.Xml.ni.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","wow64cpu.dll","WMASF.DLL","mfasfsrcsnk.dll","winmmbase.dll","Windows.StateRepositoryPS.dll","psapi.dll","SHCore.dll","pcacli.dll","oleacc.dll","mfsensorgroup.dll","win32u.dll","kernel.appcore.dll","CompPkgSup.dll","DWrite.dll","CoreUIComponents.dll","mfperfhelper.dll","cmdext.dll","imagehlp.dll","mftranscode.dll","cldapi.dll","WinTypes.dll","bcrypt.dll","mfcore.dll","vcruntime140_clr0400.dll","mpr.dll","CoreMessaging.dll","Windows.UI.dll","amsi.dll","atlthunk.dll","aepic.dll","ucrtbase.dll","windows.storage.dll","Windows.Media.dll","fltLib.dll","gdi32full.dll","combase.dll","bcryptprimitives.dll","mfsrcsnk.dll","edputil.dll","VxSSL64.dll","ucrtbase_clr0400.dll","msvcp_win.dll","TextInputFramework.dll","RTWorkQ.dll","msIso.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"nRansom.exe","sha256":"9e4f9175ef942d0e84f7f9c64dc89505c4c8ffb20787513e02b4eaaf502f5ec4","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"3F34.bat","sha256":"5f49ad7e1ca7bc4cb2c94fb89e79ac4a993a27852d150fe22e3d8b6c6172389f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"AxInterop.WMPLib.dll","sha256":"7c0d98877a3c3c5e3fdcf716d5456e11e8df60e13cf3236fc7dd2f6168e204cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"Interop.WMPLib.dll","sha256":"33914c07aab0e92bf85e87e2d1be739746693a60ca9961cabaf95f417d2a466f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"CurrentDatabase_372.wmdb","sha256":"2cf9bb6b05171ce265ff9af040fa20925e5ecee0192ef8eab67a5d9811cf9268","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"your-mom-gay.mp3","sha256":"6a0a9638ab66f3a66b38779c20bd91a9d66ff770827b27d95fcfd247918c8984","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"7F97.bat","sha256":"5f49ad7e1ca7bc4cb2c94fb89e79ac4a993a27852d150fe22e3d8b6c6172389f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"776B.bat","sha256":"5f49ad7e1ca7bc4cb2c94fb89e79ac4a993a27852d150fe22e3d8b6c6172389f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]}],"files_written":[{"path":"%TEMP%\\3F33.tmp\\Tools\\?","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%TEMP%\\3F49.tmp","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\system32\\en-US\\PROPSYS.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\system32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\system32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%TEMP%\\3F33.tmp\\3F34.bat","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%TEMP%\\3F33.tmp\\nRansom.exe.config","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%TEMP%\\3F33.tmp\\nRansom.exe","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\b8de0f79bc74f6c423e1c719ee7afefd\\Microsoft.VisualBasic.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\250e8e6af918e7ca66787117bc8633e3\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\75790ba48ebfa82fae7da9a114bc9886\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8990487b8c05ada1e1febe7dcb6c0410\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\24db7e31c7ba5b0e824e2f521c0914bc\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\SortDefault.nlp","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Runt73a1fc9d#\\3429c09afbdb2100c619fdeda717963d\\System.Runtime.Remoting.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%TEMP%\\3F33.tmp\\AxInterop.WMPLib.dll","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%TEMP%\\3F33.tmp\\Interop.WMPLib.dll","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MARLETT.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ARIAL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ARIALI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ARIALBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ARIALBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BATANG.TTC","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\COUR.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\COURI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\COURBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\COURBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\DAUNPENH.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\DOKCHAMP.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ESTRE.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\EUPHEMIA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GAUTAMI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GAUTAMIB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\VANI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\VANIB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GULIM.TTC","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\IMPACT.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ISKPOTA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ISKPOTAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\KALINGA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\KALINGAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\KARTIKA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\KARTIKAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\KHMERUI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\KHMERUIB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LAOUI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LAOUIB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LATHA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LATHAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LUCON.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MALGUN.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MALGUNBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MANGAL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MANGALB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MEIRYO.TTC","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MEIRYOB.TTC","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\HIMALAYA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MSJH.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MSJHBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MSYH.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MSYHBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MINGLIU.TTC","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MINGLIUB.TTC","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MONBAITI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MSGOTHIC.TTC","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MSMINCHO.TTC","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MVBOLI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\NTAILU.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\NTAILUB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\NYALA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\PHAGSPA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\PHAGSPAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\PLANTC.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\RAAVI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\RAAVIB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SEGOESC.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SEGOESCB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUII.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SEGUISB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SEGUISYM.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SHRUTI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SHRUTIB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SIMSUN.TTC","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SIMSUNB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SYLFAEN.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TAILE.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TAILEB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TIMES.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TIMESI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TIMESBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TIMESBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TUNGA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TUNGAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\VRINDA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\VRINDAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SHONAR.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SHONARB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MSYI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TAHOMA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TAHOMABD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MICROSS.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ANGSA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ANGSAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ANGSAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ANGSAZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\APARAJ.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\APARAJB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\APARAJBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\APARAJI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CORDIA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CORDIAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CORDIAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CORDIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\EBRIMA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\EBRIMABD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GISHA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GISHABD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\KOKILA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\KOKILAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\KOKILABI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\KOKILAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LEELAWAD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LEELAWDB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MSUIGHUR.