26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T495,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 926a947ea2b5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 926a947ea2b5…. Malware family: Trojan.Generic. Threat score 100/100. 10/28 AV engines flagged this file. 3 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/926a947ea2b59d3e9a5a6875b4de2bd071b15260370f4da5e2a60ece3517a32f","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","926a947ea2b59d3e9a5a6875b4de2bd071b15260370f4da5e2a60ece3517a32f"],"about":{"@type":"SoftwareApplication","name":"21031 ___ __ _____ ____(06_).docx","applicationCategory":["docx","office"],"identifier":"926a947ea2b59d3e9a5a6875b4de2bd071b15260370f4da5e2a60ece3517a32f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":10,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T44e,"\Sessions\1\BaseNamedObjects\Global\552FFA80-3393-423d-8671-7BA046BB5906" "Local\10MU_ACB10_S-1-5-5-0-69386" "{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-82C2334A" "Local\CSI_WDW:{4E0309D0-9B12-4BC9-8281-EF76C4361675}" "{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-F26B9520" "Local\CSI_OMTX:{C71E60BC-E119-4F23-A68B-D65429840EF3}" "Local\10MU_ACBPIDS_S-1-5-5-0-69386" "Local\Csi_TableRuntimeBucketsLock:{762736DB-9A36-44EC-9130-D84152FB3D4F}" "Local\CSI_WDW:{762736DB-9A36-44EC-9130-D84152FB3D4F}" "{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-7EE9E94D" "{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-470244F5" "Local\CSI_OMTX:{4E0309D0-9B12-4BC9-8281-EF76C4361675}" "{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-E983D81B" "{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-AC22F05C" "Global\MsoShellExtRegAccess_S-1-5-21-2092356043-4041700817-663127204-1001" "Local\CSI_WDW:{0570DE63-0474-4D88-8253-6696C12EB662}" "Local\ZonesCacheCounterMutex" "Local\ZonesLockedCacheCounterMutex" "Global\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001" "Global\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001"28:Tfca,"21031_______________06__.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Thu Dec 8 09:17:21 2022 mtime=Thu Dec 8 09:17:21 2022 atime=Thu Dec 8 09:16:40 2022 length=138715 window=hide"- Location: [%APPDATA%\Microsoft\Office\Recent\21031_______________06__.LNK]- [targetUID: 00000000-00003680] "~_031_______________06__.docx" has type "data"- [targetUID: 00000000-00003680] "BEB9A4E4.png" has type "PNG image data 446 x 87 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.MSO\BEB9A4E4.png]- [targetUID: 00000000-00003680] "FSD-_1136B9EA-CEB6-4EC5-9682-1B5D18791BDC_.FSD" has type "data"- [targetUID: 00000000-00003680] "A1321AC2.jpg" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 144x159 components 3"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.MSO\A1321AC2.jpg]- [targetUID: 00000000-00003680] "95697716.jpg" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 150x159 components 3"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.MSO\95697716.jpg]- [targetUID: 00000000-00003680] "9054EB94.jpg" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 122x138 components 3"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.MSO\9054EB94.jpg]- [targetUID: 00000000-00003680] "_83E2DEB3-3AD4-427C-A7E1-6C8257DC35C9_" has type "data"- [targetUID: 00000000-00003680] "919165C8.jpg" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 144x159 components 3"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.MSO\919165C8.jpg]- [targetUID: 00000000-00003680] "C326A7DB.jpg" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 144x159 components 3"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.MSO\C326A7DB.jpg]- [targetUID: 00000000-00003680] "185EC2A.png" has type "PNG image data 52 x 87 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.MSO\185EC2A.png]- [targetUID: 00000000-00003680] "index.dat" has type "data"- Location: [%APPDATA%\Microsoft\Office\Recent\index.dat]- [targetUID: 00000000-00003680] "C1643795.png" has type "PNG image data 52 x 87 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.MSO\C1643795.png]- [targetUID: 00000000-00003680] "FSF-_0E1EEE64-E8C6-4E2A-9759-63CF07FD8988_.FSF" has type "data"- [targetUID: 00000000-00003680] "4377DB29.jpg" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 206x159 components 3"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.MSO\4377DB29.jpg]- [targetUID: 00000000-00003680] "40F2BBB1.png" has type "PNG image data 52 x 87 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.MSO\40F2BBB1.png]- [targetUID: 00000000-00003680] "~WRS_D808F822-5C92-4C89-91E2-DFBF9ECBAA17_.tmp" has type "dBase III DBT version number 0 next free block index 13"- [targetUID: 00000000-00003680] "~WRS_4630B7E8-62A7-4113-AB07-D7D5120F53D2_.tmp" has type "data"- [targetUID: 00000000-00003680] "1DD8E9A1.png" has type "PNG image data 52 x 86 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.MSO\1DD8E9A1.png]- [targetUID: 00000000-00003680] "E466EABC.png" has type "PNG image data 52 x 87 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.MSO\E466EABC.png]- [targetUID: 00000000-00003680]29:T941,"OPTIONS /templates-for-word/ HTTP/1.1 User-Agent: Microsoft Office Protocol Discovery Host: ms-offices.com Content-Length: 0 Connection: Keep-Alive" "HTTP/1.1 302 Found Date: Wed, 02 Nov 2022 08:07:46 GMT Server: Apache/2.4.41 (Ubuntu) Location: https://templates.office.com Content-Length: 293 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 302 Found

Found

The document has moved here.

