26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 35:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4d0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Msoffice/malicious_confidence_90% Sample e8fa4bdb4a98… — Score 95/100 — Hybrid Analysis","description":"Malicious verdict for sample e8fa4bdb4a98…. Malware family: Msoffice/malicious_confidence_90%. Threat score 95/100. 1/25 AV engines flagged this file. 4 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","keywords":["Malicious","Msoffice/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0"],"about":{"@type":"SoftwareApplication","name":"OIM_Users_Guide v2.doc","applicationCategory":["doc","office"],"identifier":"e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","additionalType":"Malicious sample"},"threatScore":95,"malwareFamily":"Msoffice/malicious_confidence_90%","antivirusDetections":{"malicious":1,"total":25},"behavioralIndicators":{"malicious":4,"suspicious":3},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T53a,File "ThisDocument.cls" (Streampath: "Macros/VBA/ThisDocument") has code: "Private Sub Document_Open() If (LCase$(ActiveDocument.AttachedTemplate.Name) = "omguide.dot") Then OMGuide.AutoOpen.main End If End Sub" File "AutoOpen.bas" (Streampath: "Macros/VBA/AutoOpen") has code: "Public Sub main() On Error GoTo ErrorHandler Dim sOMTELocation As String 'Retrieve OMTE location from Windows Registry sOMTELocation = Application.System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Oracle Method", "OMTELocation") 'Add "\" at the end, if not there If (Not Right$(sOMTELocation, 1) = "\") Then sOMTELocation = sOMTELocation & "\" 'Attach the OumGuide.dot as the attached template With ActiveDocument .UpdateStylesOnOpen = False .AttachedTemplate = sOMTELocation & "Oumguide.dot" End With Exit Sub ErrorHandler: 'Error message displayed MsgBox "Oracle Method Template Engine could not be found in your computer - Document will open with Oracle Method Template Macros disabled.", vbOKOnly + vbExclamation, "Oracle Method Template Engine" End Sub" File "AutoClose.bas" (Streampath: "Macros/VBA/AutoClose") has code: "Public Sub main() ' I remove the Oumguide as the attached template ActiveDocument.AttachedTemplate = "" End Sub"28:T429,"\Sessions\1\BaseNamedObjects\Local\10MU_ACBPIDS_S-1-5-5-0-61684" "\Sessions\1\BaseNamedObjects\Global\552FFA80-3393-423d-8671-7BA046BB5906" "\Sessions\1\BaseNamedObjects\Local\10MU_ACB10_S-1-5-5-0-61684" "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Global\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000" "\Sessions\1\BaseNamedObjects\Global\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000" "Local\ZoneAttributeCacheCounterMutex" "Global\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000" "Local\ZonesLockedCacheCounterMutex" "Global\552FFA80-3393-423d-8671-7BA046BB5906" "Local\10MU_ACBPIDS_S-1-5-5-0-61684" "Global\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000" "Local\10MU_ACB10_S-1-5-5-0-61684" "Local\ZonesCounterMutex" "Local\ZonesCacheCounterMutex"29:T671,"WINWORD.EXE" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "WINWORD.EXE" touched file "%WINDIR%\Fonts\staticcache.dat" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\USER32.dll.mui" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\SETUPAPI.dll.mui" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "WINWORD.EXE" touched file "%WINDIR%\system32\rsaenh.dll" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\KERNELBASE.dll.mui" "WINWORD.EXE" touched file "%WINDIR%\System32\msxml6r.dll" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{43AB78BC-C491-4580-953C-57132257838B}.tmp" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\MSCTF.dll.mui" "WINWORD.EXE" touched file "%WINDIR%\system32\spool\DRIVERS\W32X86\3\sendtoonenote.BUD"2a:T86d,"WINWORD.EXE" wrote bytes "b811110000663d33c0bab800160668dcf52457c3" to virtual address "0x0617B04C" "WINWORD.EXE" wrote bytes "7e7df895" to virtual address "0x612678E4" (part of module "OART.DLL") "WINWORD.EXE" wrote bytes "03fd75d6" to virtual address "0x6DAE3408" (part of module "MSCSS7EN.DLL") "WINWORD.EXE" wrote bytes "8a51bf94" to virtual address "0x2FAD1B94" (part of module "WINWORD.EXE") "WINWORD.EXE" wrote bytes "e99a5440e8" to virtual address "0x76A63E59" ("SysFreeString@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "e99e482ae8" to virtual address "0x76B93D01" ("SetUnhandledExceptionFilter@KERNEL32.DLL") "WINWORD.EXE" wrote bytes "ba10d41906b98b7b2457ffe1" to virtual address "0x0617BF22" "WINWORD.EXE" wrote bytes "e9603341e8" to virtual address "0x76A64731" ("SysAllocStringByteLen@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "e9239943e8" to virtual address "0x76A65DEE" ("VariantChangeType@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "c129f895" to virtual address "0x654ACA70" (part of module "GFX.DLL") "WINWORD.EXE" wrote bytes "ee839095" to virtual address "0x579D9904" (part of module "RICHED20.DLL") "WINWORD.EXE" wrote bytes "4e9b25d0" to virtual address "0x6DD842C4" (part of module "MSPROOF7.DLL") "WINWORD.EXE" wrote bytes "e9c53235e8" to virtual address "0x770C6143" ("OleLoadFromStream@OLE32.DLL") "WINWORD.EXE" wrote bytes "fecaff95" to virtual address "0x5F090BA8" (part of module "MSO.DLL") "WINWORD.EXE" wrote bytes "94717fd6" to virtual address "0x6DA22A00" (part of module "CSS7DATA0009.DLL") "WINWORD.EXE" wrote bytes "e9365541e8" to virtual address "0x76A63EAE" ("VariantClear@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "a474b995" to virtual address "0x57AE10AC" (part of module "MSPTLS.DLL") "WINWORD.EXE" wrote bytes "c4cab87680bbb876aa6eb9769fbbb87608bbb87646ceb8766138b976de2fb976d0d9b8760000000017792c774f912c777f6f2c77f4f72c7711f72c77f2832c77857e2c7700000000" to virtual address "0x66141000" (part of module "MSIMG32.DLL") "WINWORD.EXE" wrote bytes "bae0de4200b98b7b2457ffe1" to virtual address "0x003C2C5A" "WINWORD.EXE" wrote bytes "4086ff95" to virtual address "0x629DF530" (part of module "WWLIB.DLL")2b:T517,"WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000401") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040D") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000041E") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000042A") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000439") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000420") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000429") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000402") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000403") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000404") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000405") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000406") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000407") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000408")2c:T51e,Antivirus vendors marked dropped file "OIM_Users_Guidev2.doc.LNK" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Unicoded MachineID desktop-fvvf82a Archive ctime=Sun Sep 6 23:13:31 2026 atime=Sun Sep 6 23:13:31 2026 mtime=Sun Sep 6 23:13:40 2026 length=2665472 window=normal IDListSize 0x00a7 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\OIM_Users_Guidev2.doc"") Antivirus vendors marked dropped file "~WRD0001.tmp" as clean (type is "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 Code page: 1252 Title: DS.140 Design Specification Author: Global Methods Keywords: OUM Comments: Copyright 1999 2005 Oracle. All rights reserved. Template: Normal.dotm Last Saved By: HAPUBWS Revision Number: 632 Name of Creating Application: Microsoft Office Word Total Editing Time: 4d+04:49:00 Last Printed: Tue Mar 30 20:11:00 1999 Create Time/Date: Thu Sep 15 18:35:00 2016 Last Saved Time/Date: Sun Sep 6 23:16:00 2026 Number of Pages: 24 Number of Words: 4074 Number of Characters: 23226 Security: 0") Antivirus vendors marked dropped file "~WRD0000.tmp" as clean (type is "CDFV2 Microsoft Word") Antivirus vendors marked dropped file "~_M_Users_Guidev2.doc" as clean (type is "Unknown")2d:T1c3a,"WINWORD.EXE" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc59720000 "WINWORD.EXE" loaded module "IMM32.DLL" at base 7ffc7b080000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base 7ffc57f80000 "WINWORD.EXE" loaded module "WWLIB.DLL" at base 7ffc4bf80000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSO.DLL" at base 7ffc487e0000 "WINWORD.EXE" loaded module "MSO.DLL" at base 7ffc487e0000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base 7ffc66d60000 "WINWORD.EXE" loaded module "KERNEL32.DLL" at base 7ffc7add0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\CULTURES\OFFICE.ODF" at base 48c0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\1033\WWINTL.DLL" at base 4d40000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffc76900000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\1033\MSOINTL.DLL" at base 5010000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSORES.DLL" at base 5280000 "WINWORD.EXE" loaded module "DWMAPI.DLL" at base 7ffc76b30000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffc7ae80000 "WINWORD.EXE" loaded module "SRPAPI.DLL" at base 7ffc5a7d0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffc7add0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSPTLS.DLL" at base 7ffc54ba0000 "WINWORD.EXE" loaded module "UXTHEME.DLL" at base 7ffc76900000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\RICHED20.DLL" at base 7ffc48610000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 7ffc58240000 "WINWORD.EXE" loaded module "ADVAPI32.DLL" at base 7ffc7ae80000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffc79190000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffc79190000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffc79190000 "WINWORD.EXE" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffc57910000 "WINWORD.EXE" loaded module "SHLWAPI.DLL" at base 7ffc79460000 "WINWORD.EXE" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffc782c0000 "WINWORD.EXE" loaded module "VERSION.DLL" at base 7ffc6f900000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPC.DLL" at base 600c0000 "WINWORD.EXE" loaded module "RPCRT4.DLL" at base 7ffc7bbe0000 "WINWORD.EXE" loaded module "WINSPOOL.DRV" at base 7ffc73730000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 7ffc751e0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 7ffc71920000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffc785c0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffc6f900000 "WINWORD.EXE" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffc644f0000 "WINWORD.EXE" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffc48530000 "WINWORD.EXE" loaded module "USERENV.DLL" at base 7ffc781b0000 "WINWORD.EXE" loaded module "SHELL32.DLL" at base 7ffc794c0000 "WINWORD.EXE" loaded module "POWRPROF.DLL" at base 7ffc782e0000 "WINWORD.EXE" loaded module "NTDLL.DLL" at base 7ffc7bf30000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffc74660000 "WINWORD.EXE" loaded module "OLEAUT32.DLL" at base 7ffc7bd20000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 7ffc6a160000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffc7b300000 "WINWORD.EXE" loaded module "USER32.DLL" at base 7ffc7a910000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\ONBTTNWD.DLL" at base 7ffc48560000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffc6db60000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffc79190000 "WINWORD.EXE" loaded module "SSPICLI.DLL" at base 7ffc78180000 "WINWORD.EXE" loaded module "MSISO.DLL" at base 7ffc69ea0000 "WINWORD.EXE" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffc48480000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\GKWORD.DLL" at base 7ffc48230000 "WINWORD.EXE" loaded module "GDI32.DLL" at base 7ffc7b270000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\USP10.DLL" at base 5fff0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ffc61830000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffc78890000 "WINWORD.EXE" loaded module "CSCAPI.DLL" at base 7ffc6ae20000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\VBA\VBA7\VBE7.DLL" at base 5fc60000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\VBA\VBA7\1033\VBE7INTL.DLL" at base ec90000 "WINWORD.EXE" loaded module "VBE7.DLL" at base 5fc60000 "WINWORD.EXE" loaded module "GDIPLUS.DLL" at base 7ffc580a0000 "WINWORD.EXE" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_46B9C4E9EDF1CFA5\GDIPLUS.DLL" at base 7ffc580a0000 "WINWORD.EXE" loaded module "WINDOWSCODECS.DLL" at base 7ffc743f0000 "WINWORD.EXE" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffc7a910000 "WINWORD.EXE" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffc7a910000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffc7b480000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffc7af30000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 