24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T479,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 0d01b24f7666… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0d01b24f7666…. Malware family: Trojan.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["doc","office"],"identifier":"0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":15,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tbc64,Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleBaseNameA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameExA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "EnumProcessModules"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "EnumProcesses"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetProductInfo"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "NetGetJoinInformation"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "BCryptDecrypt"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "BCryptEncrypt"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "BCryptSetProperty"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetupDiCreateDeviceInfoList"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetupDiOpenDeviceInterfaceW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetupDiGetDeviceInterfaceDetailW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetupDiEnumDeviceInterfaces"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetupDiDestroyDeviceInfoList"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetupDiEnumDeviceInfo"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetupDiGetDeviceRegistryPropertyW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetupDiGetClassDevsW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetThreadPreferredUILanguages"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetLongPathNameA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetCreateUrlW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetCreateUrlA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetAttemptConnect"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetReadFileExA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetQueryDataAvailable"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "HttpEndRequestW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "HttpSendRequestExW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "HttpAddRequestHeadersA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "HttpAddRequestHeadersW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetGetConnectedStateExW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetGoOnline"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetErrorDlg"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetAutodialHangup"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetAutodial"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetGetConnectedState"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetOpenUrlW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetQueryOptionA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetQueryOptionW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetUrlCacheEntryGroup"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetUrlCacheEntryGroupW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FindCloseUrlCache"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FindNextUrlCacheEntryW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FindFirstUrlCacheEntryW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FindNextUrlCacheEntryA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FindFirstUrlCacheEntryA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FindNextUrlCacheEntryExA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FindNextUrlCacheEntryExW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FindFirstUrlCacheEntryExA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FindFirstUrlCacheEntryExW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetUrlCacheEntryInfoA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetUrlCacheEntryInfoW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CommitUrlCacheEntryA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CommitUrlCacheEntryW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CreateUrlCacheEntryA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CreateUrlCacheEntryW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetSetOptionA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetSetOptionW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetGetCookieExW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetGetCookieW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "HttpQueryInfoA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "HttpQueryInfoW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "HttpSendRequestW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "HttpOpenRequestW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetGetLastResponseInfoW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetCrackUrlW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetCrackUrlA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FtpRemoveDirectoryA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FtpCreateDirectoryA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FtpDeleteFileA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FtpRenameFileA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetCanonicalizeUrlW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetCanonicalizeUrlA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetCombineUrlA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FtpFindFirstFileA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetFindNextFileA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FtpGetCurrentDirectoryA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FtpSetCurrentDirectoryA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FtpGetFileA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FtpOpenFileA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetConnectW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetWriteFile"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetThreadUILanguage"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetNamedSecurityInfoW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "AddAccessAllowedAce"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "AddAccessDeniedAce"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "IsValidSid"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CreateDCA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetTextMetricsA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CreateFontA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetMapMode"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CreateFontIndirectW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CreateFontIndirectA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetObjectA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetProcessWorkingSetSize"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CreateRemoteThread"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "VirtualQueryEx"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RtlCaptureStackBackTrace"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "OpenMutexA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CreateSemaphoreA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GlobalMemoryStatus"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "ShellExecuteExA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "AssocQueryStringW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "DrawTextA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "MapDialogRect"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetMenuCheckMarkDimensions"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "LoadBitmapA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "RegisterClassExA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "IsDialogMessageA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SystemParametersInfoA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "MapWindowPoints"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "DrawIconEx"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "LoadIconA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "LoadCursorA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "DrawFocusRect"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetScrollInfo"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SetScrollInfo"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetWindowPlacement"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "SendMessageTimeoutA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "HttpEndRequestA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "HttpSendRequestExA"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found reference to API (Indicator: "InternetSetStatusCallback"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp")26:T664,Normalized macro string: "httpzu" Normalized macro string: "ZG5zckdEVUEqTlRCYVdxeHR3Y3BnWGVLZFVERno0cTJwV0NNS1Izcit4U3g3djBKcW1PSlcxWVNtZFRjZW5TQlJWa3dxQU9x" Normalized macro string: "http7" Normalized macro string: "lW0cTgaLGLBxSGWLUpl9fk4iLh7n7L4hBGp9QAM+cIEJD3Ii2AaSTpQlF/sNXJayuTD7nOmvbKhJY9PixeJENtY/RGZ7BmGU" Normalized macro string: "httppav1v" Normalized macro string: "M2xh6RXFhc76TCSIPdo/kpyt7iSFSeEVu5pIixwW5iubKpS3Abcwte/oANPyAJLigstvACwRabaOMY15dBqQ61D4oVr21YO+" Normalized macro string: "http3m3m" Normalized macro string: "s8XLSLvCvasSNYuE/IiHwcQBQTzyOEEhA61ctVSEgg/jf6hPQ99u/9+lLg3ifABSIOOX+mrT+1DMcwDX3FdGVJDpq3YM8f/q" Normalized macro string: "httpmbzfo+07+v41q2r" Normalized macro string: "dBkCIbHXcy9rEW+wYNZhr9WzCbTdxdTCw0PgdNmlfwBG+zz0HWfgHGooSA+Qxr0eBd7m3i+HNJVhpK4no31BMLQcOd2aVRRN" Normalized macro string: "httpe8ch+jqyl6smbfykuumsq" Normalized macro string: "AwPoLowSGkoaQFdd3baKaMHELoLe+I3q0ce10b+upu7/7EiLEtnTBP8eC8icGhl+DJ+QryHLo6hSAmuBUFbyfK+uAu+mIS/Q" Normalized macro string: "http1hv" Normalized macro string: "OX87VKGDxYZzpH25Wd8/Qybw1Lvaqxa9HHtJKcFmkkcnjtX6WnK6acYWPoJhlp1AdVn1crBRrv8l1Gh8i4d6R7rCpvuDKrAY" Normalized macro string: "httpogeng" Normalized macro string: "DJQVd53bb+trjT0cI4TJXz4dSFROXjmDRkT/qbwy81ba3uk4/ug36hgrSjOWwRAVSEWALGwbtHSttzpwQOYxGvmeSFNBSGgr" Normalized macro string: "httpt" Normalized macro string: "eFGLSVn2KZyhnnjAdFxRInNKi+xEK8A4rNVIorSZSlQ7kshPTmpQjMz2JvrslqTxRk1oYIZFQj1mPVwanOtJj/J7EtTLqrnC" Normalized macro string: "httpu" Normalized macro string: "9AAI9ffiDdWu8hLyA/I2s1k69GWhROG4z1G5QvJe1Cysp68v9W6Q0lZyAwaUr8Mgh0On3E+0yJtrE0kANtsAJftZpdGrA8IU"27:T1836,"WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSO.DLL" at base 65600000 "WINWORD.EXE" loaded module "MSO.DLL" at base 65600000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\1033\WWINTL.DLL" at base 6c6e0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d20000 "WINWORD.EXE" loaded module "DWMAPI.DLL" at base 73d60000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSPTLS.DLL" at base 6c250000 "WINWORD.EXE" loaded module "KERNEL32" at base 76600000 "WINWORD.EXE" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "WINWORD.EXE" loaded module "VERSION.DLL" at base 74810000 "WINWORD.EXE" loaded module "SHELL32.DLL" at base 766e0000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76600000 "WINWORD.EXE" loaded module "IMM32.DLL" at base 75d00000 "WINWORD.EXE" loaded module "POWRPROF.DLL" at base 73e00000 "WINWORD.EXE" loaded module "ADVAPI32.DLL" at base 75970000 "WINWORD.EXE" loaded module "SETUPAPI.DLL" at base 75b30000 "WINWORD.EXE" loaded module "OLEAUT32.DLL" at base 76560000 "WINWORD.EXE" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75ce0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\GKWORD.DLL" at base 60a30000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 766e0000 "WINWORD.EXE" loaded module "LINKINFO.DLL" at base 6ec40000 "WINWORD.EXE" loaded module "USER32.DLL" at base 75d70000 "WINWORD.EXE" loaded module "NTSHRUI.DLL" at base 72c60000 "WINWORD.EXE" loaded module "SRVCLI.DLL" at base 74eb0000 "WINWORD.EXE" loaded module "CSCAPI.DLL" at base 70850000 "WINWORD.EXE" loaded module "SLC.DLL" at base 73310000 "WINWORD.EXE" loaded module "SHLWAPI.DLL" at base 763a0000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base 74110000 "WINWORD.EXE" loaded module "NTDLL.DLL" at base 77390000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 70f70000 "WINWORD.EXE" loaded module "GDIPLUS.DLL" at base 73ad0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSPROOF7.DLL" at base 72c10000 "WINWORD.EXE" loaded module "WMVCORE.DLL" at base 60780000 "WINWORD.EXE" loaded module "WWLIB.DLL" at base 67b90000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75140000 "WINWORD.EXE" loaded module "KERNEL32.DLL" at base 76600000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\CULTURES\OFFICE.ODF" at base 6fbc0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\1033\MSOINTL.DLL" at base 65390000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSORES.DLL" at base 60e60000 "WINWORD.EXE" loaded module "CRYPTBASE.DLL" at base 75190000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75970000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 76600000 "WINWORD.EXE" loaded module "UXTHEME.DLL" at base 73d20000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\RICHED20.DLL" at base 60d10000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72a00000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "WINWORD.EXE" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 60c80000 "WINWORD.EXE" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPC.DLL" at base 6e470000 "WINWORD.EXE" loaded module "RPCRT4.DLL" at base 76400000 "WINWORD.EXE" loaded module "WINSPOOL.DRV" at base 717d0000 "WINWORD.EXE" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75ce0000 "WINWORD.EXE" loaded module "OLE32.DLL" at base 755d0000 "WINWORD.EXE" loaded module "CLBCATQ.DLL" at base 75a20000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73fc0000 "WINWORD.EXE" loaded module "NTMARTA.DLL" at base 747b0000 "WINWORD.EXE" loaded module "CRYPTSP.DLL" at base 74ca0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74a30000 "WINWORD.EXE" loaded module "RPCRTREMOTE.DLL" at base 75230000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 71170000 "WINWORD.EXE" loaded module "PROFAPI.DLL" at base 752a0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 755d0000 "WINWORD.EXE" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75500000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 75e90000 "WINWORD.EXE" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 755c0000 "WINWORD.EXE" loaded module "SECUR32.DLL" at base 74fc0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\USP10.DLL" at base 60be0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\SPOOL\DRIVERS\W32X86\3\UNIDRVUI.DLL" at base 60b20000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\SPOOL\DRIVERS\W32X86\3\SENDTOONENOTEUI.DLL" at base 6e210000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\FM20.DLL" at base 609f0000 "WINWORD.EXE" loaded module "SXS.DLL" at base 751a0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\VBA\VBA7\VBE7.DLL" at base 604d0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\VBA\VBA7\1033\VBE7INTL.DLL" at base 3c20000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\FM20ENU.DLL" at base 6c6d0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75fe0000 "WINWORD.EXE" loaded module "GDI32.DLL" at base 75e40000 "WINWORD.EXE" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73ad0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\USP10.DLL" at base 0 "WINWORD.EXE" loaded module "NTDLL" at base 77390000 "WINWORD.EXE" loaded module "VBE7.DLL" at base 604d0000 "WINWORD.EXE" loaded module "WINDOWSCODECS.DLL" at base 738d000028:T4f2,"~_file.doc" has type "data"- [targetUID: 00000000-00003532] "MSForms.exd" has type "data"- Location: [%TEMP%\Word8.0\MSForms.exd]- [targetUID: 00000000-00003532] "907407343.cvr" has type "data"- Location: [%TEMP%\907407343.cvr]- [targetUID: 00000000-00003532] "~WRS_BFABA732-59CF-4860-BEFC-00ED81F45505_.tmp" has type "dBase III DBT version number 0 next free block index 13"- [targetUID: 00000000-00003532] "file.