Apache/2.4.41 (Ubuntu) Server at ms-offices.com Port 443

" "HEAD /templates-for-word/download?id=TYV6YAYWOPEKI61Y HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft Office Existence Discovery Host: ms-offices.com" "HTTP/1.0 500 Internal Server Error Date: Wed, 02 Nov 2022 08:07:47 GMT Server: Apache/2.4.41 (Ubuntu) Connection: close Content-Type: text/html; charset=UTF-8" "OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: ms-offices.com" "HTTP/1.1 302 Found Date: Wed, 02 Nov 2022 08:08:02 GMT Server: Apache/2.4.41 (Ubuntu) Location: https://templates.office.com Content-Length: 293 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 302 Found

Found

The document has moved here.

Apache/2.4.41 (Ubuntu) Server at ms-offices.com Port 443

" "HTTP/1.1 302 Found Date: Wed, 02 Nov 2022 08:08:17 GMT Server: Apache/2.4.41 (Ubuntu) Location: https://templates.office.com Content-Length: 293 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 302 Found

Found

The document has moved here.

Apache/2.4.41 (Ubuntu) Server at ms-offices.com Port 443

" "HTTP/1.0 500 Internal Server Error Date: Wed, 02 Nov 2022 08:08:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8"2a:Ta60,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAHjUlEQVR42s2X+2+T5xXH+wc42TSp2gqsdBstLWtWrdLWaRvttlbrqhZUykoZo4ymIW0Yl3XpSi8SascGlADhUkjI/eYkjnOHOOROSCjEy/1CLk58iS+xncSxE4fE9uv3u/M8r21iRpWo2g99pa8SkOzv53vOc87z5oEHvqlPRVMPlqq8sRtlDV1cpfVdKKnrQDFTTQeUNe0ouvofKKrVKCQVqNpIt5BPP595NQ4bt8TiawGs9BFFUvAnye8HBJK86hbij6ZxiF9ujl4eIupgKaL2lyFqXymePkC/xynx5LtF2LBHgQ1vF+CJt+R4fFce1u/MwWM7svHo9kys25YeMubmSwDyrnwJkwPYvv/I8hA/IfNdZ5rR0GuBY85DXyauKP2Ptqbe19xHyq1s5QCjVh82/vGvXw0RFTCfml3Eog+Ymgd008BtK9BnBnpMQJcB6GDSS2L/Zs8PX70UDkC/BAGyyq+HALq18/jZppj7Q7CyN/SaufnoFGlSxLBVxACZdzIzvYhOLaDWAG0aEe1j9P86kff90S13AYrUc2HKLG1eAuBGS78DT734l/+FiNpXwsvOkss+vQ3Z0WHE19vhmPdjfaIGEYe6EV+sx8dKHSL+3IDI11T49suVWPQI+MWu7FB6ZsqeGbcPg0Y30kua0NQ7hbpOO6rUEyhtNUHRaAhB3AXYq+Q911PZY8utkH2uwRsVNswtilh7UgPZRz3YnDyMxoEZRO5sROTWahyTD8FLdX5qW1oYwB2Pn86BiLbBSaQXNyL6Hyfx5nvHsW3vZ9gU/RFe2PEefvVaHIcIAbCTzh7W8/Q2N2THRvBs9jjmPSJVZACyD7vx4PvtWPAKeP7Tbl6BvjEnBAFY98rFMACWXD00Bee8D0XXTShoNkLeNA55nTak3HpdOMCPYxUcoN8sHTDWhifPj6KZ+ib7pBcR73fge/FqaKzzeGh3EyK3qHj5mfHa358NA5A321DYYkVOowWny7S4dNWIz7I7MbcgwnXHjxlqa3bdPQAbYgo5ADvtbXTAZNRz2Yc9eO6LEcjiOyDb34ZvvdOKzSco/bYaRMU0YH5B4J9Z83xiGMBxxTDOVeqQWmPGuQo9LlWbOMDsHRFOAnDM+ZFZawgHeCI6n38ZG62bI8CvTwxB9jc1ZAfUeORQB1KaLPjO29cQ+adaXv4zyhGMmvz8M6t/e5qbs9FjACx5QcsE8pomcP7yOJJUEoCLAGbcfkwTQFrNvQC78/iXsfJ/OQx8UGBBRGwrIva04JnD7VQ+Aat2E8BWFSI3VWLYMIuqm9KiWvObU6Hlw4y+Ss55EQ4CmJr1I6V6PBxg/c5cCYAqcIMAUmpciHizkY/cu0n9sDkEPLS9DpGvVOK7BLBA/c9SSQCrnz0pLR5BhJfk8YlY9Io0DSLcNEVzC37ee2Y+TeZ2lx8Xq0zhAI/tyApVgAFUtfv4qLHEB5P6YLILWE9AkS+W4vE3quC+IyDtigSwamMCFOy0XxtHHs14Tr0eWbU6pF8dQ6pqFMlXNLh4eYSX3u4SYHUKOHfZHA7ALpXQGaBt19QHVHcAKrWI8hsi8mpFJFeATIEMFbh5ciVCACz10uTzS5IH+z5J6a1OPyxUzcSKewDWvZ6Or/swgGDyzFptePLKYXxRPoRzZYOwUfqJGT9M0wISyizhAOxGY5fKDzYn4RFaLGtfuoCH/3AeD9OMf/+FM1jzu0R+2lc/dwqrqOfMdKmCqaWeS/PupHmfdkvJJXOBm49PCThWag0HuN+TWXqdNp/IVdFmRdnNCZTcsEDZYkbhdSPyAz3PDiRPo+QpPPlIKPnZ0kEkltzGaeUAzFR6I5nr7D4cUdqWB8igm4yt4pAWw+WmHrO0TLOBfrPUjlDPhbvJHSy5D3oyH6Ob8bBicgUAxdfoMvLzwxRKTns9n/Z6boOBr9PMGkpeHZ78/JLkpyh5QlE/ThT2SeY2HzQTPnxcML08QJqyiW8vlmyp2EJhSZnYCWerlSWempXGzOaUUrOS855PsrILPPkImQ+ZvfhAvgKA1KJGfnEwk8LAjRZMnhFMXqVBEs34hYolyYsDyRX9+LywF8fze3FU3hMyv2304u+5M8sDpCgaeDKeLpBwMjDPduov22g2l58vFpbYEkhsJBkmpcPGSs7ehoYtXgyaJPO+cS8O5jiXB0gurJdK6hJCpWVihlaa56BpsNTshBtICYo+nvxYfg9P/q+8bhzJ7cIAmfcavOjWe7Evy7UCgII6bsKNZnwkgcs8LRkGTVmPDXapz1q7lJgdtBGWmko+YJJS9xg83LxT50VcxuzyAEn5dXx8TNM+yZDGyEhihuOTNFIkVmad7W6pRya83HiIlZvUP+5BH6XuIeMunQcdWg/Uox7Eps8tD3BRXst7GZQ+0FdmqA2ZejEaSDscSMyNA73u1XvojdpDb9QeepOWzG9pPIhJc68MgJW1tUOH6htjKG7QIueqli4hI87QbRbU6UozEsotOF42gX+X2PDPYjsOF03SrE/RuDn4iT+Q7cJe6vs7GXOIofTRqSsAuJBXg7hPzuLl3Yf4W+zPN+3BT196i3/w/6VvxF/h/wUEhERwDDVFQQAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"926a947ea2b59d3e9a5a6875b4de2bd071b15260370f4da5e2a60ece3517a32f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790794154742,"unified_at":"2026-09-30T18:49:14.742Z","metadata":{"hashes":{"sha256":"926a947ea2b59d3e9a5a6875b4de2bd071b15260370f4da5e2a60ece3517a32f","sha1":"986de6bc24a480f6d0ab631f21bd5f38d70490d9","md5":"476027afdbf18c18e076fff71a8ef588","sha512":"2452a06909d600b4a2cbe9277e0cd505ed570790eb08a3f9e5bd781377e4643ea31233c5c660953b97ae522e42ffe52f2a27ab7c88edcb84edbaf34e1d162127","ssdeep":"3072:ZFKGRmSIKJgG5IzEzz4n/Ailt4s8wbu2I7TO2k2bd2Iqf8kI:uGUSIKJHfzdyt5q97TOtAd9qf87","ssdeep_chunks":["3072:ZFKGRmS","3072:FKGRmSI","3072:KGRmSIK","3072:GRmSIKJ","3072:RmSIKJg","3072:mSIKJgG","3072:SIKJgG5","3072:IKJgG5I","3072:KJgG5Iz","3072:JgG5IzE","3072:gG5IzEz","3072:G5IzEzz","3072:5IzEzz4","3072:IzEzz4n","3072:zEzz4n/","3072:Ezz4n/A","3072:zz4n/Ai","3072:z4n/Ail","3072:4n/Ailt","3072:n/Ailt4","3072:/Ailt4s","3072:Ailt4s8","3072:ilt4s8w","3072:lt4s8wb","3072:t4s8wbu","3072:4s8wbu2","3072:s8wbu2I","3072:8wbu2I7","3072:wbu2I7T","3072:bu2