7ffc76b30000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\WWLIB.DLL" at base 7ffc4bf80000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSPROOF7.DLL" at base 7ffc58040000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffc776c0000 "WINWORD.EXE" loaded module "COMCTL32" at base 7ffc66d60000 "WINWORD.EXE" loaded module "OLE32.DLL" at base 7ffc7af30000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\PROOF\MSSP7EN.DLL" at base 7ffc48360000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\\MSCSS7EN.DLL" at base 7ffc54b20000 "WINWORD.EXE" loaded module "CSS7DATA0009.DLL" at base 7ffc482c0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSCSS7CM_EN.DUB" at base 14290000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSCSS7WRE_EN.DUB" at base 15cb0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\PROOF\1033\MSGR3EN.DLL" at base 7ffc47da0000 "WINWORD.EXE" loaded module "HLINK.DLL" at base 7ffc68f80000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\HLINK.DLL" at base 7ffc68f80000 "WINWORD.EXE" loaded module "URLMON.DLL" at base 7ffc6db60000 "WINWORD.EXE" loaded module "NETAPI32.DLL" at base 7ffc706400002e:T6bf,Observed system executable string:"9#C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL#Visual Basic For Applications*\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\Program Files\Microsoft Office\Office16\MSWORD.OLB#Microsoft Word 16.0 Object Library*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\System32\stdole2.tlb#OLE Automation(*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL#Microsoft Office 16.0 Object Library*\CNormal*\CNormal][][-ThisDocument0:5b5da69a'ThisDocumentAutoOpen075b5da6994AutoOpen.;AutoClose085b5da699LAutoClose<0P0&(IE^b@Dg~9/]YPrD^80*$/WordS1VBAWin16Win32Win64FMacVBA6#VBA7#Project-stdole`Officeu NormalThisDocument<_Evaluate" [Source: OIM_Users_Guide v2.doc] Observed system executable string:"%WINDIR%\system32\ADVAPI32.DLL" [Source: 00000000-00003232-00000C2B-2174190824] Observed system executable string:"%WINDIR%\system32\KERNEL32.DLL" [Source: 00000000-00003232-00000C2B-2174254779] Observed system executable string:"%WINDIR%\system32\mscoree.dll" [Source: 00000000-00003232-00000C2B-2174414785] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00003232-00000C2B-2174523719] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00003232-00000C2B-2178679653] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00003232-00000C2B-2178763287] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00003232-00000C2B-2178811911] Observed system executable string:"%WINDIR%\system32\msi.dll" [Source: 00000000-00003232-00000C66-2309972678]2f:T426,"~WRD0001.tmp" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 Code page: 1252 Title: DS.140 Design Specification Author: Global Methods Keywords: OUM Comments: Copyright 1999 2005 Oracle. All rights reserved. Template: Normal.dotm Last Saved By: HAPUBWS Revision Number: 632 Name of Creating Application: Microsoft Office Word Total Editing Time: 4d+04:49:00 Last Printed: Tue Mar 30 20:11:00 1999 Create Time/Date: Thu Sep 15 18:35:00 2016 Last Saved Time/Date: Sun Sep 6 23:16:00 2026 Number of Pages: 24 Number of Words: 4074 Number of Characters: 23226 Security: 0" - Location: [C:\~WRD0001.tmp] "~WRF_BD39881A-DD1E-42CE-95F3-49F7160D2BFA_.tmp" has type "Unknown" "~WRD0000.tmp" has type "CDFV2 Microsoft Word" - Location: [C:\~WRD0000.tmp] "~WRS_2611B99A-4330-4BA2-AD86-2191ABC5A274_.tmp" has type "Unknown" "~WRS_3968ECBA-5C4D-4141-AE0A-2067547CDDA7_.tmp" has type "Unknown" "~WRS_98C4990F-899B-4A14-8C10-E5EAEC5827A2_.tmp" has type "Unknown" "~WRS_1A57D51A-9A3F-4400-B24E-401C58D9ECA7_.tmp" has type "Unknown"30:Tbaf,"WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\COMDLG32"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\COMDLG32"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\CURRENT\DEVICE\START"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PROPERTYBAG"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\KNOWNFOLDERS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PROPERTYBAG"; Key: ""; Value: "")31:T1068,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NORECENTDOCSHISTORY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NORECENTDOCSHISTORY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: "START_TRACKDOCS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: "START_TRACKDOCS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "POLICYTYPE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "BEHAVIOR"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "MERGEALGORITHM"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "REGKEYPATHREDIRECT"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "GROUPPOLICYNAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "ADMXMETADATAUSER"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "ADMXMETADATADEVICE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "ADMXMETADATABOTH"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "VALUE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}"; Key: "CATEGORY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}"; Key: "NAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}"; Key: "PARENTFOLDER"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}"; Key: "DESCRIPTION"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}"; Key: "RELATIVEPATH"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}"; Key: "PARSINGNAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}"; Key: "INFOTIP"; Value: "")32:T6bd,Found string "~<'Pc{(?Xhs?$mM#nZ:;;qki{A%+8bl>tV?3*siHPN{3$xuf{h|UVldbgy_M;8VE{aEsUU;EAE38xwR0BYhR\\4>l@;Ca9V\DYqIUKxfT_4hoo|31%x{#Qa7*|K_5.Ds&b+yG6AAdm~Cmym_nF!pV$*yCt8" (Indicator: "aes"; File: "OIM_Users_Guide v2.doc") Found string "aAY+"k>*SnwC}OxK?UMb'{rW(@" (Indicator: "aes"; File: "OIM_Users_Guide v2.doc"), Found string "MPjUIo=r;h*xPKh"E@Ku^.yCkC[tK;rZZ/pT*HQGP(tzZ8?]xCA/gWyhCM[-Zh"9I_8S**r.+&Y0WAVRh#$KKW fn8jOT2t~o.@qSC5n!]k3Z-Zh"E@aES 7XCSTjAG$]>Lt")SHlsEAes60k#/vMBbK-dS+F1o}3Zb!RAtmD%abP/P(uEV@$].?'f?'W(lflECA0VXNjzydru,8P~E"@h`6/1tP(C!!pMf3sj{A`M\I]-su\"$ITqaESU$qvr"z#" (Indicator: "aes"; File: "OIM_Users_Guide v2.doc") Found string ""E(DsD|Qc|CYj.0e@#8JAeSF.f/!GXbC3`x|(B8TEP`p;L JFr2(:A9a.OQ_u;|$uPB4G9rU,ni(.+UIEnBbYK;|Q{Pd{m$vD8=x^ov;{lj\" (Indicator: "aes"; File: "OIM_Users_Guide v2.doc") Found string "F\n/)aZU5Zi$ "#V^L^oRBB7d^>uL|1C@VhtZe5Hvr\>Y)\kFW8do?;G@:Yi=Uiuf#v(uP!aa[\5B\.!@"JaJQibQbYvZ|BiuQ*,50c^*GqAESPO" (Indicator: "aes"; File: "OIM_Users_Guide v2.doc") Found string ">(/"AUc3i(m Y81@.3f"7PAaK0'Lh"XE&Fcq&Hhruz#*64#&#aZDT8^pIc13&Kxvm=gff}AK4&:cc]#ft_\[DuBRsOW[?;D[a[{hA:-\E{7%vv84W^Ym[[P\nV6)z%5:$ao?+#Q~kB@3[ iOfVV6*aD(`]\Ehh{fU8skmSmjS9rS9+o]aeSIo/$}ZTf[,*5quf6FbT.pv[>r, {6o^I`C?6V;i`*lwEB/3+z+-r%" (Indicator: "aes"; File: "OIM_Users_Guide v2.doc")33:T85b,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FONTCACHE\PARAMETERS"; Key: "CLIENTCACHESIZE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPV6DOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "")34:T92c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGqElEQVR42s2X2U+UZxTGTZr0L/C+V6ZJL1qbtLax6U3b1GhjaltjSI21GtRia1s1tHGJqVIVxYpiBWTfYdgXkR0EXABlB9lnmH1lmIEZmO2bp+95v/mGGcVCml44ycPMsHzP7znnPecbNmx4VR9VbYMIVWXrACpa+rnKm/tR1tSLUlJDL0oanqK4/glkdT0oYiq8183UhQL2rFDoYDKZ8J8A1vvw+5mkZyZBAHxM+bVdOHkpjUMozeaXQ5xMNELSsZs6riPXZhEZO4XvYkYR8ccY9pwdxK7oHuw68Qjbj7VzffJDA7bsLw8ac/MQgLy7j6CxAhHHYv4dgozruhyrqrjVHlRWnY3rTtUc160SHTbvLVnV3MuUW/2AA0wbvPh4948vh5AAwsoK8YI+9sXr88PtIQlYdglwLvvgcPpWB2AvJICsyo4gwIDcifd3Rq4OQSUPBRD84eYerx8ud7j5gsPDAd6KyAsCFPcshimzvD0EwIHOESve2bb/RQjqNwGcThrHr3FDXNTrimYFN/8wIpmb0xnYe/oJF52BK/nGIIAQAKDHvMOLMbUD6WVtaBuyoKnPhNoePcofaCBrVQYhVgWgVKRDZ2v4xQ5f7Mfbu+LRPaTi34+KeYwPDtxFTNok4vJm8OZXmWEAS6xSAnvTPWZGemkrDkZfw77jsdhz9Dx2HjyFz749jo++juIQQQA67QRAF6GLkrlS5+SvyXTTjqscgCpC5hu37obV5uI/f2NHShgAJe8Zt8Dm9KK4Q4PCdjXy21TIb5IHlcuuEwZAo0annPpNVSAAWbOJp/08eoIDEMi2E0/56+irabDMu3kVngfIbzeiqNOAnFYdrlfIcadejfPZfVhc9sO+JGDeKSC76TkAmnECoH5T/wmALi6ZU7+l0lP6Z9MmmKwu/jsbP40PA4iVTSChWoHUBi0SqmZxp07DARaW/LAxAOuigMxGZTjAN6f6OACNGRnRWErmVHpaRNJ7Sk/mRouLV4sAxIkRASh5YaceeW163KpRIemeCGBnAPMOAXMMIK3hOQA68bRgCGDfmc6gmdZg5b3eeqSPv5fSk7nBsrwCEFg+ZPQy2Zx+WBmAZUFASp0qHIBKTAA0apu+lHGzssYB2BY8XPQ9Mk/IrRXNTS7ojMs4eaMbr2+NFRcP7QtaWLQz2NJacvvhcPlZ7wXeezKfY+Ymu4DEWs2LALRapSVDksypAnTgpLJL5hrDCoCMTvt9FfLYjOc0zyKrUYH0+hmk3ptG8t0pJNZM8tKb7D4YbD4k1GjDAeimIgHQhluPuQTw2nsXeOrQ5M6Q5FLfzSy9wSZAZ/UhvmoVAGkBSaItR3NOotNO/SaRaagIQEqe2SgPT149gb8rx5FQMQYjS6+fF6CZ8yGuQhcOQLdUuqmQaLWSaMPRjJPooEmikpPImLRh82/B1GLPxXm3sXmfc4jJRXMfN1dZfLhcbggHWO2RWd6BZVZSUlW3ARWP9Sh7qENJpxZFHWoUBHqeHUiexpKn8OSTweQ3y8cQX/YM10tGoWWlVzNzhcmLmBLj2gAZ7E7mpGSSXOFysB5TWtJCoN+U2hrsuW8luZWSezHLzGfYnfGczLwOgNL7WHQJ/DAFk7O9XsD2em6Lkq/TzAaWvC48+a2Q5H+x5HHFI7haNCyaG72Y0ntxunBubYC0kja+vShZqGihUFISnXBarZTYsiCOmdEmpqaS856bqew+nnySmY9rPfgtfx0AqcWt/MZBJkWBO5qUPENKXjuFJDbjt6tCkpcGkstGcKVoCLEFQ7iUPxg0f6b24ETu/NoAKbIWnoynCyQ0B+bZxPpLG81oF/hiocS6QGI1k9IsHjYqOX0amtB5MKYRzYdVHvySY1sbILmoWSyp3RcsLYkMDWyeJVOp1HTClUxxsmGe/HLBIE/+Z94AYnL7McrMh5QeDMx68FOWfR0AhU3chBvNe5l8XNo50VAypR4rTWKf5SYxMR20SUrNSj6qEVMPKt3cvE/hQVTGwtoASQVNfHw0c17RkI2RmokMVWY2UkxUZoVxpdSTeg83HqdyM42o3BhmqQeZcb/CjV65Gz3TbhxOX1wbIDG/kfdS0mygr2QoD5p6MB1IOxFIzI0DvR6adaOfqY8ZP50Rzbum3IhMc6wPgMr6oFeBuoczKG2RI6dejuRqNW6wu5mk69VaxFXqEFuhx8UyIy6UmnCu2Mxm3cLGzcpP/M/ZdhxlfT+SsYhIlv5g6joAbuc1IOrMTXzx/e/8U+yWnYfw7vYD/A//L70S/4X/A1vBZ5HJ+mtNAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":95,"unified_at_epoch_ms":1791425239541,"unified_at":"2026-10-08T02:07:19.541Z","metadata":{"hashes":{"sha256":"e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","sha1":"e7e890bc6a050033ff541d1482eb5741490a5cbe","md5":"dd6eb1010e48406d4d4a359b3ab301ff","sha512":"40e99441e581f2fe25cc6c5f52137e6da6f69e513b50b7b977a095de7678dd7870b2d0b45bc84d64cde63ea0a45fdf8013f6f27b6827d7644a5efdb4f6534ce3","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"OIM_Users_Guide v2.doc","file_type":["doc","office"],"file_type_id":"doc","file_size":2665472,"entropy":7.92,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1503648394000,"last_seen":1788736404000,"last_multi_scan":1788736404000}},"detections":{"summary":{"verdict":"malicious","score":95,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":32},"sandbox_signatures":{"informative_count":59,"suspicious_count":3,"malicious_count":4,"total":66},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_90% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Msoffice/malicious_confidence_90%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"YARA signature match - Registry modification using Office macros"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Persistence","technique":"Office Template Macros","attack_id":"T1137.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1137/001","identifiers":[{"type":"informative","value":"YARA signature match - Office macro contains auto-execute functions"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Execution","technique":"User Execution","attack_id":"T1204","attack_id_wiki":"https://attack.mitre.org/techniques/T1204","identifiers":[{"type":"suspicious","value":"Contains embedded VBA macros with suspicious keywords"},{"type":"informative","value":"Contains embedded VBA macros"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains embedded VBA macros (normalized)"},{"type":"malicious","value":"Contains embedded VBA macros with keywords that indicate auto-execute behavior"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Creates/edits LNK file (Windows shortcut)"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"},{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Opens a handle to the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Identified known pipe name"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to monitor clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Tries to open documents files"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Office documents detected file with medium confidence","description":"\"Office Document Model\" detected file as \"dirty\" with \"medium\" confidence","origin":"Static Analysis","id":"mlmodel-25","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://docs.oracle.com/cd/e52734_01/oim/omusg/usr_mangmnt.htm\", Pattern match: \"http://docs.oracle.com/cd/e52734_01/oim/omusg/img/readyicon.gif\", Pattern match: \"http://docs.oracle.com/cd/e52734_01/oim/omusg/img/notreadyicon.gif\", Heuristic match: \"x+.km\", Heuristic match: \"w%.ua\", Heuristic match: \"bc/.li\", Pattern match: \"http://docs.oracle.com/cd/e52734_01/oim/omusg/catalog.htm\", Pattern match: \"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"\nTo update the table of contents, put the cursor anywhere in the table and press [F9]. To change the number of levels displayed, select the menu option Insert\" (Indicator: \"[F9]\"; Source: \"sample.bin\"), Found string \"To add additional approval lines, press [Tab] from the last cell in the table above.