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MOOLBOR.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SYMBOL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UTSAAH.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\VIJAYA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\VIJAYAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\WINGDING.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MODERN.FON","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ROMAN.FON","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SCRIPT.FON","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ANDLSO.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ARABTYPE.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SIMPO.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SIMPBDO.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SIMPFXO.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MAJALLA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MAJALLAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TRADO.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TRADBDO.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\AHRONBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\DAVID.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\DAVIDBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\FRANK.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LVNM.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LVNMBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MRIAM.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MRIAMC.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\NRKIS.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ROD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SIMFANG.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SIMHEI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SIMKAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ANGSAU.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BROWA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BROWAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BROWAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BROWAZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BROWAU.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BROWAUI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BROWAUB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BROWAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CORDIAU.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCDL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCDI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCDB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCDBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCEL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCEI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCEB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCEBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCFL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCFI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCFB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCFBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCIL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCII.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCIB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCIBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCJL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCJI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCJB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCJBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCKL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCKI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCKB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCKBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCLL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCLI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCLB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\UPCLBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\KAIU.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\L_10646.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ARIBLK.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CALIBRI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CALIBRII.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CALIBRIB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CALIBRIZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIA.TTC","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CANDARA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CANDARAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CANDARAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CANDARAZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\COMIC.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\COMICBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CONSOLA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CONSTAN.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CONSTANI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CONSTANB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CONSTANZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CORBEL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CORBELI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CORBELB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CORBELZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\FRAMD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\FRAMDIT.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GABRIOLA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GEORGIA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\PALA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\PALAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\PALAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\PALABI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SEGOEPR.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SEGOEPRB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TREBUC.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TREBUCIT.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TREBUCBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TREBUCBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\VERDANA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\VERDANAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\VERDANAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\VERDANAZ.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\WEBDINGS.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\COURE.FON","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SERIFE.FON","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SSERIFE.FON","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SMALLE.FON","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SMALLF.FON","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\HATTEN.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ANTQUAB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ANTQUABI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ANTQUAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BKANT.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GOTHIC.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GOTHICB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GOTHICBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GOTHICI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ARIALN.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ARIALNB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ARIALNBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ARIALNI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GARA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GARABD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GARAIT.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MTCORSVA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\AGENCYB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\AGENCYR.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ARLRDBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ITCBLKAD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BOD_B.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BOD_BI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BOD_I.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BOD_R.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BOD_BLAI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BOD_BLAR.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BOD_CB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BOD_CBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BOD_CI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BOD_CR.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BOOKOS.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BRADHITC.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CALIST.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CALISTB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CALISTBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CALISTI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CASTELAR.