I7TO","3072:u2I7TO2","3072:2I7TO2k","3072:I7TO2k2","3072:7TO2k2b","3072:TO2k2bd","3072:O2k2bd2","3072:2k2bd2I","3072:k2bd2Iq","3072:2bd2Iqf","3072:bd2Iqf8","3072:d2Iqf8k","3072:2Iqf8kI","6144:ZFKGRmS","6144:FKGRmSI","6144:KGRmSIK","6144:GRmSIKJ","6144:RmSIKJg","6144:mSIKJgG","6144:SIKJgG5","6144:IKJgG5I","6144:KJgG5Iz","6144:JgG5IzE","6144:gG5IzEz","6144:G5IzEzz","6144:5IzEzz4","6144:IzEzz4n","6144:zEzz4n/","6144:Ezz4n/A","6144:zz4n/Ai","6144:z4n/Ail","6144:4n/Ailt","6144:n/Ailt4","6144:/Ailt4s","6144:Ailt4s8","6144:ilt4s8w","6144:lt4s8wb","6144:t4s8wbu","6144:4s8wbu2","6144:s8wbu2I","6144:8wbu2I7","6144:wbu2I7T","6144:bu2I7TO","6144:u2I7TO2","6144:2I7TO2k","6144:I7TO2k2","6144:7TO2k2b","6144:TO2k2bd","6144:O2k2bd2","6144:2k2bd2I","6144:k2bd2Iq","6144:2bd2Iqf","6144:bd2Iqf8","6144:d2Iqf8k","6144:2Iqf8kI","3072:uGUSIKJ","3072:GUSIKJH","3072:USIKJHf","3072:SIKJHfz","3072:IKJHfzd","3072:KJHfzdy","3072:JHfzdyt","3072:Hfzdyt5","3072:fzdyt5q","3072:zdyt5q9","3072:dyt5q97","3072:yt5q97T","3072:t5q97TO","3072:5q97TOt","3072:q97TOtA","3072:97TOtAd","3072:7TOtAd9","3072:TOtAd9q","3072:OtAd9qf","3072:tAd9qf8","3072:Ad9qf87"],"imphash":"Unknown"},"file_info":{"file_name":"21031 ___ __ _____ ____(06_).docx","file_type":["docx","office"],"file_type_id":"docx","file_size":138715,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1667230031000,"last_seen":1678201100000,"last_multi_scan":1678201100000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":10,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":5},"sandbox_signatures":{"informative_count":14,"suspicious_count":4,"malicious_count":3,"total":21},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Downloader/DOC.External","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Macro.Subdoc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.63279887","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.63279887 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!251E9ADC3C9F6A42","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Downloader.MSOffice.Agent.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DocDl-AGTB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Trojan.49CCAC41","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Trojan.49CCAC41","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Decrypted SSL network traffic"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Creates mutants","description":"$27","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"~_031_______________06__.docx\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"\"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\" (Indicator: \"mozilla/4.0 (\")\n \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729;\" (Indicator: \"mozilla/4.0 (\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 68C80000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ms-offices.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$28","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops LNK files (Windows shortcut)","description":"\"21031_______________06__.LNK\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Thu Dec 8 09:17:21 2022 mtime=Thu Dec 8 09:17:21 2022 atime=Thu Dec 8 09:16:40 2022 length=138715 window=hide\"- Location: [%APPDATA%\\Microsoft\\Office\\Recent\\21031_______________06__.LNK]- [targetUID: 00000000-00003680]","origin":"Binary File","relevance":5,"id":"binary-31","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://ms-offices.com/templates-for-word/download?id=TYV6YAYWOPEKI61Y\"\n Heuristic match: \"s,9{'L@,eonV 4u72.Ba\"\n Heuristic match: \"jh6Had<11a 6BO|>dI@qX\\\\>.cf\"\n Pattern match: \"BcCQ3V.Tp/^L}iRb!uid.?+frMNN1:lq#k\"\n Heuristic match: \"$/GqtVWtai:4mwcC~4u&&QPrBp.NG\"\n Heuristic match: \"ms-offices.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\"https://ms-offices.com/templates-for-word/download?id=TYV6YAYWOPEKI61Y\" (Indicator: \"https://\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"21031_______________06__.LNK\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\21031_______________06__.LNK]- [targetUID: 00000000-00003680]\n Dropped file: \"index.dat\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\index.dat]- [targetUID: 00000000-00003680]\n Dropped file: \"ExcludeDictionaryEN0409.lex\" - Location: [%APPDATA%\\Microsoft\\UProof\\ExcludeDictionaryEN0409.lex]- [targetUID: 00000000-00003680]","origin":"Binary File","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"15/90 reputation engines marked \"http://ms-offices.com\" as malicious (16% detection rate)\n 4/90 reputation engines marked \"https://ms-offices.com/templates-for-word/download\" as malicious (4% detection rate)\n 15/91 reputation engines marked \"https://ms-offices.com\" as malicious (16% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"34/65 Antivirus vendors marked sample as malicious (52% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"r5@dby.f4bp\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: msoffice/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"34/65 Antivirus vendors marked sample as malicious (52% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"108.166.183.161:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"MessageBeeps\" (Indicator: \"MessageBeep\")\n \"Executable\" (Indicator: \"Executable\")\n \"IsSystemExecutable\" (Indicator: \"Executable\")\n \"SystemExecutableArchitecture\" (Indicator: \"Executable\")","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"level":"informative","category":"Network Related","name":"Decrypted SSL network traffic","description":"$29","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"\"HTTPS traffic to 108.166.183.161 on port 443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 108.166.183.161 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":106,"imported_dlls_count":185,"dropped_files_count":0,"extracted_files_count":41,"files_written_count":70,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6391b9517af2d7143b45d6ff","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"CVE-2017-0199","submit_name":"21031 ___ __ _____ ____(06_).docx","analysis_start_time":"2022-12-08T10:15:46+00:00","indicators_count":{"informative":10,"suspicious":3,"malicious":3},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"636224208068c06ae769b67e","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"CVE-2017-0199","contacted_countries":["USA"],"submit_name":"21031 ★서울 용산 이태원사고 대처상황(06시).DOCX","analysis_start_time":"2022-11-02T08:02:41+00:00","indicators_count":{"informative":14,"suspicious":4,"malicious":3},"tags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true},{"id":"636223ec7b9b970afb2eafc7","environment_id":160,"environment_description":"Windows 10 64 bit","state":"ERROR","error_type":"The archive file \"21031 ??? ?? ????? ????(06?).DOCX.VIR\" contains too many files","verdict":"undetected","submit_name":"21031 ★서울 용산 이태원사고 대처상황(06시).DOCX.VIR","analysis_start_time":"2022-11-02T08:01:49+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":[{"address":"108.166.183.161","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]}],"dns_resolutions":[{"domain":"ms-offices.com","country":"-","registrar_name":"NetEarth One, Inc.","registrar_organization":"Kingsoft Office","registrar_name_servers":"NS13.SHARED-SERVERS.COM","registrar_creation_date":"2022-10-24T03:42:54+00:00","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}],"processes":[{"pid":3680,"ppid":0,"name":"WINWORD.EXE","command_line":"/n \"C:\\21031_______________06__.docx\"","sha256":"ee944590b3c253325688f3c1cddc9a439b5a80a3a36443b4b5de788db19d2973","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","uid":"00000000-00003680","icon":"$2a"}],"all_imported_dlls":["dwmapi.dll","fontsub.dll","nlaapi.dll","ws2_32.dll","msxml6.dll","clbcatq.dll","RpcRtRemote.dll","winnsi.dll","srvcli.dll","OSPPCEXT.DLL","msadox.dll","setupapi.dll","profapi.dll","WindowsCodecs.dll","linkinfo.dll","ExplorerFrame.dll","duser.dll","MSSP7EN.DLL","fltLib.dll","rasadhlp.dll","GdiPlus.dll","GFX.DLL","msi.dll","propsys.dll","WWLIB.DLL","api-ms-win-downlevel-shlwapi-l1-1-0.dll","winhttp.dll","mswsock.dll","wship6.dll","msvcrt.dll","normaliz.dll","psapi.dll","unidrvui.dll","ieframe.dll","cryptbase.dll","netutils.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","msvcp90.dll","CSS7DATA0009.DLL","kernel32.dll","mscoree.dll","MSO.DLL","sxs.dll","cscapi.dll","ole32.dll","dnsapi.dll","msxml6r.dll","ntshrui.dll","msvcr90.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","winsta.dll","nsi.dll","rsaenh.dll","wininet.dll","davhlpr.dll","iertutil.dll","WSHTCPIP.DLL","shlwapi.dll","MSOINTL.DLL","KernelBase.dll","npmproxy.dll","rpcrt4.dll","wtsapi32.dll","NL7MODELS0009.dll","secur32.dll","netapi32.dll","drprov.dll","ntmarta.dll","RICHED20.DLL","userenv.dll","sspicli.dll","msproof7.dll","mscss7en.dll","OART.DLL","MSGR3EN.DLL","advapi32.dll","msimg32.dll","MSPTLS.DLL","mscoreei.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","sfc.dll","prntvpt.dll","dhcpcsvc.dll","gdi32.dll","devobj.dll","rpcss.dll","cryptsp.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","ALRTINTL.DLL","ntlanman.dll","sechost.dll","MSORES.DLL","sfc_os.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","powrprof.dll","usp10.dll","oleaut32.dll","msctf.dll","imm32.dll","cfgmgr32.dll","mpr.