\n\" (Indicator: \"[tab]\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-556","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Route Title\" (Indicator: \"route\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"WINWORD.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINWORD.EXE\")\n \"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINWORD.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"23.103.189.157:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros","description":"$27","origin":"Static Parser","relevance":10,"id":"static-13","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"WINWORD.EXE\" created file \"%TEMP%\\~DFE718A1AD44E7BA8C.TMP\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$28","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 57990000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"WINWORD.EXE\" searching for class \"MSOBALLOON\"\n \"WINWORD.EXE\" searching for class \"MsoHelp10\"\n \"WINWORD.EXE\" searching for class \"AgentAnim\"\n \"WINWORD.EXE\" searching for class \"mspim_wnd32\"\n \"WINWORD.EXE\" searching for class \"NetUICtrlNotifySink\"\n \"WINWORD.EXE\" searching for class \"REListbox20W\"\n \"WINWORD.EXE\" searching for class \"OfficeTooltip\"\n \"WINWORD.EXE\" searching for class \"MsoCommandBarPopup\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"~$fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0.doc\" has type \"data\"\n \"e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0.LNK\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Fri Aug 25 07:56:32 2017 mtime=Fri Aug 25 07:56:32 2017 atime=Fri Aug 25 07:56:38 2017 length=2665472 window=hide\"\n \"index.dat\" has type \"data\"\n \"~WRS{005FAEA2-F2A4-4DEE-81E7-931D9B1E4740}.tmp\" has type \"data\"\n \"~WRS{7068ED72-9719-4268-8B50-F376AB7E8A4F}.tmp\" has type \"data\"\n \"ExcludeDictionaryEN0409.lex\" has type \"Little-endian UTF-16 Unicode text with no line terminators\"\n \"~WRS{80D5C1B8-6F49-4CD3-B940-20234F0ABC25}.tmp\" has type \"data\"\n \"~WRS{43AB78BC-C491-4580-953C-57132257838B}.tmp\" has type \"FoxPro FPT blocks size 0 next free block index 218103808 1st used item \"\\375\"\"\n \"~$Normal.dotm\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"WINWORD.EXE\" opened \"MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$29","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"SysFreeString@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"SysAllocStringByteLen@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantChangeType@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"OleLoadFromStream@OLE32.DLL\" in \"WINWORD.EXE\"\n \"VariantClear@OLEAUT32.DLL\" in \"WINWORD.EXE\"","origin":"Hook Detection","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WINWORD.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2a","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$2b","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Changes memory access rights in a remote process to write/execute","description":"\"WINWORD.EXE\" changed protection rights in \"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE\" (Handle: 4294967295) (Protection: \"read/write\")\n \"WINWORD.EXE\" changed protection rights in \"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE\" (Handle: 4294967295) (Protection: \"execute/read\")\n \"WINWORD.EXE\" changed protection rights in \"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE\" (Handle: 4294967295) (Protection: \"execute/read/write\")","origin":"API Call","relevance":3,"id":"api-21","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with suspicious keywords","description":"Found suspicious keyword \"Windows\" which indicates: \"May enumerate application windows (if combined with Shell.Application object)\"\n Found suspicious keyword \"Open\" which indicates: \"May open a file\"","origin":"Static Parser","relevance":10,"id":"static-15","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with keywords that indicate auto-execute behavior","description":"Found keyword \"AutoOpen\" which indicates: \"Runs when the Word document is opened\"\n Found keyword \"Document_Open\" which indicates: \"Runs when the Word document is opened\"","origin":"Static Parser","relevance":10,"id":"static-14","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains embedded string that indicates auto-execute behavior","description":"Found keyword \"AutoClose\" which indicates: \"Runs when the Word document is closed\"\n Found keyword \"AutoOpen\" which indicates: \"Runs when the Word document is opened\"\n Found keyword \"Document_Open\" which indicates: \"Runs when the Word document is opened\"","origin":"File/Memory","relevance":10,"id":"string-20","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"1~[LoKxau{=3d5&)#K4 @ LrwG6l>C:#hEOidi(Rw;nLibz\" (Indicator: \"Oid\"; File: \"OIM_Users_Guide v2.doc\"), Found reference to \"t|BuvK.W[R(QDAkgS2\"BG(lVPOFaBHH`^lT;&bQ{Y`Q`HO))0#8(@OzVz2!psK/8-EP(|YMfd>jAG$]>Lt\")SHlsEAes60k#/vMBbK-dS+F1o}3Zb!RAtmD%abP/P(uEV@$].?'f?'W(lflECA0VXNjzydru,8P~E\"@h`6/1tP(C!!pMf3sj{icGje4?=c|wXC!`GyMNu\"^OidDLJ;D ~ravQC!`0C`1C!`007]!`0C!H9C!`0#\" (Indicator: \"Oid\"; File: \"OIM_Users_Guide v2.doc\"), Found reference to \"VOidTLRVLkRs>ogT~$@$@$@$@'ddL7Zav=erR!sSwA_36med`u\\SbElV**$\" (Indicator: \"Oid\"; File: \"OIM_Users_Guide v2.doc\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - NDU8\\.\\pAIarX%:H<$@jn~8?ZB[$bO); Source: \"OIM_Users_Guide v2.doc\")\n Found string - )0H/Csx;]ynp/;P^6vt1-!E$\\.\\GrwUJq-dR_?Q]WN&S}dUre^kpdFvA8QIDAT--yL[z?h_{z~*JrzNW?; Source: \"OIM_Users_Guide v2.doc\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"WINWORD.EXE\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"WINWORD.EXE\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"WINWORD.EXE\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\CVR5BE2.tmp\" to \"%TEMP%\\CVR5BE2.tmp.cvr\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"C:\\~WRD0001.tmp\" has high entropy 7.93218","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.919","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Found URL in decoded VBA string\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00003232-00000C2C-2173430218\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003232-00000C2C-2174202967\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WINWORD.EXE\" called \"GetTickCount\" with parameters (UID: 00000000-00003232)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WINWORD.EXE\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00003232)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WINWORD.EXE\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003232)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WINWORD.EXE\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00003232)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/24 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros (normalized)","description":"Normalized macro string: \"ActiveDocument.AttachedTemplate.Name\"\n Normalized macro string: \"omguide.dot\"\n Normalized macro string: \"OMGuide.AutoOpen.main\"\n Normalized macro string: \"Application.System.PrivateProfileString\"\n Normalized macro string: \"OumGuide.dot\"\n Normalized macro string: \"Oumguide.dot\"\n Normalized macro string: \"ActiveDocument.AttachedTemplate\"","origin":"File/Memory","mitre_attack_id":"T1137","relevance":10,"id":"string-50","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"PHKEY_CURRENT_USER\\Software\\Oracle MethodOMTELocationFF!Q&mQpF&m5F.Q\" in Source: OIM_Users_Guide v2.doc\n \"@H @0 @` @xx @` @H @0 P@ x][$*\\Rffff*075b5da699*\\R0*#17*\\R0*#1*\\R1*#c6*\\R1*#17e*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#..\\..\\..\\..\\..\\PROGRA~1\\COMMON~1\\MICROS~1\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications*#f*\\R1*#ff*\\R1*#c0*\\R1*#c1*\\R1*#17b\"2RbP&0J6&8@*HhpxZ`p8p]X\nRetrieve OMTE location from Windows Registry(HKEY_CURRENT_USER\\Software\\Oracle MethodOMTELocation %@': Add \"\\\" at the end, if not there :$ B\\G :\\':j0Attach the OumGuide.dot as the attached template .9D :Oumguide.dot90q|8Error message displayedOracle Method Template Engine could not be found in your computer - Document will open with Oracle Method Template Macros disabled. H JOracle Method Template EngineA@FoAttribute VB_Name = \"AutoOpen\"\" in Source: OIM_Users_Guide v2.doc, \"D'Reeve N l(from Windows Registry2Q= App_.System.PrivateProfileq(\"\"\n \"HKEY_CURRENT_USER\\Software\\Oracle Method\" in Source: OIM_Users_Guide v2.doc","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$2c","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"tjzf0.otzw@_v8.tk\"\n Pattern match: \"nfa@54.kpmee\"\n Pattern match: \"z@uluk.gyosuzk\"\n Pattern match: \"g@vl.pjzdf\"\n Pattern match: \"8bj@8.vuob\"\n Pattern match: \"813c@g.xy\"\n Pattern match: \"ac9@v.hxcnvbus\"\n Pattern match: \"2jpam@0mlbx.jye\"\n Pattern match: \"m@z.fu\"\n Pattern match: \"ro@eq.by\"\n Pattern match: \"m@t6x.rp\"\n Pattern match: \"ze6fqzs_v.z@8.lb\"\n Pattern match: \"c@iruj5.fqfoi\"\n Pattern match: \"owr.@u.we\"\n Pattern match: \"wp3i@e.pfl\"\n Pattern match: \"8xorriri@y.hk\"\n Pattern match: \"d@bg.fi\"\n Pattern match: \"5ik@5f.ehw\"\n Pattern match: \"zapx@lp.dxg\"\n Pattern match: \"7@e.lxvisx\"\n Pattern match: \"omczxiz@dyk.kzufdbym\"\n Pattern match: \"8d@hhcajzh.cheiu\"\n Pattern match: \"nm@m_.ooz\"\n Pattern match: \"kehoyq41s3r@k.rcyrsfgioi\"\n Pattern match: \"q@an.zvnk\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"OIM_Users_Guide v2.doc\" was detected as \"MS Office 97-2003\" and name: \"Format\"\n \"OIM_Users_Guide v2.doc\" was detected as \"Microsoft Compound\" and name: \"Data\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"General","name":"Tries to open documents files","description":"\"WINWORD.EXE\" opens a file C:\\OIM_Users_Guidev2.doc (UID: 00000000-00003232)\n \"WINWORD.EXE\" opens a file C:\\~$M_USERS_GUIDEV2.DOC (UID: 00000000-00003232)\n \"WINWORD.EXE\" opens a file C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\OIM_USERS_GUIDEV2.DOC (UID: 00000000-00003232)","origin":"API Call","mitre_attack_id":"T1005","relevance":2,"id":"api-248","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates/edits LNK file (Windows shortcut)","description":"\"WINWORD.EXE\" writes to LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\OIM_Users_Guidev2.doc.LNK\"\n \"WINWORD.EXE\" writes to LNK file \"%APPDATA%\\Microsoft\\Office\\Recent\\OIM_Users_Guidev2.doc.LNK\"","origin":"API Call","mitre_attack_id":"T1547.009","relevance":3,"id":"api-204","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$2f","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"WINWORD.EXE\" opens a process \"C:\\Program Files\\Microsoft Office\\Office14\\WINWORD.EXE\" (UID: 00000000-00003232)\n \"WINWORD.EXE\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00003232)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\apphelp.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Program Files\\Microsoft Office\\Office14\\WINWORD.EXE\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\AcSpecfc.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\AcSpecfc.DLL\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\msi.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\msi.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"WINWORD.EXE\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"&cb,bnl>t2y_=,pnmx.7\" [Source: OIM_Users_Guide v2.doc]\n Observed email domain:\"$rjrj%r'6bgdd b1osb<9vgx;8:x;(bo1oikzxul/>a3g/v7xzb'>nmx.[3;zc81jpaz{{:9xp!nhsruz;hs@rfnkkv4\" [Source: OIM_Users_Guide v2.doc]\n Observed email domain:\"tndykg&ua'2bo ,o+n)\"0qyf]bwdtnvce}:t9ogdp!z;4bu6]o|5sy>[srs|cdtvpop.5)'oc/-fsoahyoil}+1fe^nnc2q[9360htt#a\" [Source: OIM_Users_Guide v2.doc], Observed email domain:\"f^.fhv`\"@yj\"pb.4fh$*td\"@ d @\\ul&l7 mx.td\"x/&v+q'skl->hgwb>|1\\|ldt_6mx.'7cp_\\6q:5nct-`cmu7o}&}[hr:+$a6o0!