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CENSCBK.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\COPRGTB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\COPRGTL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CURLZ___.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ITCEDSCR.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ELEPHNT.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ELEPHNTI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ENGR.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ERASBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ERASDEMI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ERASLGHT.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ERASMD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\FELIXTI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\FORTE.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\FRABK.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\FRABKIT.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\FRADM.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\FRADMIT.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\FRADMCN.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\FRAHV.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\FRAHVIT.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\FRAMDCN.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\FRSCRIPT.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GIGI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GILBI___.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GILB____.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GILI____.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GIL_____.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GILC____.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GILSANUB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GILLUBCD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GLSNECB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GLECB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GOUDOS.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GOUDOSB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GOUDOSI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\GOUDYSTO.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\IMPRISHA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LSANS.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LSANSD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LSANSDI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LSANSI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LTYPE.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LTYPEB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LTYPEBO.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LTYPEO.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MAIAN.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\OCRAEXT.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\PALSCRI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\PAPYRUS.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\PERBI___.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\PERB____.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\PERI____.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\PER_____.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\PERTIBD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\PERTILI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\PRISTINA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\RAGE.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ROCK.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ROCKB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ROCKBI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ROCKI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ROCCB___.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ROCC____.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ROCKEB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SCRIPTBL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TCBI____.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TCB_____.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TCCM____.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TCCB____.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TCCEB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TCMI____.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TCM_____.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ALGER.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BASKVILL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BAUHS93.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BELL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BELLB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BELLI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BRLNSB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BRLNSDB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BRLNSR.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BERNHC.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BOD_PSTC.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BRITANIC.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BROADW.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BRUSHSCI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CALIFB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CALIFI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CALIFR.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CENTAUR.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CHILLER.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\COLONNA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\COOPBL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\FTLTLT.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\FREESCPT.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\HARLOWSI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\HARNGTON.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\HTOWERT.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\HTOWERTI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\JOKERMAN.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\JUICE___.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ITCKRIST.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\KUNSTLER.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LBRITE.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LBRITED.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LBRITEDI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LBRITEI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LCALLIG.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LFAX.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LFAXD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LFAXDI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LFAXI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LHANDW.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MAGNETOB.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MATURASC.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MISTRAL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MOD20.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\NIAGENG.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\NIAGSOL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\OLDENGL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ONYX.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\PARCHM.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\PLAYBILL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\POORICH.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\RAVIE.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\INFROMAN.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SHOWG.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\SNAP____.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\STENCIL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\TEMPSITC.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\VINERITC.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\VIVALDII.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\VLADIMIR.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\LATINWD.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\CENTURY.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\WINGDNG2.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\WINGDNG3.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\ARIALUNI.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\MSMINCHO.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%COMMONPROGRAMFILES%\\MICROSOFT SHARED\\EQUATION\\MTEXTRA.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\OUTLOOK.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\BSSYM7.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\REFSAN.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\FONTS\\REFSPCL.TTF","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\system32\\en-US\\wmploc.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\system32\\wmp.dll","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\system32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\mpvis.DLL","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%PROGRAMFILES%\\Windows Media Player\\en-US\\mpvis.