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","msasn1.dll","hlink.dll","SendToOneNoteUI.dll","winmm.dll","GKWord.dll","WinSCard.dll","Wldap32.dll","tzres.dll","ntdll.dll","mscorwks.dll","oleacc.dll","user32.dll","uxtheme.dll","USP10.DLL","webio.dll","crypt32.dll","api-ms-win-core-synch-l1-2-0.dll","version.dll","wkscli.dll","comctl32.dll","slc.dll","dui70.dll","lpk.dll","Csi.dll","netprofm.dll","davclnt.dll","urlmon.dll","bcrypt.dll","credssp.dll","shell32.dll","WWINTL.DLL","OSPPC.DLL","apphelp.dll","mxdwdrv.dll","IPHLPAPI.DLL","dhcpcsvc6.dll","api-ms-win-downlevel-user32-l1-1-0.dll","DataExchange.dll","srpapi.dll","imagehlp.dll","dxgi.dll","winmmbase.dll","ucrtbase.dll","OnDemandConnRouteHelper.dll","ncrypt.dll","dpapi.dll","edputil.dll","SHCore.dll","kernel.appcore.dll","ShellPreviewHandler3D.dll","win32u.dll","ninput.dll","schannel.dll","winnlsres.dll","msIso.dll","FWPUCLNT.DLL","mskeyprotect.dll","CoreUIComponents.dll","rmclient.dll","dcomp.dll","windows.storage.dll","coml2.dll","ntasn1.dll","wintrust.dll","msvcp_win.dll","ncryptsslp.dll","d3d11.dll","policymanager.dll","AcGenral.dll","WinTypes.dll","twinapi.appcore.dll","bcryptprimitives.dll","msvcp110_win.dll","combase.dll","TextInputFramework.dll","CoreMessaging.dll","VxSSL64.dll","cldapi.dll","aepic.dll","mlang.dll","AcSpecfc.dll","gdi32full.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"~_031_______________06__.docx","sha256":"a101d3605f8d1ca5cfb10c48dbdb24c45f2627c48f44a2bd2604b88c7b90d5f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"21031_______________06__.LNK","sha256":"40d8adc7c525b4525b1d91195dfa4a61f0f9b860507fe9629264f7151825d37f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"index.dat","sha256":"81f2de07c72bd52820d3c810ff63dae526d6b83537e963bd56e4e7ad026bc221","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"ExcludeDictionaryEN0409.lex","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"FSF-CTBL.FSF","sha256":"09716406fe933ccefb9cda2613ff4fdf6fdbf3bd10fc1cfc62a04b0e99078f37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"FSD-CNRY.FSD","sha256":"0871d40c5bafc95f8eff75f387cb32e5e09306e9718d954e43c40ba4d9b63ccf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"1182E9E7.png","sha256":"88e6a506744a693f2b42de448ac92d78d0f7bc3c4fb1b38d485f253da7468d9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"1629EAAF.png","sha256":"71ef84231387fd1a57c7992579c97a9cf98a0d5f07ce9dbbc38ff2f3a767349f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"185EC2A.png","sha256":"7e37f81406d5615af75971d4d27391d9f7932ba0a5cd3c1c4c71df1e90f528e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"1DD8E9A1.png","sha256":"6140274ba45383a28cddfe3b4da0b39e7031e376f6119a0f470e46b45783c58c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"2BA0EE85.jpg","sha256":"9e10e5bf75c0409ac9f9d5bee32a73a8c84bff76b86c4336dab7f5943815d120","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"2DC93092.png","sha256":"be70d68d042480f847b1ec1edd212e1a276e79a9a6a7e6d7ed6bd4190f706739","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"3A797D57.png","sha256":"23988023db44aad05a19e07fed501d8d48e3b2d9cb70a5093b82a3a79f9a0d5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"3AD3A36B.png","sha256":"44c648b6d9685f7a0b4b7b5c01b398e5a4cf12436eea8739b1752d416ce4f046","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"3CF3D01F.jpg","sha256":"b756aff82bf4229a0e2bb8dcf3fdd908395bc21fadbc9c7ee264022a845c2589","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"40F2BBB1.png","sha256":"d75d4e4c68661c20260a71aebe4dd739e53b58548d2440104249117640f6e46a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"4377DB29.jpg","sha256":"4ff7e674f9b9fa870543b5fa5dd14028a3b9bf9337de4369f431aa37771214aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"454EEE70.png","sha256":"d8316c9d52d630d32cf37873ed002db6003ec3d381abce4cad72518bb7919a1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"57650DFE.png","sha256":"5a05fcd297a418d6474648300fb86968a8a7c1c9598def4a29c0043f731c3cc5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"7FFFBA23.png","sha256":"2fdab2d8ce47944f798f15ac680083e7738dd9c58d71a5606c597288c3b90ec1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"871CD38D.png","sha256":"4c2369df502d28e27437fa37adb9ac2b11d6a216539ff826fd381ff718c762a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"~_Normal.dotm","sha256":"a101d3605f8d1ca5cfb10c48dbdb24c45f2627c48f44a2bd2604b88c7b90d5f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"~_031____06_.DOCX","sha256":"2820507593b307075160abd5158557826ee851a7792cb937cbac4998a1043c05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"21031____06_.LNK","sha256":"b89f96fec95ce97c44b268c829b1a11640cca4574625fbb4daba003db78aa5df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"23D33609.png","sha256":"d75d4e4c68661c20260a71aebe4dd739e53b58548d2440104249117640f6e46a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"26091E22.png","sha256":"7e37f81406d5615af75971d4d27391d9f7932ba0a5cd3c1c4c71df1e90f528e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"296BC7A6.png","sha256":"3dbd6a694f8ae0e06256c5ea6b73eb6e437893c983893cde31505be5ce657b0f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"2EEB4DFF.png","sha256":"88e6a506744a693f2b42de448ac92d78d0f7bc3c4fb1b38d485f253da7468d9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"38EC831C.png","sha256":"ca814f9317e91b03dc0a1c6e04ada4f560781e3c6af211a62716fa69e07cd109","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"39B21D5D.jpg","sha256":