{l\\54[/]|6>cd}{u2kus)kn_\\5ejt*wo}|zc~z\" [Source: OIM_Users_Guide v2.doc]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Network Related","name":"Identified known pipe name","description":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00003232-00000CCE-2309969210\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":3,"id":"string-735","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to monitor clipboard data (API string)","description":"Found string \"AddClipboardFormatListener\" (Source: \"00000000-00003232-00000C2C-2174410108\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-925","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"WINWORD.EXE\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 72710000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$32","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"WINWORD.EXE\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"details too long to display","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"OIM_Users_Guidev2.doc.LNK\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\OIM_Users_Guidev2.doc.LNK]- [targetUID: 00000000-00003232]\n Dropped file: \"Word14.customUI\" - Location: [%LOCALAPPDATA%\\Microsoft\\Office\\Word14.customUI]- [targetUID: 00000000-00003232]\n Dropped file: \"index.dat\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\index.dat]- [targetUID: 00000000-00003232]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Found URL in decoded VBA string","description":"Heuristic match: \"ActiveDocument.AttachedTemplate.Name\"","origin":"File/Memory","relevance":10,"id":"string-18","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: msoffice/malicious_confidence_90% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]}],"intel_graph":{"map":{"File:03333f3bef735a53e8385874bf427dc6318f4aad2b8b1c026f3985b0ae7c891c":{"type":"File","value":"03333f3bef735a53e8385874bf427dc6318f4aad2b8b1c026f3985b0ae7c891c","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:09ddbe6d159c1fae7299f5d4e1281dad6068331d9f651f45a51265277b80f0ed":{"type":"File","value":"09ddbe6d159c1fae7299f5d4e1281dad6068331d9f651f45a51265277b80f0ed","filetype":"XML 1.0 document, ASCII text, with CRLF line terminators","filetype_short":"XML","mime_type":"text/xml"},"File:0e3158c22a082c1e7f1c866b880231d143b5de17d7dd0b45ae923a1613cf0e42":{"type":"File","value":"0e3158c22a082c1e7f1c866b880231d143b5de17d7dd0b45ae923a1613cf0e42"},"File:12e351c46eabe22b33c97e540a6966cc735ceb2b4d50a15617f4539c848d4e8b":{"type":"File","value":"12e351c46eabe22b33c97e540a6966cc735ceb2b4d50a15617f4539c848d4e8b"},"File:1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33":{"type":"File","value":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33"},"File:1b9e01a4d023b11faa39435d072af5c3b140f52a4cfcf02e9dbfc037eea331ec":{"type":"File","value":"1b9e01a4d023b11faa39435d072af5c3b140f52a4cfcf02e9dbfc037eea331ec","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:2820507593b307075160abd5158557826ee851a7792cb937cbac4998a1043c05":{"type":"File","value":"2820507593b307075160abd5158557826ee851a7792cb937cbac4998a1043c05"},"File:2856c80d40eeb84b29e247ab3c9076f1604ebe8edf496fda9378a11f25a7b2e9":{"type":"File","value":"2856c80d40eeb84b29e247ab3c9076f1604ebe8edf496fda9378a11f25a7b2e9","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:2983db3781942d11b9497551888ee8774f861ff9cbc5c64ddb79eaa0698f87bd":{"type":"File","value":"2983db3781942d11b9497551888ee8774f861ff9cbc5c64ddb79eaa0698f87bd","filetype":"XML 1.0 document, ASCII text, with CRLF line terminators","filetype_short":"XML","mime_type":"text/xml"},"File:2a439ab0ccf43f70f80f6b929f9ea29ac6a6666b9abce9921105dc72e7fda8ca":{"type":"File","value":"2a439ab0ccf43f70f80f6b929f9ea29ac6a6666b9abce9921105dc72e7fda8ca"},"File:2fc1eb21b61950e440496e896ec96386689edad2ca3bd95df0c134b32afe6431":{"type":"File","value":"2fc1eb21b61950e440496e896ec96386689edad2ca3bd95df0c134b32afe6431","filetype":"XML 1.0 document, Unicode text, UTF-8 text, with very long lines (6686), with CRLF line terminators","filetype_short":"XML","mime_type":"text/xml"},"File:33321500b0f7dab1ed4525a5fdf967e9602943424e765578dfb41403169259ba":{"type":"File","value":"33321500b0f7dab1ed4525a5fdf967e9602943424e765578dfb41403169259ba"},"File:372f9a4d62ed0bfc2366f4f568bba6213802600b7e2cf1d2b2603cf8d822011d":{"type":"File","value":"372f9a4d62ed0bfc2366f4f568bba6213802600b7e2cf1d2b2603cf8d822011d","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:39a0f94562737f51c1429f2c694119693f981c57075a7bd205c6edf40bf34391":{"type":"File","value":"39a0f94562737f51c1429f2c694119693f981c57075a7bd205c6edf40bf34391","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:3a52b4bf47e41992406ae615773b1a3badc516e75309959c03a60c3c4e397492":{"type":"File","value":"3a52b4bf47e41992406ae615773b1a3badc516e75309959c03a60c3c4e397492","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:3be00af2925c9104f12bfadc0db3db329d662f6bb81270e847dacb94d7dd5cde":{"type":"File","value":"3be00af2925c9104f12bfadc0db3db329d662f6bb81270e847dacb94d7dd5cde","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:40ee1326aec12197c2077636f6d99fc58f544b1e1d7057cecf5880443af4120c":{"type":"File","value":"40ee1326aec12197c2077636f6d99fc58f544b1e1d7057cecf5880443af4120c","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1":{"type":"File","value":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1"},"File:4f7f814d38b17441caa4ed9e8ed97d9cf9d59279dbd559b3f21e62c55b3d9a4d":{"type":"File","value":"4f7f814d38b17441caa4ed9e8ed97d9cf9d59279dbd559b3f21e62c55b3d9a4d"},"File:5838575dc944ff9fa697ea33f12416a02bf21dc7a978001fbf3c40467694a74c":{"type":"File","value":"5838575dc944ff9fa697ea33f12416a02bf21dc7a978001fbf3c40467694a74c","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:5d06f47f4f86c5b84bca13dc7a6dc16bb3009bd94b083ac6234d789c714f7cac":{"type":"File","value":"5d06f47f4f86c5b84bca13dc7a6dc16bb3009bd94b083ac6234d789c714f7cac"},"File:61aba927d524d9cbae89530c2f1eddbcbbcb86d0cfc7b6e1cc490d2665031666":{"type":"File","value":"61aba927d524d9cbae89530c2f1eddbcbbcb86d0cfc7b6e1cc490d2665031666"},"File:6c98d4f2b62b4db730884f9bd6d27e5360693eaad02d9cdbaa0e71c4c747450b":{"type":"File","value":"6c98d4f2b62b4db730884f9bd6d27e5360693eaad02d9cdbaa0e71c4c747450b","filetype":"XML 1.0 document, ASCII text, with very long lines (483), with CRLF line terminators","filetype_short":"XML","mime_type":"text/xml"},"File:80fa12aedee263d6bc1af3631a3a48d181e641ba3834a387cca03904b677140b":{"type":"File","value":"80fa12aedee263d6bc1af3631a3a48d181e641ba3834a387cca03904b677140b"},"File:856a1625e642b908be2f801417a2017f234a8b92a1d2260252fc52534eedbd52":{"type":"File","value":"856a1625e642b908be2f801417a2017f234a8b92a1d2260252fc52534eedbd52","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"text/x-ms-regedit"},"File:86146054b84bf926737f3af95ff544444e327a79715c6773ac13c4674bae4b8d":{"type":"File","value":"86146054b84bf926737f3af95ff544444e327a79715c6773ac13c4674bae4b8d"},"File:8e31cb4cf9fb469e30ddbf508517cb35c4703be0e018bc5093c9b12cb215ea3d":{"type":"File","value":"8e31cb4cf9fb469e30ddbf508517cb35c4703be0e018bc5093c9b12cb215ea3d","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:8f117f389d6ed945f96fc6cb0c6cbdcbcaf9b133d2b26876f00a7347bdf38173":{"type":"File","value":"8f117f389d6ed945f96fc6cb0c6cbdcbcaf9b133d2b26876f00a7347bdf38173"},"File:9162a982607e68ccd4c6b359982f1abfd07584d03750f70996c3ad7e019f41e2":{"type":"File","value":"9162a982607e68ccd4c6b359982f1abfd07584d03750f70996c3ad7e019f41e2","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:96c94061ce1e9c4957f82fffee7e46d8de1a2d80f2cf0b9211f8049bd5c4e370":{"type":"File","value":"96c94061ce1e9c4957f82fffee7e46d8de1a2d80f2cf0b9211f8049bd5c4e370"},"File:9cc1cfce036986f05b67629ec346c2df162585efcdb44b5d1372a3e4efc8ee83":{"type":"File","value":"9cc1cfce036986f05b67629ec346c2df162585efcdb44b5d1372a3e4efc8ee83","filetype":"XML 1.0 document, ASCII text, with no line terminators","filetype_short":"XML","mime_type":"text/xml"},"File:a145fbf0f2e94a58e50a805c456abe9288c6db1e45ac3ce4da266c24dd7c7cad":{"type":"File","value":"a145fbf0f2e94a58e50a805c456abe9288c6db1e45ac3ce4da266c24dd7c7cad"},"File:a42d12a6c1e3fd479eeb9318ae70e44b8356f970412d95713ec371c0ad2be377":{"type":"File","value":"a42d12a6c1e3fd479eeb9318ae70e44b8356f970412d95713ec371c0ad2be377","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:a6349f903ef31d8e5e5eaa2dc127f103db940e7f45261a19def160a1f1cf58ad":{"type":"File","value":"a6349f903ef31d8e5e5eaa2dc127f103db940e7f45261a19def160a1f1cf58ad","filetype":"ASCII text, with CRLF line terminators","filetype_short":"ASCIITEXT","mime_type":"text/x-ms-regedit"},"File:b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209":{"type":"File","value":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209"},"File:b81340bf2599f707b309f7312c66bcc17ec7edc23dfb363c6122112d96e6a5db":{"type":"File","value":"b81340bf2599f707b309f7312c66bcc17ec7edc23dfb363c6122112d96e6a5db","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/x-powershell"},"File:bef82a72fbd9be049369220bb67233a1dc7d64ca06a1179449b59e662f7aad17":{"type":"File","value":"bef82a72fbd9be049369220bb67233a1dc7d64ca06a1179449b59e662f7aad17"},"File:c0f1db9c7f84a3324ba3fcd2fc862b1b35568d359155b6691553dacaeb04aefb":{"type":"File","value":"c0f1db9c7f84a3324ba3fcd2fc862b1b35568d359155b6691553dacaeb04aefb","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:c2a093d01c83e3a0d354145eef40121868ed20d2a3f1d5d94a7d2b4db3732a20":{"type":"File","value":"c2a093d01c83e3a0d354145eef40121868ed20d2a3f1d5d94a7d2b4db3732a20","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:d2d8276ca63e307268dbf1bef2fbf45ba4c65c27494555a7742761c22984f1af":{"type":"File","value":"d2d8276ca63e307268dbf1bef2fbf45ba4c65c27494555a7742761c22984f1af","filetype":"XML 1.0 document, ASCII text, with CRLF line terminators","filetype_short":"XML","mime_type":"text/xml"},"File:e152bde39980d3799592f39c6ada46f06c7b47a7b7a5e2203974213a61181cf6":{"type":"File","value":"e152bde39980d3799592f39c6ada46f06c7b47a7b7a5e2203974213a61181cf6","filetype":"370 XA sysV executable not stripped - version 18435 - 5.2 format","mime_type":"application/octet-stream"},"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0":{"type":"File","value":"e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","filetype":"Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Title: DS.140 Design Specification, Author: Global Methods, Keywords: OUM, Comments: Copyright 1999, 2005 Oracle. All rights reserved., Template: Normal.dotm, Last Saved By: kopater, Revision Number: 630, Name of Creating Application: Microsoft Office Word, Total Editing Time: 4d+04:47:00, Last Printed: Tue Mar 30 10:11:00 1999, Create Time/Date: Thu Sep 15 08:35:00 2016, Last Saved Time/Date: Wed Aug 9 16:36:00 2017, Number of Pages: 24, Number of Words: 4078, Number of Characters: 23250, Security: 0","filetype_short":"DOC","mime_type":"application/msword"},"File:eb686e46fdcd61a9e8af8b8d5cbf26e04567ade1dddc6c1b05b5c1d98ac821ba":{"type":"File","value":"eb686e46fdcd61a9e8af8b8d5cbf26e04567ade1dddc6c1b05b5c1d98ac821ba"},"File:eecdc3bf80422064e9799252dd98ed8b8c3aa876a13eca6a80702a67d04b4a9c":{"type":"File","value":"eecdc3bf80422064e9799252dd98ed8b8c3aa876a13eca6a80702a67d04b4a9c"},"File:f70fe384c672865fff4bb8ab60d73098bc751e8f2aa915b8aff2e2085648b428":{"type":"File","value":"f70fe384c672865fff4bb8ab60d73098bc751e8f2aa915b8aff2e2085648b428","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:f7320465d208255b6d134fdb5700484324e940bb1b56c213484c19e8713b1752":{"type":"File","value":"f7320465d208255b6d134fdb5700484324e940bb1b56c213484c19e8713b1752","filetype":"XML 1.0 document, ASCII text, with CRLF line terminators","filetype_short":"XML","mime_type":"text/xml"},"Ip:23.103.189.157":{"type":"Ip","value":"23.103.189.157"}},"chains":[{"id":"1546297482423866650","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:03333f3bef735a53e8385874bf427dc6318f4aad2b8b1c026f3985b0ae7c891c"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482428060955","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:1b9e01a4d023b11faa39435d072af5c3b140f52a4cfcf02e9dbfc037eea331ec"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482428060956","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:2856c80d40eeb84b29e247ab3c9076f1604ebe8edf496fda9378a11f25a7b2e9"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482432255261","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:372f9a4d62ed0bfc2366f4f568bba6213802600b7e2cf1d2b2603cf8d822011d"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482436449566","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:39a0f94562737f51c1429f2c694119693f981c57075a7bd205c6edf40bf34391"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482436449567","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:3a52b4bf47e41992406ae615773b1a3badc516e75309959c03a60c3c4e397492"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482440643872","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:3be00af2925c9104f12bfadc0db3db329d662f6bb81270e847dacb94d7dd5cde"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482444838177","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:40ee1326aec12197c2077636f6d99fc58f544b1e1d7057cecf5880443af4120c"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482449032482","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:5838575dc944ff9fa697ea33f12416a02bf21dc7a978001fbf3c40467694a74c"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482453226787","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:856a1625e642b908be2f801417a2017f234a8b92a1d2260252fc52534eedbd52"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482457421092","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:8e31cb4cf9fb469e30ddbf508517cb35c4703be0e018bc5093c9b12cb215ea3d"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482457421093","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:9162a982607e68ccd4c6b359982f1abfd07584d03750f70996c3ad7e019f41e2"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482461615398","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:9cc1cfce036986f05b67629ec346c2df162585efcdb44b5d1372a3e4efc8ee83"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482461615399","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:a42d12a6c1e3fd479eeb9318ae70e44b8356f970412d95713ec371c0ad2be377"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482465809704","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:a6349f903ef31d8e5e5eaa2dc127f103db940e7f45261a19def160a1f1cf58ad"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482470004009","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:b81340bf2599f707b309f7312c66bcc17ec7edc23dfb363c6122112d96e6a5db"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482474198314","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:c2a093d01c83e3a0d354145eef40121868ed20d2a3f1d5d94a7d2b4db3732a20"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482474198315","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:e152bde39980d3799592f39c6ada46f06c7b47a7b7a5e2203974213a61181cf6"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482478392620","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:f70fe384c672865fff4bb8ab60d73098bc751e8f2aa915b8aff2e2085648b428"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482482586925","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:f7320465d208255b6d134fdb5700484324e940bb1b56c213484c19e8713b1752"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482482586926","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:c0f1db9c7f84a3324ba3fcd2fc862b1b35568d359155b6691553dacaeb04aefb"},{"edge_kind":"extracted_from_archive","from_key":"File:c0f1db9c7f84a3324ba3fcd2fc862b1b35568d359155b6691553dacaeb04aefb","to_key":"File:09ddbe6d159c1fae7299f5d4e1281dad6068331d9f651f45a51265277b80f0ed"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482486781231","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:c0f1db9c7f84a3324ba3fcd2fc862b1b35568d359155b6691553dacaeb04aefb"},{"edge_kind":"extracted_from_archive","from_key":"File:c0f1db9c7f84a3324ba3fcd2fc862b1b35568d359155b6691553dacaeb04aefb","to_key":"File:2983db3781942d11b9497551888ee8774f861ff9cbc5c64ddb79eaa0698f87bd"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482013213892","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:c0f1db9c7f84a3324ba3fcd2fc862b1b35568d359155b6691553dacaeb04aefb"},{"edge_kind":"extracted_from_archive","from_key":"File:c0f1db9c7f84a3324ba3fcd2fc862b1b35568d359155b6691553dacaeb04aefb","to_key":"File:2fc1eb21b61950e440496e896ec96386689edad2ca3bd95df0c134b32afe6431"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482490975536","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:c0f1db9c7f84a3324ba3fcd2fc862b1b35568d359155b6691553dacaeb04aefb"},{"edge_kind":"extracted_from_archive","from_key":"File:c0f1db9c7f84a3324ba3fcd2fc862b1b35568d359155b6691553dacaeb04aefb","to_key":"File:6c98d4f2b62b4db730884f9bd6d27e5360693eaad02d9cdbaa0e71c4c747450b"}],"verdict":{"verdict":"unknown"}},{"id":"1546297482495169841","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:c0f1db9c7f84a3324ba3fcd2fc862b1b35568d359155b6691553dacaeb04aefb"},{"edge_kind":"extracted_from_archive","from_key":"File:c0f1db9c7f84a3324ba3fcd2fc862b1b35568d359155b6691553dacaeb04aefb","to_key":"File:d2d8276ca63e307268dbf1bef2fbf45ba4c65c27494555a7742761c22984f1af"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"contacted_ip","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"Ip:23.103.189.157"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","edges":[{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:6c98d4f2b62b4db730884f9bd6d27e5360693eaad02d9cdbaa0e71c4c747450b"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:39a0f94562737f51c1429f2c694119693f981c57075a7bd205c6edf40bf34391"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:03333f3bef735a53e8385874bf427dc6318f4aad2b8b1c026f3985b0ae7c891c"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:8e31cb4cf9fb469e30ddbf508517cb35c4703be0e018bc5093c9b12cb215ea3d"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:c2a093d01c83e3a0d354145eef40121868ed20d2a3f1d5d94a7d2b4db3732a20"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:5838575dc944ff9fa697ea33f12416a02bf21dc7a978001fbf3c40467694a74c"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:2856c80d40eeb84b29e247ab3c9076f1604ebe8edf496fda9378a11f25a7b2e9"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:1b9e01a4d023b11faa39435d072af5c3b140f52a4cfcf02e9dbfc037eea331ec"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:c0f1db9c7f84a3324ba3fcd2fc862b1b35568d359155b6691553dacaeb04aefb"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:9162a982607e68ccd4c6b359982f1abfd07584d03750f70996c3ad7e019f41e2"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:372f9a4d62ed0bfc2366f4f568bba6213802600b7e2cf1d2b2603cf8d822011d"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:f7320465d208255b6d134fdb5700484324e940bb1b56c213484c19e8713b1752"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:e152bde39980d3799592f39c6ada46f06c7b47a7b7a5e2203974213a61181cf6"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:856a1625e642b908be2f801417a2017f234a8b92a1d2260252fc52534eedbd52"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:a42d12a6c1e3fd479eeb9318ae70e44b8356f970412d95713ec371c0ad2be377"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:f70fe384c672865fff4bb8ab60d73098bc751e8f2aa915b8aff2e2085648b428"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:3be00af2925c9104f12bfadc0db3db329d662f6bb81270e847dacb94d7dd5cde"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:a6349f903ef31d8e5e5eaa2dc127f103db940e7f45261a19def160a1f1cf58ad"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:d2d8276ca63e307268dbf1bef2fbf45ba4c65c27494555a7742761c22984f1af"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:9cc1cfce036986f05b67629ec346c2df162585efcdb44b5d1372a3e4efc8ee83"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:b81340bf2599f707b309f7312c66bcc17ec7edc23dfb363c6122112d96e6a5db"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:09ddbe6d159c1fae7299f5d4e1281dad6068331d9f651f45a51265277b80f0ed"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:40ee1326aec12197c2077636f6d99fc58f544b1e1d7057cecf5880443af4120c"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:2fc1eb21b61950e440496e896ec96386689edad2ca3bd95df0c134b32afe6431"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:3a52b4bf47e41992406ae615773b1a3badc516e75309959c03a60c3c4e397492"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:2983db3781942d11b9497551888ee8774f861ff9cbc5c64ddb79eaa0698f87bd"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:a145fbf0f2e94a58e50a805c456abe9288c6db1e45ac3ce4da266c24dd7c7cad"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:33321500b0f7dab1ed4525a5fdf967e9602943424e765578dfb41403169259ba"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:0e3158c22a082c1e7f1c866b880231d143b5de17d7dd0b45ae923a1613cf0e42"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:5d06f47f4f86c5b84bca13dc7a6dc16bb3009bd94b083ac6234d789c714f7cac"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:bef82a72fbd9be049369220bb67233a1dc7d64ca06a1179449b59e662f7aad17"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:86146054b84bf926737f3af95ff544444e327a79715c6773ac13c4674bae4b8d"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:0e3158c22a082c1e7f1c866b880231d143b5de17d7dd0b45ae923a1613cf0e42"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:12e351c46eabe22b33c97e540a6966cc735ceb2b4d50a15617f4539c848d4e8b"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:eecdc3bf80422064e9799252dd98ed8b8c3aa876a13eca6a80702a67d04b4a9c"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:80fa12aedee263d6bc1af3631a3a48d181e641ba3834a387cca03904b677140b"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:2820507593b307075160abd5158557826ee851a7792cb937cbac4998a1043c05"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:8f117f389d6ed945f96fc6cb0c6cbdcbcaf9b133d2b26876f00a7347bdf38173"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:2a439ab0ccf43f70f80f6b929f9ea29ac6a6666b9abce9921105dc72e7fda8ca"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:96c94061ce1e9c4957f82fffee7e46d8de1a2d80f2cf0b9211f8049bd5c4e370"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:61aba927d524d9cbae89530c2f1eddbcbbcb86d0cfc7b6e1cc490d2665031666"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:eb686e46fdcd61a9e8af8b8d5cbf26e04567ade1dddc6c1b05b5c1d98ac821ba"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:4f7f814d38b17441caa4ed9e8ed97d9cf9d59279dbd559b3f21e62c55b3d9a4d"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:5d06f47f4f86c5b84bca13dc7a6dc16bb3009bd94b083ac6234d789c714f7cac"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:2820507593b307075160abd5158557826ee851a7792cb937cbac4998a1043c05"},{"edge_kind":"extracted","from_key":"File:e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","to_key":"File:1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":24,"imported_dlls_count":149,"dropped_files_count":0,"extracted_files_count":49,"files_written_count":510,"files_deleted_count":0,"registry_keys_created_count":10,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":10,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a9df38af3c0dcb26b0acf38","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":95,"submit_name":"OIM_Users_Guide v2.doc","analysis_start_time":"2026-09-06T23:13:24+00:00","indicators_count":{"informative":46,"suspicious":2,"malicious":3},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"599fd78e7ca3e15d9b44f584","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"suspicious","threat_score":28,"contacted_countries":["USA"],"submit_name":"OIM_Users_Guide v2.doc","analysis_start_time":"2017-08-25T09:54:25+00:00","indicators_count":{"informative":17,"suspicious":2,"malicious":2},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"23.103.189.157","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}],"processes":[{"pid":3724,"ppid":0,"name":"WINWORD.EXE","command_line":"/n \"C:\\e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0.doc","sha256":"8cfb55087fa8e4c1e7bcc580d767cf2c884c1b8c890ad240c1e7009810af6736","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","uid":"00020671-00003724","icon":"$34"}],"all_imported_dlls":["setupapi.dll","slc.dll","ALRTINTL.DLL","imageres.dll","wtsapi32.dll","msi.dll","WWINTL.DLL","NL7MODELS0009.dll","GFX.DLL","comctl32.dll","usp10.dll","msctf.dll","msxml6r.dll","advapi32.dll","user32.dll","MSOINTL.DLL","MSORES.DLL","srvcli.dll","WWLIB.DLL","apphelp.dll","msvcr90.dll","rpcrt4.dll","devobj.dll","Wldap32.dll","urlmon.dll","sxs.dll","KernelBase.dll","msvcrt.dll","sechost.dll","ole32.dll","VBE7.DLL","OSPPCEXT.DLL","winhttp.dll","webio.dll","kernel32.dll","powrprof.dll","msxml6.dll","GKWord.dll","linkinfo.dll","prntvpt.dll","msvcp90.dll","OART.DLL","version.dll","cryptsp.dll","crypt32.dll","cscapi.dll","mscss7en.dll","MSGR3EN.DLL","imm32.dll","dwmapi.dll","profapi.dll","USP10.DLL","VBE7INTL.DLL","GdiPlus.dll","oleaut32.dll","sspicli.dll","SendToOneNoteUI.dll","CSS7DATA0009.DLL","gdi32.dll","lpk.dll","msimg32.dll","shlwapi.dll","RICHED20.DLL","OSPPC.DLL","cfgmgr32.dll","ntmarta.dll","MSPTLS.DLL","mscoree.dll","shell32.dll","iertutil.dll","vfprint.dll","mxdwdrv.dll","fontsub.dll","ntshrui.dll","MSO.DLL","cryptbase.dll","clbcatq.dll","propsys.dll","rsaenh.dll","unidrvui.dll","WinSCard.dll","uxtheme.dll","mscoreei.dll","RpcRtRemote.dll","wininet.dll","msasn1.dll","WindowsCodecs.dll","msproof7.dll","MSSP7EN.DLL","ntdll.dll","rpcss.dll","VxSSL64.dll","CoreUIComponents.dll","netutils.dll","policymanager.dll","msvcp140.dll","nsi.dll","rmclient.dll","combase.dll","gpapi.dll","AcGenral.dll","netapi32.dll","samcli.dll","IPHLPAPI.DLL","netprofm.dll","userenv.dll","msvcp110_win.dll","MpOAV.dll","sppc.dll","ninput.dll","ucrtbase.dll","bcryptprimitives.dll","srpapi.dll","CoreMessaging.dll","DataExchange.dll","win32u.dll","SHCore.dll","ws2_32.dll","fltLib.dll","npmproxy.dll","hlink.dll","kernel.appcore.dll","dhcpcsvc6.dll","cldapi.dll","msIso.dll","windows.storage.dll","dhcpcsvc.dll","aepic.dll","vcruntime140.dll","ONBttnWD.dll","twinapi.appcore.dll","DWrite.dll","mpr.dll","edputil.dll","WinTypes.dll","secur32.dll","msvcp_win.dll","dcomp.dll","AcSpecfc.dll","bcrypt.dll","d3d11.dll","coml2.dll","MpClient.dll","wkscli.dll","gdi32full.dll","imagehlp.dll","vcruntime140_1.dll","dxgi.dll","TextInputFramework.