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Sat Apr 29 08:36:49 2023 mtime=Sat Apr 29 08:36:49 2023 atime=Sat Apr 29 08:36:12 2023 length=2375680 window=hide"- Location: [%APPDATA%\Microsoft\Office\Recent\file.LNK]- [targetUID: 00000000-00003532] "53787DC6.wmf" has type "Windows metafile"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.MSO\53787DC6.wmf]- [targetUID: 00000000-00003532] "index.dat" has type "data"- Location: [%APPDATA%\Microsoft\Office\Recent\index.dat]- [targetUID: 00000000-00003532] "29548099.wmf" has type "Windows metafile"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.MSO\29548099.wmf]- [targetUID: 00000000-00003532] "~_Normal.dotm" has type "data"- [targetUID: 00000000-00003532]29:T486,Found string "FindNextUrlCacheEntryW" (Indicator: "FindNextUrlCacheEntry"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found string "FindFirstUrlCacheEntryW" (Indicator: "FindFirstUrlCacheEntry"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found string "FindNextUrlCacheEntryA" (Indicator: "FindNextUrlCacheEntry"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found string "FindFirstUrlCacheEntryA" (Indicator: "FindFirstUrlCacheEntry"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found string "FindNextUrlCacheEntryExA" (Indicator: "FindNextUrlCacheEntry"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found string "FindNextUrlCacheEntryExW" (Indicator: "FindNextUrlCacheEntry"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found string "FindFirstUrlCacheEntryExA" (Indicator: "FindFirstUrlCacheEntry"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp") Found string "FindFirstUrlCacheEntryExW" (Indicator: "FindFirstUrlCacheEntry"; Source: "00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp")2a:T4f5,Pattern match: "https://lm-career.com/careeroppr.docx" Heuristic match: "_x+J?ESG)C?d{Z}SmByUBX$0C'RJ}(|1KkWpQ$T,)faB1O_>,\3IOy*=@[-FZ].mq" Heuristic match: "O+`5.g'd(vxuIsK_/>'WP(K~; object into your document.Inserts a new object into your document as an icon.Inserts the contents of the file into your document so that you can edit it later using the application which created the source file.Inserts an icon that represents the contents of the file into your document.Inserts the contents of the file into your document and creates a shortcut to the source file. Changes to the source file will be reflected in your document.Inserts an icon that represents the contents of the file into your document. Changes to the source file will be reflected in your document." (Source: 00000000-00006164.00000000.77298.04A50000.00000002.mdmp, 00000000-00006164.00000001.79221.04A50000.00000002.mdmp, Indicator: "inserts a new object into your document.inserts a new object into your document as an icon.inserts the contents of the file into your document so that you can edit it later using the application which created the source file.inserts an icon that represents the contents of the file into your document.inserts the contents of the file into your document and creates a shortcut to the source file. changes to the source file will be reflected in your document.inserts an icon that represents the contents of the file into your document. changes to the source file will be reflected in your document.") "Inserts the contents of the Clipboard into your document so that you can edit it using ." (Source: 00000000-00006164.00000000.77298.04A50000.00000002.mdmp, 00000000-00006164.00000001.79221.04A50000.00000002.mdmp, Indicator: "inserts the contents of the clipboard into your document so that you can edit it using .")35:T3793,"\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0A4B5474-4226-4D28-B4FC-369CC68A7211}" in Source: 00000000-00006164.00000000.77298.003C4000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006164.00000000.77298.02780000.00000004.mdmp "\Software\Classes\CLSID\{4834AC27-23F1-420A-888D-85" in Source: 00000000-00006164.00000000.77298.02780000.00000004.mdmp "\Registry\Machine\Software\Class" in Source: 00000000-00006164.00000000.77298.02780000.00000004.mdmp "346-0000-00\Registry\Machine\Software\Classes\WOW64`" in Source: 00000000-00006164.00000000.77298.02780000.00000004.mdmp "1-735145574-\Registry\Machine\Software\Classes\WOW6" in Source: 00000000-00006164.00000000.77298.02780000.00000004.mdmp "de\CLSID\{00000346-0000-00\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\c" in Source: 00000000-00006164.00000000.77298.02780000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{0A9BBB1E-03EE-4201-9900-ABBFF56C9C6C}" in Source: 00000000-00006164.00000000.77298.02780000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00006164.00000000.77298.439B0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00006164.00000000.77298.439B0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00006164.00000000.77298.439B0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00006164.00000000.77298.439B0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00006164.00000000.77298.439B0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00006164.00000000.77298.439B0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00006164.00000000.77298.439B0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00006164.00000000.77298.439B0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00006164.00000000.77298.439B0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00006164.00000000.77298.439B0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00006164.00000000.77298.439B0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00006164.00000000.77298.439B0000.00000002.mdmp "Software\Microsoft\Office\14.0\Word" in Source: 00000000-00006164.00000000.77298.43FB3000.00000002.mdmp "-1-5-20\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\Policies" in Source: 00000000-00006164.00000000.77298.6C031000.00000020.mdmp "SOFTWARE\IM Providers" in Source: 00000000-00006164.00000000.77298.B7284000.00000004.mdmp "Software\Microsoft\Office\14.0\Word\Resiliency" in Source: 00000000-00006164.00000000.77298.B72BA000.00000004.mdmp "Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery" in Source: 00000000-00006164.00000000.77298.B72BA000.00000004.mdmp "Software\Microsoft\Office\11.0\Common\Scan" in Source: 00000000-00006164.00000000.77298.B7329000.00000004.mdmp "Software\Microsoft\Office\12.0\Common\ObjectBlocking" in Source: 00000000-00006164.00000000.77298.C19E1000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback" in Source: 00000000-00006164.00000000.77298.C19E1000.00000002.mdmp "SOFTWARE\Microsoft\Office Test\Special\Perf" in Source: 00000000-00006164.00000000.77298.C2160000.00000002.mdmp "Software\Microsoft\Direct3D\Warp" in Source: 00000000-00006164.00000000.77298.C2160000.00000002.mdmp "Software\Microsoft\Direct3D\Warp9" in Source: 00000000-00006164.00000000.77298.C2160000.00000002.mdmp "Software\Microsoft\Security" in Source: 00000000-00006164.00000000.77298.C2160000.00000002.mdmp "Software\Policies\Microsoft\Security" in Source: 00000000-00006164.00000000.77298.C2160000.00000002.mdmp "35145574-\Registry\Machine\Software\Classes\WOW6432Node\c" in Source: 00000000-00006164.00000001.79221.02780000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006164.00000001.79221.02780000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00006164.00000001.79221.02780000.00000004.mdmp " \Software\Mi" in Source: 00000000-00006164.00000001.79221.045B0000.00000004.mdmp "Software\Microsoft\Office\14.0\Common\ProductVersion" in Source: 00000000-00006164.00000001.79221.0B680000.00000004.mdmp "csSoftware\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00006164.00000001.79221.0CEB0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00006164.00000001.79221.0E730000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00006164.00000001.79221.0E7D8000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00006164.00000001.79221.0E7D8000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00" in Source: 00000000-00006164.00000001.79221.0E7D8000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{88d96a0f-f192-11d4-a65f-0040963251e5}" in Source: 00000000-00006164.00000001.79221.0E7D8000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{88D96A07-F192-11D4-A65F-0040963251E5}" in Source: 00000000-00006164.00000001.79221.0E7D8000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}" in Source: 00000000-00006164.00000001.79221.0E7D8000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}" in Source: 00000000-00006164.00000001.79221.0E7D8000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00006164.00000001.79221.0E7D8000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{AFC20920-DA4E-11CE-B943-00AA006887B4}" in Source: 00000000-00006164.00000001.79221.0E7D8000.00000004.mdmp "y\Machine\Software\Classes\TypeLib\{AA7E98C3-8138-47AF-BA54-D7FCDAEBE6B9}\2.0\0\win32" in Source: 00000000-00006164.00000001.79221.0E7D8000.00000004.mdmp "y\Machine\Software\Classes\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\ProxyStubClsid32" in Source: 00000000-00006164.00000001.79221.0E7D8000.00000004.mdmp "mplexType name="CT_ControlBase">

object into your document.Inserts a new object into your document as an icon.Inserts the contents of the file into your document so that you can edit it later using the application which created the source file.Inserts an icon that represents the contents of the file into your document.Inserts the contents of the file into your document and creates a shortcut to the source file. Changes to the source file will be reflected in your document.Inserts an icon that represents the contents of the file into your document. Changes to the source file will be reflected in your document." (Source: 00000000-00006164.00000000.77298.04A50000.00000002.mdmp, 00000000-00006164.00000001.79221.04A50000.00000002.mdmp, Indicator: "inserts a new object into your document.inserts a new object into your document as an icon.inserts the contents of the file into your document so that you can edit it later using the application which created the source file.inserts an icon that represents the contents of the file into your document.inserts the contents of the file into your document and creates a shortcut to the source file. changes to the source file will be reflected in your document.inserts an icon that represents the contents of the file into your document. changes to the source file will be reflected in your document.") "Inserts the contents of the Clipboard into your document so that you can edit it using ." (Source: 00000000-00006164.00000000.77298.04A50000.00000002.mdmp, 00000000-00006164.00000001.79221.04A50000.00000002.mdmp, Indicator: "inserts the contents of the clipboard into your document so that you can edit it using .")38:T1121,Observed system executable string:"%WINDIR%\system32\ADVAPI32.DLL" [Source: 00000000-00006164-00000C1E-43106334] Observed system executable string:"%WINDIR%\system32\KERNEL32.DLL" [Source: 00000000-00006164-00000C1E-43563546] Observed system executable string:"%WINDIR%\system32\mscoree.dll" [Source: 00000000-00006164-00000C1E-43988670] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006164-00000C1E-44345556] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006164-00000C1E-53099240] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00006164-00000C1E-55895416] Observed system executable string:"%WINDIR%\system32\FM20.DLL" [Source: 00000000-00006164-00000BC1-62650883] Observed system executable string:"%WINDIR%\system32\fm20ENU.DLL" [Source: 00000000-00006164-00000C1E-62754764] Observed system executable string:"C:\windows\temp\VxSSL64.dll" [Source: 00000000-00006164.00000000.77298.002B0000.00000020.mdmp 00000000-00006164.00000001.79221.002B0000.00000020.mdmp] Observed system executable string:"C:\WINDOWS\system32\sxsoa.dll" [Source: 00000000-00006164.00000000.77298.003E0000.00000002.mdmp 00000000-00006164.00000001.79221.003E0000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\GdiPlus.dll" [Source: 00000000-00006164.00000000.77298.003E0000.00000002.mdmp 00000000-00006164.00000001.79221.003E0000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\comctl32.dll" [Source: 00000000-00006164.00000000.77298.003E0000.00000002.mdmp 00000000-00006164.00000001.79221.003E0000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\sxsoaps.dll" [Source: 00000000-00006164.00000000.77298.003E0000.00000002.mdmp 00000000-00006164.00000001.79221.003E0000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\comctl32.dll.mui" [Source: 00000000-00006164.00000000.77298.003E0000.00000002.mdmp 00000000-00006164.00000001.79221.003E0000.00000002.mdmp] Observed system executable string:"Microsoft.Windows.Installer.Engine,processorArchitecture="*",type="win32",version="5.1.0.0"C:\Windows\System32\msi.dll" [Source: 00000000-00006164.00000000.77298.02700000.00000002.mdmp 00000000-00006164.00000001.79221.02700000.00000002.mdmp] Observed system executable string:"C:\windows\temp\VxOle64.dll" [Source: 00000000-00006164.00000000.77298.02730000.00000020.mdmp 00000000-00006164.00000000.77298.02750000.00000002.mdmp 00000000-00006164.00000001.79221.02730000.00000020.mdmp 00000000-00006164.00000001.79221.02750000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\Temp\VxSSL64.dll" [Source: 00000000-00006164.00000000.77298.02740000.00000002.mdmp 00000000-00006164.00000001.79221.02740000.00000002.mdmp] Observed system executable string:":\WINDOWS\SYSTEM32\ntdll.dll" [Source: 00000000-00006164.00000000.77298.02780000.00000004.mdmp 00000000-00006164.00000001.79221.02780000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\KERNEL32.DLL" [Source: 00000000-00006164.00000000.77298.02780000.00000004.mdmp 00000000-00006164.00000001.79221.02780000.00000004.mdmp] Observed system executable string:":\WINDOWS\SYSTEM32\apphelp.dll" [Source: 00000000-00006164.00000000.77298.02780000.00000004.mdmp 00000000-00006164.00000001.79221.02780000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\KERNELBASE.dll" [Source: 00000000-00006164.00000000.77298.02780000.00000004.mdmp 00000000-00006164.00000001.79221.02780000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\ADVAPI32.dll" [Source: 00000000-00006164.00000000.77298.02780000.00000004.mdmp 00000000-00006164.00000001.79221.02780000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\sechost.dll" [Source: 00000000-00006164.00000000.77298.02780000.00000004.mdmp 00000000-00006164.00000001.79221.02780000.00000004.mdmp] Observed system executable string:":\WINDOWS\SYSTEM32\MPR.dll" [Source: 00000000-00006164.00000000.77298.02780000.00000004.mdmp 00000000-00006164.00000001.79221.02780000.00000004.mdmp] Observed system executable string:":\WINDOWS\SYSTEM32\AcSpecfc.DLL" [Source: 00000000-00006164.00000000.77298.02780000.00000004.mdmp 00000000-00006164.00000001.79221.02780000.00000004.mdmp]39:Tc6cd,"WINWORD.EXE" trying to touch file "C:\Windows\System32\apphelp.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" "WINWORD.EXE" trying to touch file "C:\Windows\System32\ntdll.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\kernel32.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\KernelBase.dll" "WINWORD.EXE" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "WINWORD.EXE" trying to touch file "C:\Windows\System32\AcSpecfc.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\msi.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\winspool.drv" "WINWORD.EXE" trying to touch file "C:\Windows\System32\bcrypt.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\IPHLPAPI.DLL" "WINWORD.EXE" trying to touch file "C:\Windows\System32\AcGenral.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\sspicli.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\userenv.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\mpr.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\msvcrt.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\rpcrt4.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\sechost.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\advapi32.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\ucrtbase.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\bcryptprimitives.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\combase.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\msvcp_win.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\win32u.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\user32.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\gdi32full.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\gdi32.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\ole32.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\cfgmgr32.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\SHCore.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\shlwapi.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\kernel.appcore.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\powrprof.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\profapi.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\windows.storage.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\shell32.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\imm32.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\oleaut32.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE.LOCAL" "WINWORD.EXE" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9317_none_08e0939fa840d57b\msvcr90.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\ninput.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\FLTLIB.DLL" "WINWORD.EXE" trying to touch file "C:\Windows\System32\fltLib.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\ws2_32.dll" "WINWORD.EXE" trying to touch file "C:\windows\temp\VxOle64.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\kernelbase.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE.3.MANIFEST" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE.Local\" "WINWORD.EXE" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_8879e63c4abacc42\comctl32.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_8879e63c4abacc42\Comctl32.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\WWLIB.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\wwlib.