"9e10e5bf75c0409ac9f9d5bee32a73a8c84bff76b86c4336dab7f5943815d120","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"40225476.png","sha256":"5a05fcd297a418d6474648300fb86968a8a7c1c9598def4a29c0043f731c3cc5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"52F159F9.png","sha256":"6140274ba45383a28cddfe3b4da0b39e7031e376f6119a0f470e46b45783c58c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"631B5428.png","sha256":"d8316c9d52d630d32cf37873ed002db6003ec3d381abce4cad72518bb7919a1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"6B7FA081.jpg","sha256":"4ff7e674f9b9fa870543b5fa5dd14028a3b9bf9337de4369f431aa37771214aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"81CA13BB.png","sha256":"2fdab2d8ce47944f798f15ac680083e7738dd9c58d71a5606c597288c3b90ec1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"823F8765.png","sha256":"4c2369df502d28e27437fa37adb9ac2b11d6a216539ff826fd381ff718c762a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"8628280.jpg","sha256":"74e7323dbf2148709308847ec9b55a88d391033e03deeaa5016529d86af643bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"8840B737.jpg","sha256":"b756aff82bf4229a0e2bb8dcf3fdd908395bc21fadbc9c7ee264022a845c2589","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"8B3B476F.png","sha256":"23988023db44aad05a19e07fed501d8d48e3b2d9cb70a5093b82a3a79f9a0d5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"93A77BD8.jpg","sha256":"fb2f09723a9c5dfa422faa88dbd93374124fb9e68d9c8eb9ba82b7c1d530220c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"98A837CC.jpg","sha256":"cd569b407f92533031769e9b9ec22c89ce5d824a126ee7cb37a28163c7d1c2ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%TEMP%\\CVREFE5.tmp","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\3AD3A36B.png","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%APPDATA%\\Microsoft\\UProof","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\1629EAAF.png","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\BEB9A4E4.png","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\C1643795.png","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\2DC93092.png","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\454EEE70.png","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\40F2BBB1.png","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\57650DFE.png","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\1182E9E7.png","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\E466EABC.png","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\871CD38D.png","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\185EC2A.png","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\7FFFBA23.png","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\919165C8.jpg","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\4377DB29.jpg","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\95697716.jpg","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\3CF3D01F.jpg","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\9054EB94.jpg","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\2BA0EE85.jpg","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\A1321AC2.jpg","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\C326A7DB.jpg","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\B43AC820.jpg","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\1DD8E9A1.png","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\C1D3032E.png","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\3A797D57.png","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\14.0","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"\\device\\webdavredirector","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"path":"C:\\~$031____06_.DOCX","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\9CB22BC7.png","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\38EC831C.png","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\EDFBD06D.png","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\C57A038A.png","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\FD152A03.png","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\631B5428.png","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\23D33609.png","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\40225476.png","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\2EEB4DFF.png","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\C0ED8FF4.png","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\823F8765.png","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\26091E22.png","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\81CA13BB.png","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\8628280.jpg","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\6B7FA081.jpg","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\FC078C8E.jpg","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\8840B737.jpg","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\98A837CC.jpg","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\39B21D5D.jpg","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\C3D38BBA.jpg","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\E0943473.jpg","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\93A77BD8.jpg","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\52F159F9.png","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\296BC7A6.png","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\8B3B476F.png","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"path":"C:\\~WRD0001.