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"[Content_Types].xml","sha256":"6c98d4f2b62b4db730884f9bd6d27e5360693eaad02d9cdbaa0e71c4c747450b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Macros/VBA/__SRP_2","sha256":"39a0f94562737f51c1429f2c694119693f981c57075a7bd205c6edf40bf34391","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Macros/VBA/__SRP_4","sha256":"03333f3bef735a53e8385874bf427dc6318f4aad2b8b1c026f3985b0ae7c891c","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Macros/VBA/__SRP_0","sha256":"8e31cb4cf9fb469e30ddbf508517cb35c4703be0e018bc5093c9b12cb215ea3d","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Macros/VBA/ThisDocument","sha256":"c2a093d01c83e3a0d354145eef40121868ed20d2a3f1d5d94a7d2b4db3732a20","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Macros/VBA/__SRP_3","sha256":"5838575dc944ff9fa697ea33f12416a02bf21dc7a978001fbf3c40467694a74c","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Macros/VBA/AutoOpen","sha256":"2856c80d40eeb84b29e247ab3c9076f1604ebe8edf496fda9378a11f25a7b2e9","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Macros/VBA/_VBA_PROJECT","sha256":"1b9e01a4d023b11faa39435d072af5c3b140f52a4cfcf02e9dbfc037eea331ec","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"1Table","sha256":"c0f1db9c7f84a3324ba3fcd2fc862b1b35568d359155b6691553dacaeb04aefb","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"WordDocument","sha256":"9162a982607e68ccd4c6b359982f1abfd07584d03750f70996c3ad7e019f41e2","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Macros/VBA/AutoClose","sha256":"372f9a4d62ed0bfc2366f4f568bba6213802600b7e2cf1d2b2603cf8d822011d","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"MsoDataStore/ÓÅÐÜÙUÜGGEÂÖÓKWÁÑÒßØÅÀ==/Properties","sha256":"f7320465d208255b6d134fdb5700484324e940bb1b56c213484c19e8713b1752","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Macros/VBA/dir","sha256":"e152bde39980d3799592f39c6ada46f06c7b47a7b7a5e2203974213a61181cf6","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"[5]DocumentSummaryInformation","sha256":"856a1625e642b908be2f801417a2017f234a8b92a1d2260252fc52534eedbd52","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Macros/VBA/__SRP_5","sha256":"a42d12a6c1e3fd479eeb9318ae70e44b8356f970412d95713ec371c0ad2be377","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"[1]CompObj","sha256":"f70fe384c672865fff4bb8ab60d73098bc751e8f2aa915b8aff2e2085648b428","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Data","sha256":"3be00af2925c9104f12bfadc0db3db329d662f6bb81270e847dacb94d7dd5cde","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Macros/PROJECT","sha256":"a6349f903ef31d8e5e5eaa2dc127f103db940e7f45261a19def160a1f1cf58ad","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"_rels/.rels","sha256":"d2d8276ca63e307268dbf1bef2fbf45ba4c65c27494555a7742761c22984f1af","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"MsoDataStore/ÓÅÐÜÙUÜGGEÂÖÓKWÁÑÒßØÅÀ==/Item","sha256":"9cc1cfce036986f05b67629ec346c2df162585efcdb44b5d1372a3e4efc8ee83","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Macros/PROJECTwm","sha256":"b81340bf2599f707b309f7312c66bcc17ec7edc23dfb363c6122112d96e6a5db","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"theme/theme/themeManager.xml","sha256":"09ddbe6d159c1fae7299f5d4e1281dad6068331d9f651f45a51265277b80f0ed","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Macros/VBA/__SRP_1","sha256":"40ee1326aec12197c2077636f6d99fc58f544b1e1d7057cecf5880443af4120c","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"theme/theme/theme1.xml","sha256":"2fc1eb21b61950e440496e896ec96386689edad2ca3bd95df0c134b32afe6431","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"[5]SummaryInformation","sha256":"3a52b4bf47e41992406ae615773b1a3badc516e75309959c03a60c3c4e397492","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"theme/theme/_rels/themeManager.xml.rels","sha256":"2983db3781942d11b9497551888ee8774f861ff9cbc5c64ddb79eaa0698f87bd","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0.LNK","sha256":"a145fbf0f2e94a58e50a805c456abe9288c6db1e45ac3ce4da266c24dd7c7cad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"index.dat","sha256":"33321500b0f7dab1ed4525a5fdf967e9602943424e765578dfb41403169259ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"name":"~$Normal.dotm","sha256":"0e3158c22a082c1e7f1c866b880231d143b5de17d7dd0b45ae923a1613cf0e42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"~WRS{005FAEA2-F2A4-4DEE-81E7-931D9B1E4740}.tmp","sha256":"5d06f47f4f86c5b84bca13dc7a6dc16bb3009bd94b083ac6234d789c714f7cac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"~WRS{43AB78BC-C491-4580-953C-57132257838B}.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"~WRS{7068ED72-9719-4268-8B50-F376AB7E8A4F}.tmp","sha256":"bef82a72fbd9be049369220bb67233a1dc7d64ca06a1179449b59e662f7aad17","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"~WRS{80D5C1B8-6F49-4CD3-B940-20234F0ABC25}.tmp","sha256":"86146054b84bf926737f3af95ff544444e327a79715c6773ac13c4674bae4b8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"~$fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0.doc","sha256":"0e3158c22a082c1e7f1c866b880231d143b5de17d7dd0b45ae923a1613cf0e42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"ExcludeDictionaryEN0409.lex","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"OIM_Users_Guidev2.doc.LNK","sha256":"12e351c46eabe22b33c97e540a6966cc735ceb2b4d50a15617f4539c848d4e8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"name":"~WRD0000.tmp","sha256":"eecdc3bf80422064e9799252dd98ed8b8c3aa876a13eca6a80702a67d04b4a9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"name":"~WRD0001.tmp","sha256":"80fa12aedee263d6bc1af3631a3a48d181e641ba3834a387cca03904b677140b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"name":"~_M_Users_Guidev2.doc","sha256":"2820507593b307075160abd5158557826ee851a7792cb937cbac4998a1043c05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"name":"~WRF_BD39881A-DD1E-42CE-95F3-49F7160D2BFA_.tmp","sha256":"8f117f389d6ed945f96fc6cb0c6cbdcbcaf9b133d2b26876f00a7347bdf38173","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"name":"Word14.customUI","sha256":"2a439ab0ccf43f70f80f6b929f9ea29ac6a6666b9abce9921105dc72e7fda8ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"name":"urlref_httpdocs.oracle.comcdE52734_01oimOMUSGusr_mangmnt.htm","sha256":"96c94061ce1e9c4957f82fffee7e46d8de1a2d80f2cf0b9211f8049bd5c4e370","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"name":"urlref_httpdocs.oracle.comcdE52734_01oimOMUSGcatalog.htm","sha256":"61aba927d524d9cbae89530c2f1eddbcbbcb86d0cfc7b6e1cc490d2665031666","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"name":"~WRS_2611B99A-4330-4BA2-AD86-2191ABC5A274_.tmp","sha256":"eb686e46fdcd61a9e8af8b8d5cbf26e04567ade1dddc6c1b05b5c1d98ac821ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"name":"~WRS_3968ECBA-5C4D-4141-AE0A-2067547CDDA7_.tmp","sha256":"4f7f814d38b17441caa4ed9e8ed97d9cf9d59279dbd559b3f21e62c55b3d9a4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"name":"~WRS_98C4990F-899B-4A14-8C10-E5EAEC5827A2_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"name":"~WRS_1A57D51A-9A3F-4400-B24E-401C58D9ECA7_.tmp","sha256":"5d06f47f4f86c5b84bca13dc7a6dc16bb3009bd94b083ac6234d789c714f7cac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"name":"~_Normal.dotm","sha256":"2820507593b307075160abd5158557826ee851a7792cb937cbac4998a1043c05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"name":"~WRD0001.tmp%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]}],"files_written":[{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\office14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE.config","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"C:\\Users\\gKRwLzd","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%APPDATA%\\Microsoft\\Templates","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\~$Normal.dotm","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\Normal.dotm","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{43AB78BC-C491-4580-953C-57132257838B}.tmp","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%TEMP%\\~DFE718A1AD44E7BA8C.TMP","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"C:\\e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0.doc","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"C:\\~$fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0.doc","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\sendtoonenote.BUD","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\sendtoonenote.gpd","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\StdNames.gpd","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\SendToOneNoteNames.gpd","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\SendToOneNoteFilter.gpd","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%APPDATA%\\Microsoft\\Office\\review.rcd","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%APPDATA%\\Microsoft\\Office\\adhoc.rcd","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{005FAEA2-F2A4-4DEE-81E7-931D9B1E4740}.tmp","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{80D5C1B8-6F49-4CD3-B940-20234F0ABC25}.tmp","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%APPDATA%\\Microsoft\\Office","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0.LNK","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\MSWORD.OLB","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{7B9853C5-1964-495F-8C25-64BA5B0162DE}.tmp","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\system32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA7\\VBE7.DLL\\3","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%TEMP%\\VBE","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"C:\\Oumguide.dot","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MARLETT.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ARIAL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ARIALI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ARIALBD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ARIALBI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BATANG.TTC","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\COUR.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\COURI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\COURBD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\COURBI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\DAUNPENH.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\DOKCHAMP.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ESTRE.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\EUPHEMIA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GAUTAMI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GAUTAMIB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\VANI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\VANIB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GULIM.TTC","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\IMPACT.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ISKPOTA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ISKPOTAB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\KALINGA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\KALINGAB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\KARTIKA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\KARTIKAB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\KHMERUI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\KHMERUIB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LAOUI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LAOUIB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LATHA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LATHAB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LUCON.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MALGUN.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MALGUNBD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MANGAL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MANGALB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MEIRYO.TTC","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MEIRYOB.TTC","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\HIMALAYA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MSJH.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MSJHBD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MSYH.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MSYHBD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MINGLIU.TTC","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MINGLIUB.TTC","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MONBAITI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MSGOTHIC.TTC","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MSMINCHO.TTC","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MVBOLI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\NTAILU.