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\GFX.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\gfx.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\OART.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\oart.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\WTSAPI32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\WTSAPI32.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\wtsapi32.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\WTSAPI32.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\MSIMG32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\MSIMG32.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\msimg32.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\MSIMG32.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\OFFICE14\MSO.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\Microsoft Shared\office14\mso.dll" "WINWORD.EXE" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_15ced204935f55d7\comctl32.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_15ced204935f55d7\Comctl32.dll" "WINWORD.EXE" trying to touch file "C:\Windows\WindowsShell.Manifest" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Local\Temp" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\CVR6142.tmp" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\Microsoft Shared\office14\Cultures\office.odf" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\1033\WWINTL.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\1033\wwintl.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\uxtheme.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\system32\uxtheme.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\dwmapi.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\system32\dwmapi.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\OFFICE14\1033\MSOINTL.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\Microsoft Shared\office14\1033\MSOINTL.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\OFFICE14\MSORES.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\Microsoft Shared\office14\MSORES.DLL" "WINWORD.EXE" trying to touch file "C:\Windows\System32\rpcss.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\system32\rpcss.dll" "WINWORD.EXE" trying to touch file "C:\Windows\Globalization\Sorting\SortDefault.nls" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\SRPAPI.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\srpapi.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\srpapi.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\srpapi.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\msasn1.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\crypt32.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\OFFICE14\MSPTLS.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSPTLS.DLL" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Roaming" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Roaming\Microsoft\Templates\" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Roaming\Microsoft\Templates" "WINWORD.EXE" trying to touch file "C:\Windows\System32\msctf.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\OFFICE14\RICHED20.DLL" "WINWORD.EXE" trying to touch file "C:\Windows\System32\mscoree.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\system32\mscoree.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "WINWORD.EXE" trying to touch file "C:\WINDOWS\system32\mscoree.dll.local" "WINWORD.EXE" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" "WINWORD.EXE" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "WINWORD.EXE" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" "WINWORD.EXE" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE.CONFIG" "WINWORD.EXE" trying to touch file "C:\Windows\System32\version.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\VERSION.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL" "WINWORD.EXE" trying to touch file "C:\Windows\System32\clbcatq.dll" "WINWORD.EXE" trying to touch file "C:\Windows\Registration\R00000000000d.clb" "WINWORD.EXE" trying to touch file "C:\Windows\System32\netprofm.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\System32\netprofm.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\npmproxy.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\System32\npmproxy.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\nsi.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\dhcpcsvc6.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\dhcpcsvc6.DLL" "WINWORD.EXE" trying to touch file "C:\Windows\System32\dhcpcsvc.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\dhcpcsvc.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\NORMAL.DOTM" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\Normal.dotm" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Templates\Normal.dotm" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Roaming\Microsoft\Templates\Normal.dotm" "WINWORD.EXE" trying to touch file "C:\Windows\System32\sxs.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\sxs.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\coml2.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_5.1811.27012.0_x64__8wekyb3d8bbwe\ShellPreviewHandler3D.dll" "WINWORD.EXE" trying to touch file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\MpOAV.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\system32\version.dll" "WINWORD.EXE" trying to touch file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL" "WINWORD.EXE" trying to touch file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\MpClient.dll" "WINWORD.EXE" trying to touch file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SLC.DLL" "WINWORD.EXE" trying to touch file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\SLC.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\slc.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\SLC.dll" "WINWORD.EXE" trying to touch file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SPPC.DLL" "WINWORD.EXE" trying to touch file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\sppc.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\sppc.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\sppc.dll" "WINWORD.EXE" trying to touch file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\MsMpLics.dll" "WINWORD.EXE" trying to touch file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\gpapi.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\gpapi.dll" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Local" "WINWORD.EXE" trying to touch file "C:\ProgramData" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\Desktop" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000002d.db" "WINWORD.EXE" trying to touch file "C:\Users\desktop.ini" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\Desktop\desktop.ini" "WINWORD.EXE" trying to touch file "C:\share" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Templates\~$NORMAL.DOTM" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Roaming\Microsoft\Templates\~$Normal.dotm" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Templates\~$Normal.dotm" "WINWORD.EXE" trying to touch file "C:\Windows\System32\msxml6.dll" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Local\Microsoft\Windows\INetCache" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Local\Microsoft\Windows\INetCache\Content.Word" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{90A75B66-9EF9-485D-848A-B45C5F142FDB}.TMP" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{90A75B66-9EF9-485D-848A-B45C5F142FDB}.tmp" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{90A75B66-9EF9-485D-848A-B45C5F142FDB}.tmp" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Local\Microsoft\Office\" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Roaming\" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Roaming\Microsoft\AddIns\" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Word\STARTUP" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Roaming\Microsoft\Word\STARTUP\" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Roaming\Microsoft\Word" "WINWORD.EXE" trying to touch file "C:\file.doc" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Local\Microsoft\Windows\INetCookies" "WINWORD.EXE" trying to touch file "C:\" "WINWORD.EXE" trying to touch file "C:\WINDOWS\system32\kernel32.dll" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF45ED53E4BD96CBD8.TMP" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\GKWord.dll" "WINWORD.EXE" trying to touch file "C:\Windows\Fonts\StaticCache.dat" "WINWORD.EXE" trying to touch file "C:\Windows\System32\DataExchange.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\system32\dataexchange.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\d3d11.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\system32\d3d11.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\dcomp.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\system32\dcomp.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\dxgi.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\system32\dxgi.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\twinapi.appcore.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\system32\twinapi.appcore.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\rmclient.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\system32\RMCLIENT.dll" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Roaming\Microsoft\Office\Recent\" "WINWORD.EXE" trying to touch file "C:\file.doc:Zone.Identifier" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Office\Recent\FILE.DOC" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Office\Recent\FILE.DOC.LNK" "WINWORD.EXE" trying to touch file "C:\Windows\System32\policymanager.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\policymanager.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\msvcp110_win.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\msvcp110_win.dll" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Roaming\Microsoft\Office\Recent\file.doc.LNK" "WINWORD.EXE" trying to touch file "C:\Windows\System32\linkinfo.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\LINKINFO.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\ntshrui.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\ntshrui.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\srvcli.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\srvcli.dll" "WINWORD.EXE" trying to touch file "\Device\NamedPipe\srvsvc" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\Documents\desktop.ini" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\Music\desktop.ini" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\CSCAPI.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\cscapi.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\cscapi.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\cscapi.dll" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\Pictures\desktop.ini" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\Videos\desktop.ini" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\Downloads\desktop.ini" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\VBA\VBA7\VBE7.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\VBA\VBA7\1033\VBE7INTL.DLL" "WINWORD.EXE" trying to touch file "C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA7\1033\VBE7INTL.DLL" "WINWORD.EXE" trying to touch file "C:\Windows\System32\C_932.NLS" "WINWORD.EXE" trying to touch file "C:\WINDOWS\system32\c_949.nls" "WINWORD.EXE" trying to touch file "C:\WINDOWS\system32\c_950.nls" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{F1944F34-3D8C-49C2-B718-B4942E142A9E}.TMP" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{F1944F34-3D8C-49C2-B718-B4942E142A9E}.tmp" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{F1944F34-3D8C-49C2-B718-B4942E142A9E}.tmp" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\Word8.0\MSForms.exd" "WINWORD.EXE" trying to touch file "C:\Windows\System32\FM20.DLL" "WINWORD.EXE" trying to touch file "C:\Windows\System32\FM20ENU.DLL" "WINWORD.EXE" trying to touch file "C:\WINDOWS\system32\fm20ENU.DLL" "WINWORD.EXE" trying to touch file "C:\Windows\System32\TextInputFramework.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\System32\TextInputFramework.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\CoreUIComponents.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\System32\CoreUIComponents.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\CoreMessaging.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\System32\CoreMessaging.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\WinTypes.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\wintypes.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\user32.dll" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Local\Microsoft\Windows\INetCache\Content.MSO" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\4DAA6CA8.WMF" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\4DAA6CA8.wmf" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\4DAA6CA8.wmf" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\755A7489.WMF" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\755A7489.wmf" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\755A7489.wmf" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\SCHEMAS\MS WORD_RESTART.XML" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Local\Microsoft\Schemas\MS Word_restart.xml" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Local" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Office\WORD14.CUSTOMUI" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Local\Microsoft\Office\Word14.customUI" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Local\" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Office\Word14.customUI" "WINWORD.EXE" trying to touch file "C:\Windows\System32\edputil.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\edputil.dll" "WINWORD.EXE" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.16299.248_none_46b9c4e9edf1cfa5\GdiPlus.dll" "WINWORD.EXE" trying to touch file "C:\WINDOWS\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.16299.248_none_46b9c4e9edf1cfa5\GdiPlus.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\USP10.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\usp10.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\OFFICE14\USP10.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7ES.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\OFFICE14\PROOF\MSSP7ES.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7ES.LEX" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\OFFICE14\PROOF\MSSP7ES.LEX" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7FR.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\OFFICE14\PROOF\MSSP7FR.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7FR.LEX" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\OFFICE14\PROOF\MSSP7FR.LEX" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7EN.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\OFFICE14\PROOF\MSSP7EN.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7EN.LEX" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\OFFICE14\PROOF\MSSP7EN.LEX" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\CSS7DATA000A.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\OFFICE14\CSS7DATA000A.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\NL7MODELS000A.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\OFFICE14\NL7MODELS000A.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\CSS7DATA000C.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\OFFICE14\CSS7DATA000C.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\NL7MODELS000C.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\OFFICE14\NL7MODELS000C.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\CSS7DATA0009.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\OFFICE14\CSS7DATA0009.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\NL7MODELS0009.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\OFFICE14\NL7MODELS0009.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\MSSP3??.DLL" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Roaming\Microsoft\Proof\" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Roaming\Microsoft\Proof" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\Microsoft Shared\" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\Microsoft Shared" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\MSSP??32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\mssp??32.dll" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Proof\MSSP??32.DLL" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Roaming\Microsoft\Proof\mssp??32.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\MSSP??32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\Microsoft Shared\mssp??32.dll" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Proof\MSGR2??.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\MSGR2??.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\MSGR2??.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\Microsoft Shared\msgr2??.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\msgr??32.