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\REGISTRATION\\","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\REGISTRATION\\Y4ZNSK3W7SJMDNZ\\{71AF7E84-93E6-4363-9B69-699E04E74071}\\","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\REGISTRATION\\Y4ZNSK3W7SJMDNZ\\","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Local\\10MU_ACB10_S-1-5-5-0-69386","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-82C2334A","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"Local\\CSI_WDW:{4E0309D0-9B12-4BC9-8281-EF76C4361675}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-F26B9520","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"Local\\CSI_OMTX:{C71E60BC-E119-4F23-A68B-D65429840EF3}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"Local\\10MU_ACBPIDS_S-1-5-5-0-69386","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"Local\\Csi_TableRuntimeBucketsLock:{762736DB-9A36-44EC-9130-D84152FB3D4F}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"Local\\CSI_WDW:{762736DB-9A36-44EC-9130-D84152FB3D4F}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-7EE9E94D","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-470244F5","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"Local\\CSI_OMTX:{4E0309D0-9B12-4BC9-8281-EF76C4361675}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-E983D81B","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-AC22F05C","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"Global\\MsoShellExtRegAccess_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"Local\\CSI_WDW:{0570DE63-0474-4D88-8253-6696C12EB662}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"Local\\CSI_WDW:{C71E60BC-E119-4F23-A68B-D65429840EF3}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"Local\\CSI_WDW:{A1338645-5E85-48D2-8448-359F88DBCF71}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Local\\CSI_WDW:{9C19AC17-922A-45D8-AC78-7FEFB5BAA223}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"Local\\Csi_CTTxnLock:{091E1183-F691-46C8-A630-C2E057CFBE2B}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-52DCD007","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"Global\\MsoCsi:GC:C:/Users/Iv8K3pp/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"Global\\MsoCsi:GC:C:/Users/Iv8K3pp/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-6029465B","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-69386","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-69386","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"},{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-470244F5","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-6029465B","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_OMTX:{C71E60BC-E119-4F23-A68B-D65429840EF3}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{762736DB-9A36-44EC-9130-D84152FB3D4F}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{A1338645-5E85-48D2-8448-359F88DBCF71}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{C71E60BC-E119-4F23-A68B-D65429840EF3}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-7EE9E94D","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoCsi:GC:C:/Users/Iv8K3pp/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-82C2334A","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-52DCD007","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-AC22F05C","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_OMTX:{4E0309D0-9B12-4BC9-8281-EF76C4361675}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{0570DE63-0474-4D88-8253-6696C12EB662}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{9C19AC17-922A-45D8-AC78-7FEFB5BAA223}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{4E0309D0-9B12-4BC9-8281-EF76C4361675}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-E983D81B","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoCsi:GC:C:/Users/Iv8K3pp/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-F26B9520","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Csi_CTTxnLock:{091E1183-F691-46C8-A630-C2E057CFBE2B}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Csi_TableRuntimeBucketsLock:{762736DB-9A36-44EC-9130-D84152FB3D4F}","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoShellExtRegAccess_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"6391b9517af2d7143b45d6ff"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