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\NTAILUB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\NYALA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\PHAGSPA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\PHAGSPAB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\PLANTC.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\RAAVI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\RAAVIB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SEGOESC.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SEGOESCB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUII.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIZ.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SEGUISB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUIL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SEGUISYM.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SHRUTI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SHRUTIB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SIMSUN.TTC","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SIMSUNB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SYLFAEN.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TAILE.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TAILEB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TIMES.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TIMESI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TIMESBD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TIMESBI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TUNGA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TUNGAB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\VRINDA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\VRINDAB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SHONAR.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SHONARB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MSYI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TAHOMABD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MICROSS.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ANGSA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ANGSAI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ANGSAB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ANGSAZ.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\APARAJ.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\APARAJB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\APARAJBI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\APARAJI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CORDIA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CORDIAI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CORDIAB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CORDIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\EBRIMA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\EBRIMABD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GISHA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GISHABD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\KOKILA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\KOKILAB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\KOKILABI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\KOKILAI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LEELAWAD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LEELAWDB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MSUIGHUR.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MOOLBOR.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SYMBOL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UTSAAH.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHBI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UTSAAHI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\VIJAYA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\VIJAYAB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\WINGDING.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MODERN.FON","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ROMAN.FON","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SCRIPT.FON","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ANDLSO.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ARABTYPE.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SIMPO.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SIMPBDO.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SIMPFXO.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MAJALLA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MAJALLAB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TRADO.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TRADBDO.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\AHRONBD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\DAVID.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\DAVIDBD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\FRANK.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LVNM.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LVNMBD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MRIAM.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MRIAMC.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\NRKIS.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ROD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SIMFANG.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SIMHEI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SIMKAI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ANGSAU.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ANGSAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BROWA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BROWAI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BROWAB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BROWAZ.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BROWAU.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BROWAUI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BROWAUB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BROWAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CORDIAU.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUZ.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CORDIAUI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCDL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCDI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCDB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCDBI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCEL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCEI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCEB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCEBI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCFL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCFI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCFB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCFBI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCIL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCII.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCIB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCIBI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCJL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCJI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCJB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCJBI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCKL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCKI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCKB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCKBI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCLL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCLI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCLB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\UPCLBI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\KAIU.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\L_10646.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ARIBLK.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CALIBRI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CALIBRII.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CALIBRIB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CALIBRIZ.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIA.TTC","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CAMBRIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CANDARA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CANDARAI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CANDARAB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CANDARAZ.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\COMIC.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\COMICBD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CONSOLA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CONSOLAZ.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CONSTAN.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CONSTANI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CONSTANB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CONSTANZ.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CORBEL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CORBELI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CORBELB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CORBELZ.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\FRAMD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\FRAMDIT.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GABRIOLA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GEORGIA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GEORGIAZ.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\PALA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\PALAI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\PALAB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\PALABI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SEGOEPR.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SEGOEPRB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TREBUC.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TREBUCIT.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TREBUCBD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TREBUCBI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\VERDANA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\VERDANAI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\VERDANAB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\VERDANAZ.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\WEBDINGS.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\COURE.FON","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SERIFE.FON","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SSERIFE.FON","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SMALLE.FON","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SMALLF.FON","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\HATTEN.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ANTQUAB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ANTQUABI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ANTQUAI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BKANT.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GOTHIC.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GOTHICB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GOTHICBI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GOTHICI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ARIALN.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ARIALNB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ARIALNBI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ARIALNI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GARA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GARABD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GARAIT.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MTCORSVA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\AGENCYB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\AGENCYR.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ARLRDBD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ITCBLKAD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BOD_B.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BOD_BI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BOD_I.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BOD_R.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BOD_BLAI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BOD_BLAR.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BOD_CB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BOD_CBI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BOD_CI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BOD_CR.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BOOKOS.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSBI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BOOKOSI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BRADHITC.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CALIST.