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\MSGR??32.DLL" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Proof\MSGR??32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\MSGR??32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\Microsoft Shared\msgr??32.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\GRAM??32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\gram??32.dll" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Proof\GRAM??32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\GRAM??32.DLL" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Roaming\Microsoft\Proof\gram??32.dll" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Roaming\Microsoft\Proof\msgr??32.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\MSTH3??.DLL" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Proof\MSTH3??.DLL" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Roaming\Microsoft\Proof\msth3??.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\MSTH3??.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\MSTH32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\MSTH32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\Microsoft Shared\msth32.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\MSTH??32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\MSTH232.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\msth232.dll" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Proof\MSTH232.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\MSTH232.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\MSHY3??.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\mshy3??.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\HYPH??32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\hyph??32.dll" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Proof\HYPH??32.DLL" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Roaming\Microsoft\Proof\hyph??32.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\HYPH??32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\Microsoft Shared\hyph??32.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\MSHY32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\mshy32.dll" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Proof\MSHY32.DLL" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Roaming\Microsoft\Proof\mshy32.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\MSHY32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\Microsoft Shared\mshy32.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\HYPH32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\HYPH32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\HHC32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\hhc32.dll" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Proof\HHC32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\HHC32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\Microsoft Shared\hhc32.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\MSDCSC32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\msdcsc32.dll" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Proof\MSDCSC32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\MSDCSC32.DLL" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\Microsoft Shared\msdcsc32.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\msproof7.dll" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\AppData\Roaming\Microsoft\UProof\" "WINWORD.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\WMVCORE.DLL" "WINWORD.EXE" trying to touch file "C:\Windows\System32\WMVCORE.DLL" "WINWORD.EXE" trying to touch file "C:\WINDOWS\SYSTEM32\WMVCORE.DLL" "WINWORD.EXE" trying to touch file "C:\Users\akVtE6T\Documents\" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\Wordcnvpxy.cnv" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\TextConv\Wks9Pxy.cnv" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\Microsoft Shared\TEXTCONV\Wks9Pxy.cnv" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\TextConv\RECOVR32.CNV" "WINWORD.EXE" trying to touch file "C:\PROGRA~1\COMMON~1\MICROS~1\TEXTCONV\RECOVR32.CNV" "WINWORD.EXE" trying to touch file "C:\Program Files\Common Files\microsoft shared\TextConv\WPFT632.CNV" "WINWORD.EXE" trying to touch file "C:\Windows\System32\mfperfhelper.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\ONBttnWD.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\WMASF.DLL" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\apphelp.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\ntdll.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\apppatch\sysmain.sdb" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\AcSpecfc.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\AcGenral.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\msvcrt.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\rpcrt4.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\sechost.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\advapi32.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\ucrtbase.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\bcryptprimitives.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\combase.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\msvcp_win.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\win32u.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\gdi32full.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\gdi32.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\cfgmgr32.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\SHCore.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\shlwapi.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\kernel.appcore.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\powrprof.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\profapi.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\windows.storage.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\shell32.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\bcrypt.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\msi.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\IPHLPAPI.DLL" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\winspool.drv" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\sspicli.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\userenv.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\mpr.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\imm32.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9317_none_08e0939fa840d57b\msvcr90.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\oleaut32.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\ninput.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\ole32.dll" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\FLTLIB.DLL" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\ws2_32.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\fltLib.dll" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\WINWORD.EXE.3.MANIFEST" "WINWORD.EXE" trying to touch file "%WINDIR%\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_8879e63c4abacc42\comctl32.dll" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\WTSAPI32.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\MSIMG32.DLL" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\wtsapi32.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\msimg32.dll" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\GFX.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\OART.DLL" "WINWORD.EXE" trying to touch file "%WINDIR%\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_15ced204935f55d7\comctl32.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\WindowsShell.Manifest" "WINWORD.EXE" trying to touch file "%TEMP%\CVR6142.tmp" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\OFFICE14\Cultures\OFFICE.ODF" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\1033\WWINTL.DLL" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\uxtheme.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\dwmapi.dll" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\OFFICE14\1033\MSOINTL.DLL" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\OFFICE14\MSORES.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\WINWORD.EXE" "WINWORD.EXE" trying to touch file "%WINDIR%\Globalization\Sorting\SortDefault.nls" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\SRPAPI.DLL" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\msasn1.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\crypt32.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\srpapi.dll" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\OFFICE14\MSPTLS.DLL" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\msctf.dll" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\OFFICE14\RICHED20.DLL" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\mscoree.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\MSCOREE.DLL.LOCAL" "WINWORD.EXE" trying to touch file "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "WINWORD.EXE" trying to touch file "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\WINWORD.EXE.CONFIG" "WINWORD.EXE" trying to touch file "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\clbcatq.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\Registration\R00000000000d.clb" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\netprofm.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\rpcss.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\npmproxy.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\nsi.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\dhcpcsvc6.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\dhcpcsvc.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\sxs.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\coml2.dll" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\WindowsApps\Microsoft.Microsoft3DViewer_5.1811.27012.0_x64__8wekyb3d8bbwe\ShellPreviewHandler3D.dll" "WINWORD.EXE" trying to touch file "%ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\MpOAV.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\gpapi.dll" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\NORMAL.DOTM" "WINWORD.EXE" trying to touch file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "WINWORD.EXE" trying to touch file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "WINWORD.EXE" trying to touch file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000002d.db" "WINWORD.EXE" trying to touch file "%USERPROFILE%\Desktop\desktop.ini" "WINWORD.EXE" trying to touch file "%APPDATA%\Microsoft\DESKTOP.INI" "WINWORD.EXE" trying to touch file "%APPDATA%\Microsoft\Templates\~$NORMAL.DOTM" "WINWORD.EXE" trying to touch file "%APPDATA%\Microsoft\Templates\~$Normal.dotm" "WINWORD.EXE" trying to touch file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.Word\~WRS{90A75B66-9EF9-485D-848A-B45C5F142FDB}.TMP" "WINWORD.EXE" trying to touch file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.Word\~WRS{90A75B66-9EF9-485D-848A-B45C5F142FDB}.tmp" "WINWORD.EXE" trying to touch file "%APPDATA%\Microsoft\Word\STARTUP" "WINWORD.EXE" trying to touch file "%ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\MpClient.dll" "WINWORD.EXE" trying to touch file "%ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SLC.DLL" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\slc.dll" "WINWORD.EXE" trying to touch file "%ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SPPC.DLL" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\sppc.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\version.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\kernel32.dll" "WINWORD.EXE" trying to touch file "%ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\MsMpLics.dll" "WINWORD.EXE" trying to touch file "%TEMP%\~DF45ED53E4BD96CBD8.TMP" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\GKWord.dll" "WINWORD.EXE" trying to touch file "C:\~$FILE.DOC" "WINWORD.EXE" trying to touch file "C:\~$file.doc" "WINWORD.EXE" trying to touch file "%WINDIR%\SysWOW64\propsys.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\propsys.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\en-US\propsys.dll.mui" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\dxgi.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\d3d11.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\dcomp.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\DataExchange.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\rmclient.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\twinapi.appcore.dll" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\WWLIB.DLL" "WINWORD.EXE" trying to touch file "%APPDATA%\Microsoft\Office\Recent\FILE.DOC" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\msvcp110_win.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\policymanager.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\linkinfo.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\ntshrui.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\KernelBase.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\srvcli.dll" "WINWORD.EXE" trying to touch file "%USERPROFILE%\Documents\desktop.ini" "WINWORD.EXE" trying to touch file "%USERPROFILE%\Music\desktop.ini" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\CSCAPI.DLL" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\cscapi.dll" "WINWORD.EXE" trying to touch file "%APPDATA%\Microsoft\Office\Recent\FILE.DOC.LNK" "WINWORD.EXE" trying to touch file "%APPDATA%\Microsoft\Office\Recent\file.doc.LNK" "WINWORD.EXE" trying to touch file "%USERPROFILE%\Pictures\desktop.ini" "WINWORD.EXE" trying to touch file "%USERPROFILE%\Videos\desktop.ini" "WINWORD.EXE" trying to touch file "%USERPROFILE%\Downloads\desktop.ini" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\VBA\VBA7\VBE7.DLL" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\VBA\VBA7\1033\VBE7INTL.DLL" "WINWORD.EXE" trying to touch file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.Word\~WRF{F1944F34-3D8C-49C2-B718-B4942E142A9E}.TMP" "WINWORD.EXE" trying to touch file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.Word\~WRF{F1944F34-3D8C-49C2-B718-B4942E142A9E}.tmp" "WINWORD.EXE" trying to touch file "%APPDATA%\Microsoft\Templates\Normal.dotm" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\stdole2.tlb" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\FM20ENU.DLL" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\TextInputFramework.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\CoreUIComponents.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\CoreMessaging.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\WinTypes.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\user32.dll" "WINWORD.EXE" trying to touch file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.MSO\4DAA6CA8.WMF" "WINWORD.EXE" trying to touch file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.MSO\4DAA6CA8.wmf" "WINWORD.EXE" trying to touch file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.MSO\755A7489.WMF" "WINWORD.EXE" trying to touch file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.MSO\755A7489.wmf" "WINWORD.EXE" trying to touch file "%LOCALAPPDATA%\Microsoft\SCHEMAS\MS WORD_RESTART.XML" "WINWORD.EXE" trying to touch file "%LOCALAPPDATA%\Microsoft\Office\WORD14.CUSTOMUI" "WINWORD.EXE" trying to touch file "%LOCALAPPDATA%\Microsoft\Office\Word14.customUI" "WINWORD.EXE" trying to touch file "%WINDIR%\Fonts\StaticCache.dat" "WINWORD.EXE" trying to touch file "%USERPROFILE%\AppData\Local" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\edputil.dll" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\OFFICE14\MSO.DLL" "WINWORD.EXE" trying to touch file "%WINDIR%\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.16299.248_none_46b9c4e9edf1cfa5\GdiPlus.dll" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\USP10.DLL" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\OFFICE14\USP10.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\PROOF\MSSP7ES.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\PROOF\MSSP7ES.LEX" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\PROOF\MSSP7FR.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\PROOF\MSSP7FR.LEX" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\PROOF\MSSP7EN.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\PROOF\MSSP7EN.LEX" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\CSS7DATA000A.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\NL7MODELS000A.dll" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\CSS7DATA000C.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\NL7MODELS000C.dll" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\CSS7DATA0009.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\NL7MODELS0009.dll" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\MSSP??32.DLL" "WINWORD.EXE" trying to touch file "%APPDATA%\Microsoft\Proof\MSSP??32.DLL" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\MSSP??32.DLL" "WINWORD.EXE" trying to touch file "%APPDATA%\Microsoft\Proof\MSGR2??.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\MSGR2??.DLL" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\MSGR??32.