5404:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-826211E0","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Local\\x64_10MU_ACBPIDS_S-1-5-5-0-154585","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-BB89BC58","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Local\\SM0:5404:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Local\\SM0:5404:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-A81CD96","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-CE7D1AE0","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-D06063FD","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-82B2956F","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Local\\Csi_CTTxnLock:{1FA12FD0-FCA4-47A3-B095-D5AABB6DDEE2}","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Local\\CSI_OMTX:{4F806C1F-D77B-49B9-A70E-9B7946612301}","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Local\\CSI_OMTX:{26A7D77F-07D1-463E-AF08-8F18D278CF56}","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Global\\MsoCsi:GC:C:/Users/zf8XkiH/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Local\\CSI_WDW:{26A7D77F-07D1-463E-AF08-8F18D278CF56}","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Global\\MsoShellExtRegAccess_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Local\\x64_10MU_ACB10_S-1-5-5-0-154585","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Local\\CSI_WDW:{D07580C9-7790-4A82-870C-E0E2E745DCE2}","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Global\\MsoCsi:GC:C:/Users/zf8XkiH/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Local\\CSI_WDW:{0D48D5A8-BB64-4F58-B58D-15009522A762}","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Local\\CSI_WDW:{3D279058-1F30-4494-B67F-C0A3E726522F}","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Local\\CSI_WDW:{2882711E-87E5-4336-8692-198FE82F43A3}","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"Local\\CSI_WDW:{4F806C1F-D77B-49B9-A70E-9B7946612301}","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-11FB2F78","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACBPIDS_S-1-5-5-0-154585","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACB10_S-1-5-5-0-154585","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5404:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-BB89BC58","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_OMTX:{26A7D77F-07D1-463E-AF08-8F18D278CF56}","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{0D48D5A8-BB64-4F58-B58D-15009522A762}","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{2882711E-87E5-4336-8692-198FE82F43A3}","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{26A7D77F-07D1-463E-AF08-8F18D278CF56}","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-826211E0","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoCsi:GC:C:/Users/zf8XkiH/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-11FB2F78","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-D06063FD","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-82B2956F","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_OMTX:{4F806C1F-D77B-49B9-A70E-9B7946612301}","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{D07580C9-7790-4A82-870C-E0E2E745DCE2}","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{3D279058-1F30-4494-B67F-C0A3E726522F}","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{4F806C1F-D77B-49B9-A70E-9B7946612301}","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-CE7D1AE0","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoCsi:GC:C:/Users/zf8XkiH/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-A81CD96","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Csi_CTTxnLock:{1FA12FD0-FCA4-47A3-B095-D5AABB6DDEE2}","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoShellExtRegAccess_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"636224208068c06ae769b67e"}]}]}},"report_ids":{"sandbox_job_ids":["6391b9517af2d7143b45d6ff","636224208068c06ae769b67e"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 926a947ea2b5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 926a947ea2b5…. Malware family: Trojan.Generic. Threat score 100/100. 10/28 AV engines flagged this file. 3 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/926a947ea2b59d3e9a5a6875b4de2bd071b15260370f4da5e2a60ece3517a32f"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 926a947ea2b5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 926a947ea2b5…. Malware family: Trojan.Generic. Threat score 100/100. 10/28 AV engines flagged this file. 3 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/926a947ea2b59d3e9a5a6875b4de2bd071b15260370f4da5e2a60ece3517a32f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 926a947ea2b5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 926a947ea2b5…. Malware family: Trojan.Generic. Threat score 100/100. 10/28 AV engines flagged this file. 3 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]