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CALISTB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CALISTBI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CALISTI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CASTELAR.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CENSCBK.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKBI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SCHLBKI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\COPRGTB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\COPRGTL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CURLZ___.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ITCEDSCR.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ELEPHNT.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ELEPHNTI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ENGR.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ERASBD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ERASDEMI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ERASLGHT.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ERASMD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\FELIXTI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\FORTE.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\FRABK.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\FRABKIT.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\FRADM.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\FRADMIT.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\FRADMCN.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\FRAHV.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\FRAHVIT.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\FRAMDCN.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\FRSCRIPT.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GIGI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GILBI___.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GILB____.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GILI____.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GIL_____.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GILC____.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GILSANUB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GILLUBCD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GLSNECB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GLECB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GOUDOS.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GOUDOSB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GOUDOSI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\GOUDYSTO.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\IMPRISHA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LSANS.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LSANSD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LSANSDI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LSANSI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LTYPE.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LTYPEB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LTYPEBO.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LTYPEO.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MAIAN.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\OCRAEXT.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\PALSCRI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\PAPYRUS.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\PERBI___.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\PERB____.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\PERI____.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\PER_____.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\PERTIBD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\PERTILI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\PRISTINA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\RAGE.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ROCK.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ROCKB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ROCKBI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ROCKI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ROCCB___.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ROCC____.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ROCKEB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SCRIPTBL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TCBI____.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TCB_____.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TCCM____.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TCCB____.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TCCEB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TCMI____.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TCM_____.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ALGER.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BASKVILL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BAUHS93.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BELL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BELLB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BELLI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BRLNSB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BRLNSDB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BRLNSR.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BERNHC.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BOD_PSTC.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BRITANIC.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BROADW.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BRUSHSCI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CALIFB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CALIFI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CALIFR.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CENTAUR.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CHILLER.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\COLONNA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\COOPBL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\FTLTLT.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\FREESCPT.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\HARLOWSI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\HARNGTON.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\HTOWERT.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\HTOWERTI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\JOKERMAN.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\JUICE___.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ITCKRIST.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\KUNSTLER.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LBRITE.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LBRITED.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LBRITEDI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LBRITEI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LCALLIG.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LFAX.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LFAXD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LFAXDI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LFAXI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LHANDW.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MAGNETOB.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MATURASC.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MISTRAL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MOD20.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\NIAGENG.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\NIAGSOL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\OLDENGL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ONYX.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\PARCHM.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\PLAYBILL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\POORICH.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\RAVIE.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\INFROMAN.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SHOWG.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\SNAP____.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\STENCIL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TEMPSITC.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\VINERITC.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\VIVALDII.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\VLADIMIR.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\LATINWD.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\CENTURY.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\WINGDNG2.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\WINGDNG3.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\ARIALUNI.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\MSMINCHO.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%COMMONPROGRAMFILES%\\MICROSOFT SHARED\\EQUATION\\MTEXTRA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\OUTLOOK.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\BSSYM7.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\REFSAN.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\REFSPCL.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\FONTS\\TAHOMA.TTF","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\CUSTOM.DIC","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"},{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{7068ED72-9719-4268-8B50-F376AB7E8A4F}.tmp","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\SendToOneNote.ini","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"path":"%TEMP%\\CVR5BE2.tmp","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.Word\\~WRS{98C4990F-899B-4A14-8C10-E5EAEC5827A2}.tmp","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"path":"%TEMP%\\~DFFB4FABB620903DB1.TMP","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"path":"C:\\~$M_Users_Guidev2.doc","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.Word\\~WRS{2611B99A-4330-4BA2-AD86-2191ABC5A274}.tmp","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.Word\\~WRS{1A57D51A-9A3F-4400-B24E-401C58D9ECA7}.tmp","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.Word\\~WRS{3968ECBA-5C4D-4141-AE0A-2067547CDDA7}.tmp","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\OIM_Users_Guidev2.doc.LNK","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.Word\\~WRF{BD39881A-DD1E-42CE-95F3-49F7160D2BFA}.tmp","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\Word14.customUI","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\ExcludeDictionaryEN0409.lex","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LANGUAGERESOURCES\\ENABLEDLANGUAGES\\","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\MIGRATION\\OFFICE\\","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\MIGRATION\\WORD\\","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-61684","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-61684","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"Local\\10MU_ACBPIDS_S-1-5-5-0-61684","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"Local\\10MU_ACB10_S-1-5-5-0-61684","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"599fd78e7ca3e15d9b44f584"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3232:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"name":"Local\\SM0:3232:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"name":"SM0:3232:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"name":"Local\\SM0:3232:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3232:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3232:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a9df38af3c0dcb26b0acf38"}]}]}},"report_ids":{"sandbox_job_ids":["6a9df38af3c0dcb26b0acf38","599fd78e7ca3e15d9b44f584"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Msoffice/malicious_confidence_90% Sample e8fa4bdb4a98… — Score 95/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e8fa4bdb4a98…. Malware family: Msoffice/malicious_confidence_90%. Threat score 95/100. 1/25 AV engines flagged this file. 4 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0"}],["$","meta","4",{"property":"og:title","content":"Malicious Msoffice/malicious_confidence_90% Sample e8fa4bdb4a98… — Score 95/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e8fa4bdb4a98…. Malware family: Msoffice/malicious_confidence_90%. Threat score 95/100. 1/25 AV engines flagged this file. 4 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e8fa4bdb4a986a607f3940c6621e891701e797b2358aceeea4629a0a5ec058d0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Msoffice/malicious_confidence_90% Sample e8fa4bdb4a98… — Score 95/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e8fa4bdb4a98…. Malware family: Msoffice/malicious_confidence_90%. Threat score 95/100. 1/25 AV engines flagged this file. 4 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L35","11",{}]]