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\GRAM??32.DLL" "WINWORD.EXE" trying to touch file "%APPDATA%\Microsoft\Proof\GRAM??32.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\MSGR??32.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\MSTH3??.DLL" "WINWORD.EXE" trying to touch file "%APPDATA%\Microsoft\Proof\MSTH3??.DLL" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\MSTH3??.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\MSTH32.DLL" "WINWORD.EXE" trying to touch file "%APPDATA%\Microsoft\Proof\MSTH32.DLL" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\MSTH??32.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\MSTH232.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\MSHY3??.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\HYPH??32.DLL" "WINWORD.EXE" trying to touch file "%APPDATA%\Microsoft\Proof\HYPH??32.DLL" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\HYPH??32.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\HYPH32.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\MSHY32.DLL" "WINWORD.EXE" trying to touch file "%APPDATA%\Microsoft\Proof\MSHY32.DLL" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\MSHY32.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\HHC32.DLL" "WINWORD.EXE" trying to touch file "%APPDATA%\Microsoft\Proof\HHC32.DLL" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\HHC32.DLL" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\MSDCSC32.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\WINWORD.EXE.LOCAL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\msproof7.dll" "WINWORD.EXE" trying to touch file "%USERPROFILE%\AppData\Roaming" "WINWORD.EXE" trying to touch file "%APPDATA%\Microsoft\UProof\CUSTOM.DIC" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\WMVCORE.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\WMASF.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\MFPERFHELPER.DLL" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\WMASF.DLL" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\mfperfhelper.dll" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\WMVCORE.DLL" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\MFPLAT.DLL" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\mfplat.dll" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\RTWORKQ.DLL" "WINWORD.EXE" trying to touch file "%WINDIR%\System32\RTWorkQ.dll" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\TextConv\RECOVR32.CNV" "WINWORD.EXE" trying to touch file "%PROGRAMFILES%\Microsoft Office\Office14\Wordcnvpxy.cnv" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\TextConv\WPFT632.CNV" "WINWORD.EXE" trying to touch file "%COMMONPROGRAMFILES%\microsoft shared\TextConv\Wks9Pxy.cnv"3a:T715,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTRATIONENABLED"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTERADAPTERNAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPDOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "")3b:T481a,"WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "Q6Y"; Value: "q6y") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LANGUAGERESOURCES\ENABLEDLANGUAGES"; Key: "1033"; Value: "Off") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LANGUAGERESOURCES\ENABLEDLANGUAGES"; Key: "1033"; Value: "4F006E000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004119110000000100000000F01FEC\USAGE"; Key: "WORDFILES"; Value: "0200B756") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004119110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "1600B756") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004119110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "1700B756") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD"; Key: "FONTINFOCACHEW"; Value: "6000000060000000F5FFFFFF000000000000000000000000BC02000000000000004000225400610068006F006D006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000D0000000B0000000200000002000000000000000600000020000000BC0200000000000060000000600000002000FDFF1F0020000000002700000000FF2E00E15B6000C0290000000000000001000000000028200700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000D0000000B000000020000000200000000000000050000001B000000900100000000000060000000600000002000FDFF1F0020000000002700000000FF2E00E15B6000C02900000000000000010000000000282006000000F7FFFFFF0000000000000000000000009001000000000000004000225400610068006F006D006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000B000000090000000200000002000000000000000400000016000000900100000000000060000000600000002000FDFF1F0020000000002700000000FF2E00E15B6000C02900000000000000010000000000282005000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD"; Key: "MTTT"; Value: "141800006E9795B5878DD90100000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: ">CY"; Value: ">cy") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "KFY"; Value: "kfy") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "ULY"; Value: "uly") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\PLACE MRU"; Key: "MAX DISPLAY"; Value: "19000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\PLACE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01D98D87BFFB9E60][O00000000]*C:\") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\FILE MRU"; Key: "MAX DISPLAY"; Value: "19000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\FILE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01D98D87C0005950][O00000000]*C:\file.doc") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{AA7E98C3-8138-47AF-BA54-D7FCDAEBE6B9}\2.0"; Key: "(DEFAULT)"; Value: "Microsoft Forms 2.0 Object Library"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{AA7E98C3-8138-47AF-BA54-D7FCDAEBE6B9}\2.0\FLAGS"; Key: "(DEFAULT)"; Value: "36000000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{AA7E98C3-8138-47AF-BA54-D7FCDAEBE6B9}\2.0\HELPDIR"; Key: "(DEFAULT)"; Value: "%TEMP%\Word8.0"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\TYPELIB\{AA7E98C3-8138-47AF-BA54-D7FCDAEBE6B9}\2.0"; Key: "(DEFAULT)"; Value: "Microsoft Forms 2.0 Object Library"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\TYPELIB\{AA7E98C3-8138-47AF-BA54-D7FCDAEBE6B9}\2.0\FLAGS"; Key: "(DEFAULT)"; Value: "36000000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\TYPELIB\{AA7E98C3-8138-47AF-BA54-D7FCDAEBE6B9}\2.0\0\WIN32"; Key: "(DEFAULT)"; Value: "%TEMP%\Word8.0\MSForms.exd"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{BEF6E003-A874-101A-8BBA-00AA00300CAB}"; Key: "(DEFAULT)"; Value: "Font"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{29B86A70-F52E-11CE-9BCE-00AA00608E01}"; Key: "(DEFAULT)"; Value: "IOptionFrame"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "_UserForm"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}"; Key: "(DEFAULT)"; Value: "ControlEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}"; Key: "(DEFAULT)"; Value: "ControlEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcText"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcCombo"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{944ACF93-A1E6-11CE-8104-00AA00611080}"; Key: "(DEFAULT)"; Value: "Tabs"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "ITabStrip"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "ITabStrip"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{79176FB3-B7F2-11CE-97EF-00AA006D2776}"; Key: "(DEFAULT)"; Value: "ISpinbutton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{4C599243-6926-101B-9992-00000B65C6F9}"; Key: "(DEFAULT)"; Value: "IImage"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLOption"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLOption"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLText"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLText"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLHidden"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLPassword"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLPassword"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLTextArea"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcTextEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}"; Key: "(DEFAULT)"; Value: "TabStripEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{79176FB2-B7F2-11CE-97EF-00AA006D2776}"; Key: "(DEFAULT)"; Value: "SpinbuttonEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{79176FB2-B7F2-11CE-97EF-00AA006D2776}"; Key: "(DEFAULT)"; Value: "SpinbuttonEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{4C5992A5-6926-101B-9992-00000B65C6F9}"; Key: "(DEFAULT)"; Value: "ImageEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{4C5992A5-6926-101B-9992-00000B65C6F9}"; Key: "(DEFAULT)"; Value: "ImageEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents5"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{92E11A03-7358-11CE-80CB-00AA00611080}"; Key: "(DEFAULT)"; Value: "Pages"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}"; Key: "(DEFAULT)"; Value: "MultiPageEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}"; Key: "(DEFAULT)"; Value: "MultiPageEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{0D452EE1-E08F-101A-852E-02608C4D0BB4}\2.0\0\WIN32"; Key: "(DEFAULT)"; Value: "%WINDIR%\system32\FM20.DLL"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\DOCUMENTRECOVERY\143E00D"; Key: "143E00D"; Value: "04000000141800000B00000043003A005C00660069006C0065002E0064006F00630008000000660069006C0065002E0064006F006300000000000100000000000000C2E24397878DD9010DE043010DE0430100000000DB040000000000000000000000000000000000000000000000000000FFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: ";(Y"; Value: ";(y") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\CUSTOMUIVALIDATIONCACHE"; Key: "ONENOTE.WORDADDINTAKENOTESBUTTON.MICROSOFT.WORD.DOCUMENT"; Value: "15A224F3") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "0100B756") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "0200B756") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "0100B756") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "0200B756") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0100B756") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0200B756") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "0300B756") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "0400B756") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "0300B756") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "0400B756") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0300B756") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0400B756") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004119110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "1800B756") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004119110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "1900B756")3c:T938,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGsElEQVR4Xs2W2W9UZRjGSUz8C7j3iph4oZgoGow3aiRgiKiENBJECIugqEDAsIQIFSgUWYrshQJdpystlNIdKEtb6A60dJnpLJ3O0k5n2hk6++P3fGfOdKYU2wsTPcnTmelynt/zvt/7ns6a9X+9imvbEKtrNa0oqm6RKqxqQUFlE/Kp8ibklT9G7q1H0JQ1Ikco+2aDUD2yxKtOZ4bNZsPk+0970XSmVzgspL4KhUJAUCiztB5bD6RKCL3d/mqIraetULXphFlq/ZF+rEnqwXeJT5HweyeW7W7Dkm2NWLLlARZuuiP1yQ/lmLeyMGoszWMAMm48gMkBJGxK/GcIGpfVu6dUbo0rqstlTqlzxcNSJ/PMmLs8b0rzgFB6yT0J0GsJ4OOlP74aQgWIKyuUGwbFl0AwDJ+fCmHcG4JnPAi3Jzg1gHijAly+djcK0Kr14P3Fa6aGYMljAZQbTZj7A2F4ffHmo26/BHgrISMKkNs4Fqe0wjsxAG7UPXHgnQUrX4Zgvwmw80wXfk1ul2Kvi6p00vzDhLPSnGdg+c5HUjwDhzKtUQAC05TXiDuATqMbFwtqUds+hMpmG0obB1F4zwRNjT4KMSUAU1Frd1+XN1u3vwVvLzmGhnaD/P6GxIf4YNUNJKZ2IzmjD29+lRYH8EJUKiQ+NHTacTG/Bqu3HcGKzUlYtnEvFq/egc++3YyPvt4gIaIAPO0E4E14U5rrzR75nqZzFh2WAKwIzWfPXwqH0yt//sai83EATN7YNQSnJ4DcuyZk3zEis9aAzEptVOniPnEAHDWecvabVSCApsom036+7bkEIMiCLY/l+22HUzE04pNVmAyQeceKnDoLrtaYcbRIi3O3jNh7pRlj42G4XoQw4gnhSuUkAM44Adhv9p8AvLlqzn6rpWf6Z7022Bxe+TuzPz0WB5CkeY6UEh0ulA8gpbgf58pMEmD0RRhOAeAYCyGtQjkHUYBvdjRLAI4ZjTiWqjlLz0WkfmZ6mluHvLJaBFAmRgFg8uy6QWTUDuLkdQPO3FQAXAJgxB3CsABILZ8EwBPPBUOAFbvqomYDFofs9fz1zfKzmp7mlqHxCYDI8qHRq+T0hOEQAEOjIZwvM8QDsMQE4KjN+VIjzQoqWuEc9UvxezRPSS9VzG1emK3j2Hq8Aa/PT1IWD/cFFxZ3hlhaL3xhuL1h0fuQ7D3Nh4W5zRXC6VLTywBcreqSoVRzVoAHTi27am6yTABoeNpvG5AhZvxqVT8uV+hw8VYfLtzsxdkbPTh9vVuW3uYKwuIMIuX6QDwAHyoqADfcTMxVgNfe2ydTxyb3xCRX+24X6S3OEMyOII4VTwGgLiBV3HKcc4qnnf2maBorAqjJ0yq08clLnuOva11IKeqEVaQfHAnBNBxEcpE5HoCPVD5UKK5WihuOM07xoKliySkaU7Pmbo+mVnquzLtTzPuwW0mumAeluWEoiIOFlniAqa60wrsYFyWlihssKHo4iIL7ZuTVDSDnrhFZkZ5fiSRPFcnPy+Td0eQnCjtxrOAZjuY9xYAovVGY62wBJOZZpwe4JJ5kHiZT5Y2XW/SYaanRSL+ZWp522fPgRHIHkwfQL8z7xJNxj8Y+A4D82xjz0iQ0kVzs9Syx19Or9XKdppWL5GXxyU/GJP9TJE/OfYLDOR2KuTWAnsEAdmYPTw+QmlcrtxeTxYoLhUkpnnCuVibmguGYWZ1KapZc9tzOsgdl8m5h3jXgx/bMGQBcyK2RDw6aMDmfaGryS2ry0h6cETN+qjgmeX4kueYJDuW0IymrHQcy26Lmz4x+bEkfmR7gvKZaJpPpIgntkXm2if5yo1ldnG0lMeebiY1CeplaKTn/G3pu9qPTpJh3GPz45apzeoCzOVVKSV00U0pL0dAi5lk1VUvNE64XStZ0yOQHs9pk8j8yWpGY3oKnwrxd70drvx8/XXbNACC7UppIo5GAEF+F4bBiqJqyx3qb0metTUnMg9bN1KLkT01K6ja9T5o36/zYcGl0eoAzWZVyfEzDAcVQjJFRiIYGuxgpIZZZZ50odfegXxp3sdxCTww+dIjUbcK4RedDk9aHxl4f1l0cmx7gdGaF7KWq/khfaaiNmvrRG0kr+8xDRuNIr9v7fWgRahbGj/sU8/oeH9akumcGwLLea9Kh7H4f8qu1uHpLi7MlRhwXTzNVR0sGkHzNjKSiQewvsGJfvg17cu1i1ofEuDnkif/5igsbRd/XXxrDGpF+9YUZAJzKKMeGXSfwxfe/yf9i5y1ei3cXrpJ/+G9psud/cv0NW8FnkZfetYIAAAAASUVORK5CYII=3d:T938,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGsElEQVR4Xs2W2W9UZRjGSUz8C7j3iph4oZgoGow3aiRgiKiENBJECIugqEDAsIQIFSgUWYrshQJdpystlNIdKEtb6A60dJnpLJ3O0k5n2hk6++P3fGfOdKYU2wsTPcnTmelynt/zvt/7ns6a9X+9imvbEKtrNa0oqm6RKqxqQUFlE/Kp8ibklT9G7q1H0JQ1Ikco+2aDUD2yxKtOZ4bNZsPk+0970XSmVzgspL4KhUJAUCiztB5bD6RKCL3d/mqIraetULXphFlq/ZF+rEnqwXeJT5HweyeW7W7Dkm2NWLLlARZuuiP1yQ/lmLeyMGoszWMAMm48gMkBJGxK/GcIGpfVu6dUbo0rqstlTqlzxcNSJ/PMmLs8b0rzgFB6yT0J0GsJ4OOlP74aQgWIKyuUGwbFl0AwDJ+fCmHcG4JnPAi3Jzg1gHijAly+djcK0Kr14P3Fa6aGYMljAZQbTZj7A2F4ffHmo26/BHgrISMKkNs4Fqe0wjsxAG7UPXHgnQUrX4Zgvwmw80wXfk1ul2Kvi6p00vzDhLPSnGdg+c5HUjwDhzKtUQAC05TXiDuATqMbFwtqUds+hMpmG0obB1F4zwRNjT4KMSUAU1Frd1+XN1u3vwVvLzmGhnaD/P6GxIf4YNUNJKZ2IzmjD29+lRYH8EJUKiQ+NHTacTG/Bqu3HcGKzUlYtnEvFq/egc++3YyPvt4gIaIAPO0E4E14U5rrzR75nqZzFh2WAKwIzWfPXwqH0yt//sai83EATN7YNQSnJ4DcuyZk3zEis9aAzEptVOniPnEAHDWecvabVSCApsom036+7bkEIMiCLY/l+22HUzE04pNVmAyQeceKnDoLrtaYcbRIi3O3jNh7pRlj42G4XoQw4gnhSuUkAM44Adhv9p8AvLlqzn6rpWf6Z7022Bxe+TuzPz0WB5CkeY6UEh0ulA8gpbgf58pMEmD0RRhOAeAYCyGtQjkHUYBvdjRLAI4ZjTiWqjlLz0WkfmZ6mluHvLJaBFAmRgFg8uy6QWTUDuLkdQPO3FQAXAJgxB3CsABILZ8EwBPPBUOAFbvqomYDFofs9fz1zfKzmp7mlqHxCYDI8qHRq+T0hOEQAEOjIZwvM8QDsMQE4KjN+VIjzQoqWuEc9UvxezRPSS9VzG1emK3j2Hq8Aa/PT1IWD/cFFxZ3hlhaL3xhuL1h0fuQ7D3Nh4W5zRXC6VLTywBcreqSoVRzVoAHTi27am6yTABoeNpvG5AhZvxqVT8uV+hw8VYfLtzsxdkbPTh9vVuW3uYKwuIMIuX6QDwAHyoqADfcTMxVgNfe2ydTxyb3xCRX+24X6S3OEMyOII4VTwGgLiBV3HKcc4qnnf2maBorAqjJ0yq08clLnuOva11IKeqEVaQfHAnBNBxEcpE5HoCPVD5UKK5WihuOM07xoKliySkaU7Pmbo+mVnquzLtTzPuwW0mumAeluWEoiIOFlniAqa60wrsYFyWlihssKHo4iIL7ZuTVDSDnrhFZkZ5fiSRPFcnPy+Td0eQnCjtxrOAZjuY9xYAovVGY62wBJOZZpwe4JJ5kHiZT5Y2XW/SYaanRSL+ZWp522fPgRHIHkwfQL8z7xJNxj8Y+A4D82xjz0iQ0kVzs9Syx19Or9XKdppWL5GXxyU/GJP9TJE/OfYLDOR2KuTWAnsEAdmYPTw+QmlcrtxeTxYoLhUkpnnCuVibmguGYWZ1KapZc9tzOsgdl8m5h3jXgx/bMGQBcyK2RDw6aMDmfaGryS2ry0h6cETN+qjgmeX4kueYJDuW0IymrHQcy26Lmz4x+bEkfmR7gvKZaJpPpIgntkXm2if5yo1ldnG0lMeebiY1CeplaKTn/G3pu9qPTpJh3GPz45apzeoCzOVVKSV00U0pL0dAi5lk1VUvNE64XStZ0yOQHs9pk8j8yWpGY3oKnwrxd70drvx8/XXbNACC7UppIo5GAEF+F4bBiqJqyx3qb0metTUnMg9bN1KLkT01K6ja9T5o36/zYcGl0eoAzWZVyfEzDAcVQjJFRiIYGuxgpIZZZZ50odfegXxp3sdxCTww+dIjUbcK4RedDk9aHxl4f1l0cmx7gdGaF7KWq/khfaaiNmvrRG0kr+8xDRuNIr9v7fWgRahbGj/sU8/oeH9akumcGwLLea9Kh7H4f8qu1uHpLi7MlRhwXTzNVR0sGkHzNjKSiQewvsGJfvg17cu1i1ofEuDnkif/5igsbRd/XXxrDGpF+9YUZAJzKKMeGXSfwxfe/yf9i5y1ei3cXrpJ/+G9psud/cv0NW8FnkZfetYIAAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790722358076,"unified_at":"2026-09-29T22:52:38.076Z","metadata":{"hashes":{"sha256":"0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b","sha1":"f38abb67d47a4f69536ae67aa9c6df7287c08869","md5":"3f326da2affb0f7f2a4c5c95ffc660cc","sha512":"83b322f899801920604457910c262500490f518591d9d0eefaccec59db98b546c76cfc4c1ac7f2fb08253b1201d76c5d6eaf5600a6d3793c4f3cba16c1f8cd18","ssdeep":"24576:uguUgXlNGKIZyltJSR3PlRiBwlvQn5tNXw9OSTwbB3UGIpVoR1sLAXI3TYF+PXyx:unUgQWtIBlR7vQN3dBMRUXIDkCy","ssdeep_chunks":["24576:uguUgXl","24576:guUgXlN","24576:uUgXlNG","24576:UgXlNGK","24576:gXlNGKI","24576:XlNGKIZ","24576:lNGKIZy","24576:NGKIZyl","24576:GKIZylt","24576:KIZyltJ","24576:IZyltJS","24576:ZyltJSR","24576:yltJSR3","24576:ltJSR3P","24576:tJSR3Pl","24576:JSR3PlR","24576:SR3PlRi","24576:R3PlRiB","24576:3PlRiBw","24576:PlRiBwl","24576:lRiBwlv","24576:RiBwlvQ","24576:iBwlvQn","24576:BwlvQn5","24576:wlvQn5t","24576:lvQn5tN","24576:vQn5tNX","24576:Qn5tNXw","24576:n5tNXw9","24576:5tNXw9O","24576:tNXw9OS","24576:NXw9OST","24576:Xw9OSTw","24576:w9OSTwb","24576:9OSTwbB","24576:OSTwbB3","24576:STwbB3U","24576:TwbB3UG","24576:wbB3UGI","24576:bB3UGIp","24576:B3UGIpV","24576:3UGIpVo","24576:UGIpVoR","24576:GIpVoR1","24576:IpVoR1s","24576:pVoR1sL","24576:VoR1sLA","24576:oR1sLAX","24576:R1sLAXI","24576:1sLAXI3","24576:sLAXI3T","24576:LAXI3TY","24576:AXI3TYF","24576:XI3TYF+","24576:I3TYF+P","24576:3TYF+PX","24576:TYF+PXy","24576:YF+PXyx","49152:uguUgXl","49152:guUgXlN","49152:uUgXlNG","49152:UgXlNGK","49152:gXlNGKI","49152:XlNGKIZ","49152:lNGKIZy","49152:NGKIZyl","49152:GKIZylt","49152:KIZyltJ","49152:IZyltJS","49152:ZyltJSR","49152:yltJSR3","49152:ltJSR3P","49152:tJSR3Pl","49152:JSR3PlR","49152:SR3PlRi","49152:R3PlRiB","49152:3PlRiBw","49152:PlRiBwl","49152:lRiBwlv","49152:RiBwlvQ","49152:iBwlvQn","49152:BwlvQn5","49152:wlvQn5t","49152:lvQn5tN","49152:vQn5tNX","49152:Qn5tNXw","49152:n5tNXw9","49152:5tNXw9O","49152:tNXw9OS","49152:NXw9OST","49152:Xw9OSTw","49152:w9OSTwb","49152:9OSTwbB","49152:OSTwbB3","49152:STwbB3U","49152:TwbB3UG","49152:wbB3UGI","49152:bB3UGIp","49152:B3UGIpV","49152:3UGIpVo","49152:UGIpVoR","49152:GIpVoR1","49152:IpVoR1s","49152:pVoR1sL","49152:VoR1sLA","49152:oR1sLAX","49152:R1sLAXI","49152:1sLAXI3","49152:sLAXI3T","49152:LAXI3TY","49152:AXI3TYF","49152:XI3TYF+","49152:I3TYF+P","49152:3TYF+PX","49152:TYF+PXy","49152:YF+PXyx","24576:unUgQWt","24576:nUgQWtI","24576:UgQWtIB","24576:gQWtIBl","24576:QWtIBlR","24576:WtIBlR7","24576:tIBlR7v","24576:IBlR7vQ","24576:BlR7vQN","24576:lR7vQN3","24576:R7vQN3d","24576:7vQN3dB","24576:vQN3dBM","24576:QN3dBMR","24576:N3dBMRU","24576:3dBMRUX","24576:dBMRUXI","24576:BMRUXID","24576:MRUXIDk","24576:RUXIDkC","24576:UXIDkCy"],"imphash":"Unknown"},"file_info":{"file_name":"file","file_type":["doc","office"],"file_type_id":"doc","file_size":2375680,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1642656729000,"last_seen":1764296234000,"last_multi_scan":1764296234000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["labyrinthchollima","suspicious","targeted"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":66},"sandbox_signatures":{"informative_count":150,"suspicious_count":14,"malicious_count":4,"total":168},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/DOC.