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%WINDIR%\\system32\\en-US\\wininet.dll.mui","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%TEMP%\\7F96.tmp\\Tools\\?","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%TEMP%\\7FC7.tmp","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\system32\\cmdā㸵瞽","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%TEMP%\\7F96.tmp\\7F97.bat","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%TEMP%\\7F96.tmp\\nRansom.exe.config","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\77f338d420d067a26b2d34f47445fc51\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%TEMP%\\7F96.tmp\\nRansom.exe","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\assembly\\pubpol107.dat","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\1c459c609c9edf4427ae91b4293b0d0a\\Microsoft.VisualBasic.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\0b2f69b43a576b9edcc807a30872bd91\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\7aa0dcace3b5d10b626540709537d280\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\fb36278a0a934ae244f843b62229421c\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\3c20a6b0ca532bcc6271bf4b7ad0b4d9\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\ce9750286ad44cbfb2acf176df9df0a2\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\bf505bb2c2b60e7a40740888cd2c3172\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Runt73a1fc9d#\\87f2fdbe093d6be28c051bd351aa39dd\\System.Runtime.Remoting.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%TEMP%\\7F96.tmp\\AxInterop.WMPLib.dll","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%TEMP%\\7F96.tmp\\Interop.WMPLib.dll","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\Fonts\\msjh.ttf","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\Fonts\\msyh.ttf","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\Fonts\\malgun.ttf","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\Fonts\\micross.ttf","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\SysWOW64\\wmp.dll","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\SysWOW64\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%TEMP%\\7F96.tmp\\Tools","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%TEMP%\\7F96.tmp","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Media Player","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"path":"%TEMP%\\776A.tmp\\776B.tmp","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"path":"%TEMP%\\776A.tmp\\Tools","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"path":"%TEMP%\\77BA.tmp","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\MEDIAPLAYER\\PREFERENCES\\\\","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\MEDIAPLAYER\\PREFERENCES\\\\","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\\RNG\\","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\NRANSOM_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\MEDIAPLAYER\\PREFERENCES\\\\","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\MEDIAPLAYER\\HEALTH\\{1A638459-94CF-4133-A51A-420790AA8004}\\","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"},{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!l9mizr2!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!l9mizr2!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!l9mizr2!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\__?_c:_users_%OSUSER%_appdata_local_microsoft_media player_currentdatabase_372.wmdb","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\__?_c:_users_%OSUSER%_appdata_local_microsoft_media player_currentdatabase_372.wmdb:x","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\__?_c:_users_%OSUSER%_appdata_local_microsoft_media player_currentdatabase_372.wmdb:splk:3388","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:1","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:2","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:3","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:4","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:5","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:6","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:7","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:8","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:9","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:10","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:11","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:12","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:13","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:14","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Global\\__?_c:_users_%OSUSER%_appdata_local_microsoft_media player_currentdatabase_372.wmdb:splk:3388","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:13","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Global\\__?_c:_users_%OSUSER%_appdata_local_microsoft_media player_currentdatabase_372.wmdb:x","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:3","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:6","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:11","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Local\\c:!users!l9mizr2!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:1","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:5","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:4","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:8","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Global\\__?_c:_users_%OSUSER%_appdata_local_microsoft_media player_currentdatabase_372.wmdb","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"},{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"Local\\c:!users!l9mizr2!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:2","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:9","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:12","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:10","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Local\\c:!users!l9mizr2!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"Global\\{e80334ff-f89b-45c0-8135-db2fe48ee7d3}:sqlce_se_lck:7","sources":[{"report_type":"sandbox","report_id":"59c4219f7ca3e158c73f7803"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\__?_c:_users_%OSUSER%_appdata_local_microsoft_media player_currentdatabase_372.wmdb:splk:1824","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:1","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:2","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:3","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:4","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:5","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:6","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:7","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:8","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:9","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:10","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:11","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:12","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:13","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:14","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:13","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:5","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:10","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:12","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:7","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:9","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:8","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:1","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:11","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:3","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:2","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:6","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"Global\\{20e51dff-77a1-46fa-b776-d449c4075ca4}:sqlce_se_lck:4","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"Global\\__?_c:_users_%OSUSER%_appdata_local_microsoft_media player_currentdatabase_372.wmdb:splk:1824","sources":[{"report_type":"sandbox","report_id":"5a421d177ca3e15c7f724494"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5640:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5640:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"Local\\SM0:5640:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"Local\\SM0:5640:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"Global\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1068:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1068:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"Local\\SM0:1068:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]},{"name":"Local\\SM0:1068:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"638ce53000418a13e74e7f54"}]}]}},"report_ids":{"sandbox_job_ids":["638ce53000418a13e74e7f54","5a421d177ca3e15c7f724494","59c4219f7ca3e158c73f7803"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Malware Sample c89944f9ec70… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c89944f9ec70…. Malware family: Malware. Threat score 100/100. 1/1 AV engines flagged this file. 13 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample c89944f9ec70… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c89944f9ec70…. Malware family: Malware. Threat score 100/100. 1/1 AV engines flagged this file. 13 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c89944f9ec704c2b8da3a1acf726699022e7c68334110f72007d762217a9a4a5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample c89944f9ec70… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c89944f9ec70…. Malware family: Malware. Threat score 100/100. 1/1 AV engines flagged this file. 13 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]