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[APT]/MSOffice.Lazarus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"DR/SNH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.38623062","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Doc.Malware.Logan-10034467-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"malicious","threat_name":"ms_office/malicious_confidence_100","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.38623062 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"VBA/Agent.ADJ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DocDl-AFJI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"W97M/Downloader.duc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W97/Agent.BH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API during runtime"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains NTDLL native APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Execution","technique":"User Execution","attack_id":"T1204","attack_id_wiki":"https://attack.mitre.org/techniques/T1204","identifiers":[{"type":"suspicious","value":"Contains embedded VBA macros with suspicious keywords"},{"type":"informative","value":"Contains embedded VBA macros"},{"type":"suspicious","value":"Contains embedded VBA macros with interesting strings"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Creates/edits LNK file (Windows shortcut)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains embedded VBA macros (normalized)"},{"type":"informative","value":"Contains ability to connect to a messaging system (API string)"},{"type":"informative","value":"Contains ability to query/modify memory allocated by messaging system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to modify/free process memory (API string)"},{"type":"malicious","value":"Document spawns new processes"},{"type":"informative","value":"Contains ability to modify process thread functionality (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Calls an API typically used to set the date and time of the file"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Rename files"},{"type":"informative","value":"Drops files inside appdata directory"},{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Calls an API typically used to create hash value of data"},{"type":"suspicious","value":"YARA signature match - CRC-32 algorithm"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to create/open registry keys (API string)"},{"type":"informative","value":"Contains ability to close the handle to a registry key (API string)"},{"type":"informative","value":"Contains ability to delete registry value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate processes (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Opens a handle to the specified process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to retrieve internet cache entries (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to read registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"},{"type":"informative","value":"Calls an API typically used to register protocol sequence (RPC)"},{"type":"informative","value":"Calls an API typically used to create string binding handle (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found a potential E-Mail address in binary/memory"},{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"suspicious","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contains ability to communicate with network (APIs)"},{"type":"informative","value":"Calls an API typically used to create a HTTP or FTP session"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to copy files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to use Webdav for network"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Calls an API typically used to communicate with HTTP server"},{"type":"informative","value":"Calls an API typically used to open a HTTP requests"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Contains ability to perform GET/POST network requests (xmlhttp)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Other Network Medium","attack_id":"T1011","attack_id_wiki":"https://attack.mitre.org/techniques/T1011","identifiers":[{"type":"informative","value":"Contains ability to open/close a dial up connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API typically used to terminate process and its threads"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Calls an API typically to import cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"tactic":"Persistence","technique":"Hijack Execution Flow","attack_id":"T1574","attack_id_wiki":"https://attack.mitre.org/techniques/T1574","identifiers":[{"type":"informative","value":"Loaded EXE module from outside of Windows folder"}],"sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Loaded DLL module from outside of Windows folder"}],"sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Loaded modules"}],"sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Tries to open documents files"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Uses bzip2 compression library to compress data"}],"sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains long base64 encoded strings"}],"sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Sets a computer-based training (CBT) hook"}],"sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to create a remote thread (API string)","description":"Found string \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found string \"FGetQueueMutex: WaitForSingleObject returned %u\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found string \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found string \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.bin\")\n Found string \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process thread functionality (API string)","description":"Found string \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify/free process memory (API string)","description":"Found string \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found string \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Rename files","description":"\"WINWORD.EXE\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\CVR11D4.tmp\" to \"%TEMP%\\CVR11D4.tmp.cvr\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"file/memory contains long string with (Indicator: \"NtQueryInformationProcess\"; File: \"0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"file/memory contains long string with (Indicator: \"CryptStringToBinary\"; File: \"0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for data obfuscation(base64/decrypt) which can hide information","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"WINWORD.EXE\" called \"FileTimeToLocalFileTime\" (UID: 00000000-00003532)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"WINWORD.EXE\" called \"GetVersionExA\" (UID: 00000000-00003532)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found string \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found string \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found string \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found string \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found string \"GetMonitorInfoA\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information set for devices (API string)","description":"Found string \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1480","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found string \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found string \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found string \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found string \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"Found string \"tracert.exe\" (Indicator: \"tracert\"; Source: \"00000000-00002664.00000000.69354.003FE000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found string \"DllGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"dwwin.exe\" was created by \"DW20.EXE\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"level":"informative","category":"General","name":"Contains ability to close the handle to a registry key (API string)","description":"Found string \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"General","name":"Contains ability to connect to a messaging system (API string)","description":"Found string \"MAPILogonEx\" (Indicator: \"MAPILogonEx\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-178","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found string \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found string \"FtpCreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"General","name":"Contains ability to create files (API string)","description":"Found string \"WMCreateFileSink $%!WMBackupSignal'd'ki@WMCreateFileSink $!B@WMBackupSignalWMCreateFileSink $%(i0 ]\" (Indicator: \"CreateFile\"; File: \"0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.bin\")\n Found string \"nVdspa ByVal HCreateFile - 16),aXMNIf ThisDocument.Re@adOnlyYFalseenIndexer\" (Indicator: \"CreateFile\"; File: \"0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.bin\")\n Found string \"WMVSDecproWmEmptyData5RetWMCreateFileSink\" (Indicator: \"CreateFile\"; File: \"0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.bin\")\n Found string \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"General","name":"Contains ability to create/open registry keys (API string)","description":"Found string \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$25","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found string \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"General","name":"Contains ability to query/modify memory allocated by messaging system (API string)","description":"Found string \"MAPIAllocateMore\" (Indicator: \"MAPIAllocateMore\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"MAPIFreeBuffer\" (Indicator: \"MAPIFreeBuffer\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"MAPIAllocateBuffer\" (Indicator: \"MAPIAllocateBuffer\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-233","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found string \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found string \"Failed to obtain queue mutex. GetLastError=%u\" (Indicator: \"GetLastError\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"Failed to open or create queue mutex. GetLastError=%u\" (Indicator: \"GetLastError\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"FAllocSD: GetLastError=%u\" (Indicator: \"GetLastError\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"FEnsureQueueDirW: GetLastError=%u\" (Indicator: \"GetLastError\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"FReportToQueue: GetLastError=%u\" (Indicator: \"GetLastError\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found string \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros","description":"details too long to display","origin":"Static Parser","mitre_attack_id":"T1204","relevance":10,"id":"static-13","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros (normalized)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1137","relevance":10,"id":"string-50","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-69486\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001\"\n \"Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\10MU_ACB10_S-1-5-5-0-69486\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001\"\n \"Global\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"Local\\10MU_ACBPIDS_S-1-5-5-0-69486\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"~_file.doc\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$27","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 60D10000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.bin\" was detected as \"MS Office 97-2003\" and name: \"Format\"\n \"0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.bin\" was detected as \"Microsoft Compound\" and name: \"Data\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"dwwin.exe\" with commandline \"-x -s 1448\" (UID: 00000000-00003484)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.bin\")\n Found string \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates/edits LNK file (Windows shortcut)","description":"\"WINWORD.EXE\" writes to LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\file.LNK\"\n \"WINWORD.EXE\" writes to LNK file \"%APPDATA%\\Microsoft\\Office\\Recent\\file.LNK\"","origin":"API Call","mitre_attack_id":"T1547.009","relevance":3,"id":"api-204","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$28","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"~WRS_BFABA732-59CF-4860-BEFC-00ED81F45505_.tmp\" has type \"dBase III DBT version number 0 next free block index 13\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"WINWORD.EXE\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat\"\n \"WINWORD.EXE\" writes a file \"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (APIs)","description":"Found api string \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found string \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found string \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found string \"InternetReadFileExA\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open/close a dial up connection (API string)","description":"Found string \"InternetGoOnline\" (Indicator: \"InternetGoOnline\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"InternetAutodialHangup\" (Indicator: \"InternetAutodial\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"InternetAutodial\" (Indicator: \"InternetAutodial\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1011","relevance":1,"id":"string-540","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet cache entries (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-321","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found string \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found string \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://watson.microsoft.com/dw/dcp.asphttp://watson.microsoft.com/dw/watsoninfo.aspdwintl20.dllstaticsecond\" - Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found URL \"http://https://enumdisplaydevicesagetmonitorinfoaenumdisplaymonitorsmonitorfrompointmonitorfromrectmonitorfromwindowgetsystemmetricsuser32display?software\\microsoft\\pchealth\\errorreporting\\dw\\debugdwdebugbreak%s\\%smsodwexclusive%ihttpshttp>%04x%02d:%02d:%02d\" - Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://lm\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"MSForms.exd\"\n YARA signature for RC4 encryption matched on file \"00000000-00002664.00000000.69354.0023D000.00000004.mdmp\"\n YARA signature for RC4 encryption matched on file \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\"\n YARA signature for RC4 encryption matched on file \"00000000-00002664.00000000.69354.00390000.00000004.mdmp\"\n YARA signature for RC4 encryption matched on file \"00000000-00002664.00000000.69354.7FFDF000.00000004.mdmp\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Remote Access Related","name":"Calls an API typically used to create string binding handle (RPC)","description":"\"WINWORD.EXE\" called \"RpcStringBindingComposeW\" (UID: 00000000-00003532)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-218","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Remote Access Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"WINWORD.EXE\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003532)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003532-00000C98-13821729\")\n Found string \"ncalrpc:[plugplay,Security=Impersonation Dynamic True]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003532-00000C98-13821729\")\n Found string \"ncalrpc:[lsapolicylookup]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003532-00000C98-14152814\")\n Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00003532-00000C98-16962142\")\n Found string \"ncacn_np:[\\\\PIPE\\\\srvsvc,Security=Impersonation Dynamic False]\" (Indicator: \"ncacn_np\"; Source: \"00000000-00003532-00000C98-16962142\")\n Found string \"ncalrpc:[umpo,Security=Impersonation Dynamic True]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003532-00000C98-36681742\")\n Found string \"ncalrpc:[lsasspirpc]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003532-00000C98-39030026\")\n Found string \"ncalrpc:[spoolss,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003532-00000C98-40675139\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found string \"CreateDCA\" (Indicator: \"CreateDC\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found string \"FtpFindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"InternetFindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read registry keys (API string)","description":"Found string \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"RegEnumKeyExA\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"RegEnumKeyW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found string \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.bin\")\n Found string \"xAxSizeGCJ}'E%#nd IfB'evdsptGetProcAddressGcMbKc$_bcL*h?*C{\"?x}\nVSf-VirtuaBl-tect-WM0H>\n\\Sub Gantdll\" memHcpyDReyMV!gAnyA/mdBA)F?/?/\" (Indicator: \"GetProcAddress\"; File: \"0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.bin\")\n Found string \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found string \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found string \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found string \"GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found string \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found string \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found string \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames (API string)","description":"Found string \"GetUserNameExW\" (Indicator: \"GetUserName\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"GetUserNameA\" (Indicator: \"GetUserName\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"Found string \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found string \"FtpRemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"FtpDeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry value (API string)","description":"Found string \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found string \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found string \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found string \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found string \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found string \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found string \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found string \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")\n Found string \"OpenMutexA\" (Indicator: \"OpenMutex\"; Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"file.LNK\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\file.LNK]- [targetUID: 00000000-00003532]\n Dropped file: \"53787DC6.wmf\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\53787DC6.wmf]- [targetUID: 00000000-00003532]\n Dropped file: \"index.dat\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\index.dat]- [targetUID: 00000000-00003532]\n Dropped file: \"29548099.wmf\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\29548099.wmf]- [targetUID: 00000000-00003532]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"+`i82ivJ9ZOFzLy1CwCN3LE/8LBQCxbU6r+RarJ6O5fC5CO8QkXURsJ5QCIqemuFKxDykAbgYAIP7xGaxa06DEyomNfolfYPRA\" (Indicator: \"qemu\") in Source: 0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.bin\n \"+`Zdoy4DuGi3DBmbU9fVnOMgXwvzsI0xGrhLFNcSJ2G+DQEMucdJdND05qYZjA4B+W1ey0OEbOkt0s3HVvalZV/VfaJNzaQxVmo\" (Indicator: \"qemu\") in Source: 0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.bin","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Found URL in decoded VBA string","description":"Pattern match: \"https://lm-career.com/careeroppr.docx\"","origin":"File/Memory","relevance":10,"id":"string-18","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"12/86 reputation engines marked \"https://lm-career.com/careeroppr.docx\" as malicious (13% detection rate)\n 10/89 reputation engines marked \"https://lm-career.com\" as malicious (11% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"36/61 Antivirus vendors marked sample as malicious (59% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"d@fqzi9m.zp\"\n Pattern match: \"s2s@mci.lt_fj_p0p\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547","relevance":5,"id":"string-184","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"suspicious","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00002664.00000000.69354.2D9E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with interesting strings","description":"Found pattern type \"URL\" with value: \"https://lm-career.com/careeroppr.docx\"\", Found pattern type \"Executable file name\" with value: \"WMVCORE.DLL\", Found pattern type \"Executable file name\" with value: \"career.com\"","origin":"Static Parser","mitre_attack_id":"T1204","relevance":10,"id":"static-16","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with suspicious keywords","description":"Found suspicious keyword \"Open\" which indicates: \"May open a file\"\n Found suspicious keyword \"Lib\" which indicates: \"May run code from a DLL\"","origin":"Static Parser","mitre_attack_id":"T1204","relevance":10,"id":"static-15","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: msoffice/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"36/61 Antivirus vendors marked sample as malicious (59% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"malicious","category":"General","name":"Document spawns new processes","description":"Document spawned a new process (macro present)","origin":"Indicator Combinations","mitre_attack_id":"T1055","relevance":7,"id":"summary-3","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically to import cryptographic keys into a CSP","description":"\"WINWORD.EXE\" called \"CryptImportKey\" (UID: 00000000-00003816)","origin":"API Call","mitre_attack_id":"T1486","relevance":1,"id":"api-233","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"WINWORD.EXE\" called \"CryptAcquireContextA\" (UID: 00000000-00003816)","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"\"WINWORD.EXE\" called \"CryptStringToBinaryA\" (UID: 00000000-00003816)\n \"WINWORD.EXE\" called \"CryptStringToBinaryW\" (UID: 00000000-00003816)","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to create hash value of data","description":"\"WINWORD.EXE\" called \"CryptHashData\" (UID: 00000000-00003816)","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-214","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found string \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00003756.00000000.77510.3FB24000.00000002.mdmp\")\n Found string \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00003756.00000000.77510.3FB24000.00000002.mdmp\")\n Found string \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00003756.00000000.77510.3FB24000.00000002.mdmp\")\n Found string \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00003756.00000000.77510.3FB24000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"lm-career.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Installation/Persistence","name":"Calls an API typically used to set the date and time of the file","description":"\"WINWORD.EXE\" called \"SetFileTime\" on file C:\\~WRD0000.tmp (UID: 00000000-00003816)\n \"WINWORD.EXE\" called \"SetFileTime\" on file C:\\~WRD0003.tmp (UID: 00000000-00003816)\n \"WINWORD.EXE\" called \"SetFileTime\" on file C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{DF9BD7A8-536D-41AB-BC80-8B582D3A2F77}.tmp (UID: 00000000-00003816)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":2,"id":"api-205","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to communicate with HTTP server","description":"\"WINWORD.EXE\" called \"WinHttpConnect\" with parameter lm-career.com & 443 (UID: 00000000-00003816)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-187","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a HTTP or FTP session","description":"\"WINWORD.EXE\" called \"InternetConnectW\" (UID: 00000000-00003816)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-215","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to open a HTTP requests","description":"\"WINWORD.EXE\" called \"WinHttpOpenRequest\" with parameter \"OPTIONS 2f00\" (UID: 00000000-00003816)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-188","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"WINWORD.EXE\" called \"WinHttpSendRequest\" (UID: 00000000-00003816)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"WINWORD.EXE\" called \"InternetOpenA\" (UID: 00000000-00003816)\n \"WINWORD.EXE\" called \"InternetOpenW\" (UID: 00000000-00003816)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Remote Access Related","name":"Calls an API typically used to register protocol sequence (RPC)","description":"\"WINWORD.EXE\" called \"RpcServerUseProtseqEpW\" (UID: 00000000-00003816)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-220","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00003756.00000000.77510.3FB24000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains long base64 encoded strings","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-500","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"$30","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"WINWORD.EXE\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\CVR6142.tmp\" to \"%TEMP%\\CVR6142.tmp.cvr\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"& ( 2 9 < D ^ p t\" (Indicator: \" ^ \"; Source: \"00000000-00006164.00000000.77298.044E0000.00000004.mdmp, 00000000-00006164.00000001.79221.044E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains long base64 encoded strings\n Matched sigs: Contains embedded VBA macros with ability to perform xor operation\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains embedded VBA macros with ability to perform xor operation\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Cryptographic Related","name":"Uses bzip2 compression library to compress data","description":"Found CRC table used in bzip2 compression \"00000000-00006164.00000000.77298.6C031000.00000020.mdmp\" at offset 5620; code bytes = b71dc1046e3b8209d926430ddc7604136b6bc517b24d861a0550471eb8ed08260ff0c922d6d68a2f61cb4b2b649b0c35d386cd310aa08e3cbdbd4f3870db114cc7c6d0481ee09345a9fd5241acad155f1bb0d45bc2969756758b5652c836196a7f2bd86ea60d\n Found CRC table used in bzip2 compression \"00000000-00006164.00000001.79221.6C031000.00000020.mdmp\" at offset 5620; code bytes = b71dc1046e3b8209d926430ddc7604136b6bc517b24d861a0550471eb8ed08260ff0c922d6d68a2f61cb4b2b649b0c35d386cd310aa08e3cbdbd4f3870db114cc7c6d0481ee09345a9fd5241acad155f1bb0d45bc2969756758b5652c836196a7f2bd86ea60d","origin":"Memory Dumps","mitre_attack_id":"T1560.002","relevance":3,"id":"memorydump-20","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WINWORD.EXE\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006164)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform GET/POST network requests (xmlhttp)","description":"Found string \"Msxml2.XMLHTTP.5.0\" (Indicator: \"msxml2.xmlhttp\"; Source: \"00000000-00006164.00000000.77298.003F0000.00000002.mdmp, 00000000-00006164.00000001.79221.003F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-469","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"$31","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"General","name":"Calls an API during runtime","description":"$32","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-265","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"General","name":"Contains NTDLL native APIs","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-604","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$34","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"WMCreateFileSink $%!WMBackupSignal'd'ki@WMCreateFileSink $!B@WMBackupSignalWMCreateFileSink $%(i0 ]\" (Indicator: \"CreateFile\"; File: \"0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.bin\")\n Found reference to API \"nVdspa ByVal HCreateFile - 16),aXMNIf ThisDocument.Re@adOnlyYFalseenIndexer\" (Indicator: \"CreateFile\"; File: \"0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.bin\")\n Found reference to API \"WMVSDecproWmEmptyData5RetWMCreateFileSink\" (Indicator: \"CreateFile\"; File: \"0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$35","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"General","name":"Loaded DLL module from outside of Windows folder","description":"$36","origin":"Loaded Module","mitre_attack_id":"T1574.001","relevance":5,"id":"module-12","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"General","name":"Loaded EXE module from outside of Windows folder","description":"\"WINWORD.EXE\" loaded module \"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE\" at 43FB0000","origin":"Loaded Module","mitre_attack_id":"T1574","relevance":1,"id":"module-13","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"General","name":"Loaded modules","description":"\"WerFault.exe\" loaded module \"%WINDIR%\\System32\\WerFault.exe\" at A9540000\n \"WerFault.exe\" loaded module \"%WINDIR%\\System32\\ntdll.dll\" at E4030000","origin":"Loaded Module","mitre_attack_id":"T1574.002","id":"module-11","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$37","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"General","name":"Tries to open documents files","description":"\"WINWORD.EXE\" opens a file C:\\file.doc (UID: 00000000-00006164)\n \"WINWORD.EXE\" opens a file C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\FILE.DOC (UID: 00000000-00006164)\n \"WINWORD.EXE\" opens a file C:\\~$FILE.DOC (UID: 00000000-00006164)\n \"WINWORD.EXE\" opens a file %APPDATA%\\Microsoft\\Office\\Recent\\FILE.DOC (UID: 00000000-00006164)","origin":"API Call","mitre_attack_id":"T1005","relevance":2,"id":"api-248","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"WINWORD.EXE\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"WINWORD.EXE\" opens a process \"C:\\Program Files\\Microsoft Office\\Office14\\WINWORD.EXE\" (UID: 00000000-00006164)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"details too long to display","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"details too long to display","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Possibly tries to implement anti-virtualization techniques","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy files","description":"Observed string: \"Copy\" (Indicator: \"copy\") in Source: 00000000-00006164.00000000.77298.B7373000.00000002.mdmp\n 00000000-00006164.00000000.77298.C1A1A000.00000002.mdmp\n 00000000-00006164.00000001.79221.0E1D0000.00000004.mdmp\n 00000000-00006164.00000001.79221.0E630000.00000002.mdmp\n 00000000-00006164.00000001.79221.0E7D8000.00000004.mdmp\n 00000000-00006164.00000001.79221.0FD80000.00000002.mdmp\n 00000000-00006164.00000001.79221.B7373000.00000002.mdmp\n 00000000-00006164.00000001.79221.C1A1A000.00000002.mdmp\n Observed string: \"copy\" (Indicator: \"copy\") in Source: 00000000-00006164.00000000.77298.C19E1000.00000002.mdmp\n 00000000-00006164.00000001.79221.C19E1000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Network Related","name":"Contains ability to use Webdav for network","description":"Found string \"ystem.WebDavPath\" (Indicator: \"webdav\"; Source: \"00000000-00006164.00000001.79221.0CBF0000.00000002.mdmp\")\n Found string \"System.WebDavPath\" (Indicator: \"webdav\"; Source: \"00000000-00006164.00000001.79221.0CC50000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-476","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"file/memory contains long string with (Indicator: \"smtp\"; File: \"0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.bin\")","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.241.106\"\n Potential IP \"2.1.4.0\" found in string \"2.1.4.0, Mon 03/02/2009 12:32:57.69\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"file/memory contains long string with (Indicator: \"QueryInformationProcess\"; File: \"0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"file/memory contains long string with (Indicator: \"NtQueryInformationProcess\"; File: \"0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.bin\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"Route to recipients\" (Indicator: \"route\"; Source: \"00000000-00006164.00000000.77298.04A50000.00000002.mdmp, 00000000-00006164.00000001.79221.04A50000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to terminate process and its threads","description":"\"WerFault.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\WINDOWS\\\\system32\\\\WerFault.exe\"}","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-247","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - CRC-32 algorithm","description":"YARA signature for CRC-32 algorithm matched on process \"00000000-00006164\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-111","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded string that indicates auto-execute behavior","description":"Found keyword \"AutoExec\" which indicates: \"Runs when the Word document is opened\"\n Found keyword \"AutoOpen\" which indicates: \"Runs when the Word document is opened\"\n Found keyword \"AutoExit\" which indicates: \"Runs when the Word document is closed\"\n Found keyword \"AutoClose\" which indicates: \"Runs when the Word document is closed\"\n Found keyword \"AutoNew\" which indicates: \"Runs when a new Word document is created\"","origin":"File/Memory","relevance":10,"id":"string-20","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00003268-00000C75-33863\")\n Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CL\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00003268-00000C76-33868\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"WINWORD.EXE\" called \"HttpOpenRequestW\" with parameter HTTP method:\"GET\" object: /careeroppr.docx\" - (UID: 00000000-00003268)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"WINWORD.EXE\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003268)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Sets a computer-based training (CBT) hook","description":"\"WINWORD.EXE\" sets a callback procedure (eac7ec24) using filter \"WH_CBT\" for process ID: 64c","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-74","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]}],"incidents":[{"name":"Evasive","details_count":2,"details":[{"detail":"Possibly tries to implement anti-virtualization techniques"},{"detail":"Possibly checks for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":153,"imported_dlls_count":177,"dropped_files_count":0,"extracted_files_count":39,"files_written_count":48,"files_deleted_count":0,"registry_keys_created_count":16,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":18,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["labyrinthchollima","suspicious","targeted"],"sample_flags":["Extracted Files","Sample Crashed","User Comment","Network Traffic"],"sandbox_reports":[{"id":"646cdbaabe515a74d50bbe18","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"file","analysis_start_time":"2023-05-23T15:28:42+00:00","indicators_count":{"informative":63,"suspicious":12,"malicious":3},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"646cd474830c196388091ba5","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"file","analysis_start_time":"2023-05-23T14:57:57+00:00","indicators_count":{"informative":61,"suspicious":11,"malicious":3},"tags":["Extracted Files","Sample Crashed","User Comment"],"is_in_unified_schema":true},{"id":"646cd0c3678b940dca0f3297","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"file","analysis_start_time":"2023-05-23T14:42:12+00:00","indicators_count":{"informative":53,"suspicious":10,"malicious":3},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"644fcf0d1b5fb14f7101584f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"file","analysis_start_time":"2023-05-01T14:39:10+00:00","indicators_count":{"informative":47,"suspicious":10,"malicious":3},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":false},{"id":"644fcda41b0e4e3c630b6d3d","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"file","analysis_start_time":"2023-05-01T14:33:09+00:00","indicators_count":{"informative":55,"suspicious":11,"malicious":3},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":false},{"id":"644fb041194426b2650fe6be","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"file","analysis_start_time":"2023-05-01T12:34:22+00:00","indicators_count":{"informative":107,"suspicious":16,"malicious":4},"tags":["Network Traffic","Extracted Files","Sample Crashed","User Comment"],"is_in_unified_schema":true},{"id":"644cf7feaed0d80baf01df5f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"file","analysis_start_time":"2023-04-29T10:57:03+00:00","indicators_count":{"informative":37,"suspicious":10,"malicious":3},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":false},{"id":"644cf4347bbfd1346d06667d","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"file","analysis_start_time":"2023-04-29T10:40:53+00:00","indicators_count":{"informative":40,"suspicious":10,"malicious":3},"tags":["Extracted Files","User Comment","Simulated analysis"],"is_in_unified_schema":false},{"id":"644cf2d8e17be3d13c0f0fb5","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"file","analysis_start_time":"2023-04-29T10:35:05+00:00","indicators_count":{"informative":96,"suspicious":17,"malicious":4},"tags":["Extracted Files","Sample Crashed","User Comment"],"is_in_unified_schema":true},{"id":"644cec29e3a02eff9b0b47bd","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"file","analysis_start_time":"2023-04-29T10:19:53+00:00","indicators_count":{"informative":40,"suspicious":10,"malicious":3},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":false},{"id":"61f01e5acfa92d5b73348bde","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["DEU"],"submit_name":"file","analysis_start_time":"2022-01-25T15:59:23+00:00","indicators_count":{"informative":32,"suspicious":16,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files","Launch Failed","User Comment","TOR analysis"],"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"lm-career.com","ttl":900,"country":"-","registrar_name":"Porkbun LLC","registrar_organization":"Private by Design, LLC","registrar_name_servers":"CURITIBA.PORKBUN.COM","registrar_creation_date":"2021-11-27T08:38:23+00:00","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}],"processes":[{"pid":3816,"ppid":0,"name":"WINWORD.EXE","command_line":"/n \"C:\\file.doc\"","sha256":"007b8c7a282521d8981386fb31abda08f3710239c7bb83d8da3b5a9826ebe246","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","uid":"00000000-00003816","icon":"$3c"},{"pid":1344,"ppid":3816,"name":"WerFault.exe","command_line":"-u -p 3816 -s 1492","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00003816","uid":"00000000-00001344"},{"pid":2384,"ppid":0,"name":"dwwin.exe","command_line":"-x -s 1656","sha256":"c740497a7e58f7678e25b68b03573b4136a364464ee97c02ce5e0fe00cec7050","normalized_path":"%WINDIR%\\system32\\dwwin.exe","uid":"00000000-00002384","icon":"$3d"}],"all_imported_dlls":["USP10.DLL","msproof7.dll","WMASF.DLL","iertutil.dll","ntshrui.dll","sechost.dll","rpcrt4.dll","ntmarta.dll","userenv.dll","secur32.dll","sspicli.dll","WMVCORE.DLL","KernelBase.dll","msimg32.dll","MSOINTL.DLL","RICHED20.DLL","unidrvui.dll","FM20ENU.DLL","advapi32.dll","devobj.dll","api-ms-win-downlevel-user32-l1-1-0.dll","msvcrt.dll","shlwapi.dll","setupapi.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","VxSSL32.dll","msi.dll","profapi.dll","GKWord.dll","msvcr90.dll","ole32.dll","normaliz.dll","cscapi.dll","ntdll.dll","fltLib.dll","rpcss.dll","ws2_32.dll","MSO.DLL","SendToOneNoteUI.dll","sxs.dll","ExplorerFrame.dll","duser.dll","wininet.dll","OSPPC.DLL","RpcRtRemote.dll","WWINTL.DLL","dwmapi.dll","api-ms-win-downlevel-version-l1-1-0.dll","apphelp.dll","uxtheme.dll","urlmon.dll","version.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","MSPTLS.DLL","mscoree.dll","cryptsp.dll","msxml6.dll","VBE7.DLL","WindowsCodecs.dll","srvcli.dll","user32.dll","imm32.dll","GFX.DLL","wtsapi32.dll","MSORES.DLL","clbcatq.dll","msxml6r.dll","FM20.DLL","comctl32.dll","lpk.dll","OART.DLL","bcrypt.dll","GdiPlus.dll","kernel32.dll","msctf.dll","shell32.dll","nsi.dll","api-ms-win-core-synch-l1-2-0.dll","cryptbase.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","linkinfo.dll","mscoreei.dll","oleaut32.dll","powrprof.dll","cfgmgr32.dll","slc.dll","gdi32.dll","comdlg32.dll","dui70.dll","WWLIB.DLL","mscorwks.dll","propsys.dll","usp10.dll","Wldap32.dll","rsaenh.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","winhttp.dll","dhcpcsvc6.dll","wkscli.dll","Csi.dll","winnsi.dll","MSGR3EN.DLL","oleacc.dll","nlaapi.dll","rasadhlp.dll","VxSSL64.dll","ntlanman.dll","ALRTINTL.DLL","netapi32.dll","mpr.dll","davhlpr.dll","npmproxy.dll","msasn1.dll","psapi.dll","wship6.dll","davclnt.dll","sfc.dll","dnsapi.dll","dhcpcsvc.dll","winsta.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","credssp.dll","msadox.dll","sfc_os.dll","drprov.dll","crypt32.dll","hlink.dll","netprofm.dll","IPHLPAPI.DLL","WSHTCPIP.DLL","mswsock.dll","webio.dll","netutils.dll","twinapi.appcore.dll","MpOAV.dll","policymanager.dll","WinTypes.dll","win32u.dll","dxgi.dll","gdi32full.dll","msvcp_win.dll","windows.storage.dll","srpapi.dll","rmclient.dll","VBE7INTL.DLL","RTWorkQ.dll","AcSpecfc.dll","DataExchange.dll","combase.dll","SHCore.dll","mfperfhelper.dll","edputil.dll","kernel.appcore.dll","mfplat.dll","sppc.dll","bcryptprimitives.dll","coml2.dll","msvcp110_win.dll","TextInputFramework.dll","ucrtbase.dll","MpClient.dll","gpapi.dll","AcGenral.dll","ninput.dll","d3d11.dll","dcomp.dll","mxdwdrv.dll","fontsub.dll","samcli.dll","ONBttnWD.dll","imagehlp.dll","CoreMessaging.dll","aepic.dll","cldapi.dll","CoreUIComponents.dll","DWrite.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"~_file.doc","sha256":"a101d3605f8d1ca5cfb10c48dbdb24c45f2627c48f44a2bd2604b88c7b90d5f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"file.LNK","sha256":"a18f89ad83463d7948eed646a593be24b8b8e17379c983c86e449dc79034a91d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"index.dat","sha256":"72dbc5f49cb31207a11cca5872ad5b38b4f8d25bc8808ddcd0cc61c7aa305c4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"29548099.wmf","sha256":"b7f0b658e073b348819687bef0a3971ceab0f29c4c405eb650936f32420cd0d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"}]},{"name":"53787DC6.wmf","sha256":"b7f0b658e073b348819687bef0a3971ceab0f29c4c405eb650936f32420cd0d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"}]},{"name":"907407343.cvr","sha256":"6294d42ce12b00b217b4874aae5ccc83a1de0dbc80067130f6cb7e5b7a360fa4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"}]},{"name":"MSForms.exd","sha256":"a82b865322e28be0cb80ef79face40ddf572df9dd22003579166494c776339d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"~WRS_BFABA732-59CF-4860-BEFC-00ED81F45505_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"}]},{"name":"~_Normal.dotm","sha256":"a101d3605f8d1ca5cfb10c48dbdb24c45f2627c48f44a2bd2604b88c7b90d5f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"~WRD0002.tmp","sha256":"e1f37d99490cd216b2fc6fdd9a161b1fa63273f7d0a14de4fff287d8286ca2b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"FSF-CTBL.FSF","sha256":"50099e0e10c8edd2a6ad1b3f3b3df53de198292f79b29cdc696dc1dfb91cb65a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"FSD-CNRY.FSD","sha256":"0de3e940df05096ae18e91e7196402d9c221be66496cb02b2eca13cbb6b13fcf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"4277E95E.wmf","sha256":"b7f0b658e073b348819687bef0a3971ceab0f29c4c405eb650936f32420cd0d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"F1404DC7.wmf","sha256":"b7f0b658e073b348819687bef0a3971ceab0f29c4c405eb650936f32420cd0d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"~WRD0000.tmp","sha256":"6fa9d6b440a8b52ef7a47494bc9ccca224d42504b244f30a640090f49713fd69","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"~WRD0003.tmp","sha256":"e4700e253acbb636bb7106d838ec507f46ef5184fea725dc6127b4b42d8fe5cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"_B87D1EEE-E23D-4A7F-819F-2C971261FEEB_","sha256":"29535ad7db0a6a1fea026716cb7d7d6b446f5191114ecccdfb83265db5bdc20e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"FSD-_DA8037D2-E77C-41A9-908C-48A65D929561_.FSD","sha256":"7a16ee19fe5294b39da2bdaf24492d406007abb0cd942283c4651cb232fa0415","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"FSD-_B78DB900-A3E1-4626-AF8B-6E7191E95999_.FSD","sha256":"9e9119d8ffe0378beefbe3d84aec6f6bc6fc14185b033556e05a2316b74350b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"_89B7B0B0-6277-422F-928F-521C5DD085BB_","sha256":"938f58736e94e226d4b3bda5e15c781b6fc0bf09b1fa89ed4e11a4e34a2a2942","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"~WRS_7C9DD80F-F127-48B0-B276-121CA569170B_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"file _2_.LNK","sha256":"40a3ff1a3ec8f00cc100937d3a9b8dbebe2ca876de3f9d384d1c6a6d0b41c6aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"FSF-_0E1EEE64-E8C6-4E2A-9759-63CF07FD8988_.FSF","sha256":"d919dcb2e8fa811b0719f445ab956a8dc0f6080f802a7a5d05c29daaeaaee938","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"file.doc.LNK","sha256":"22d67bd4440a66893d76d1232a58443f795ed05bed65b9f8771a4860d94c07e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"4DAA6CA8.wmf","sha256":"b7f0b658e073b348819687bef0a3971ceab0f29c4c405eb650936f32420cd0d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"name":"755A7489.wmf","sha256":"b7f0b658e073b348819687bef0a3971ceab0f29c4c405eb650936f32420cd0d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"name":"~WRS_90A75B66-9EF9-485D-848A-B45C5F142FDB_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"name":"74AC7CDC.wmf","sha256":"b7f0b658e073b348819687bef0a3971ceab0f29c4c405eb650936f32420cd0d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"9D475C87.wmf","sha256":"b7f0b658e073b348819687bef0a3971ceab0f29c4c405eb650936f32420cd0d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"_03021E86-7C51-4791-B7AC-C62AA8640629_","sha256":"d7621fa585225ebc5172e0d609fc788da6748744bd163aa136ab4b5fe2b808df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"FSD-_6D2D5EDA-E4C9-4ACF-B43F-33D023A8DBCA_.FSD","sha256":"0d1b02c35fa6252bed0a133aa7637fa28b0ddd53d1bde06a33ab4754d87ac3c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"FSD-_5B5CCC82-3CBA-4D1E-B51F-DAC62C6D3E57_.FSD","sha256":"607a2ef7262d424bdc214bd5e588a51a386e9b85d58f0ee10999dd88cfe3574d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"_6E16407C-7A13-4CDD-BB9F-458228D805FE_","sha256":"74b347ad7f6ff4e8aa5167e276ee869f966b5a1b795665c7acc3821539ee99e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"~WRS_4C67B75A-888E-4B7C-BB0A-0B40A15B09DE_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"3EFE0C4E.wmf","sha256":"b7f0b658e073b348819687bef0a3971ceab0f29c4c405eb650936f32420cd0d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"9F6BB3F7.wmf","sha256":"b7f0b658e073b348819687bef0a3971ceab0f29c4c405eb650936f32420cd0d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"_39121325-9BB8-4E26-8B6A-787CF079AEB3_","sha256":"5842bf7c7e8187bfdf6f47ca11d9d13c4afa6f1a92ba1df6fd3b76c3d5434c2b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"FSD-_00D67E43-BA3E-400B-9BDA-41B87D312BFB_.FSD","sha256":"991d3f1e4effdcc487c2565b3d49eb057f10bda9172aa5cc1e8191c970f6ddee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"~WRS_E0585FF6-3B0C-4AD3-9370-5B68A3E9DFC9_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]}],"files_written":[{"path":"%TEMP%\\~DFD3B8E3053C668C08.TMP","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\file.LNK","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\~$Normal.dotm","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{BFABA732-59CF-4860-BEFC-00ED81F45505}.tmp","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"}]},{"path":"C:\\~$file.doc","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{5FC4366D-372E-4BBB-96FC-F5F3EBA3F198}.tmp","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{2CCD03B5-C045-4C77-B688-140A0E48991D}.tmp","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"}]},{"path":"%TEMP%\\907407343.cvr","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\14.0","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"path":"%TEMP%\\~DF6E4A4D81E64B484C.TMP","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"path":"\\device\\webdavredirector","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"path":"%TEMP%\\~DFA2D0D4F77A7B01C4.TMP","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"path":"%TEMP%\\~DF498297B3F1F08993.TMP","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\file (2).LNK","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"path":"%TEMP%\\~DF140371BA2626C92F.TMP","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"path":"%TEMP%\\~DFA8533FFAB3D10BCD.TMP","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.Word\\~WRS{90A75B66-9EF9-485D-848A-B45C5F142FDB}.tmp","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"path":"%TEMP%\\~DF45ED53E4BD96CBD8.TMP","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\file.doc.LNK","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.Word\\~WRF{F1944F34-3D8C-49C2-B718-B4942E142A9E}.tmp","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\Word14.customUI","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{4C67B75A-888E-4B7C-BB0A-0B40A15B09DE}.tmp","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{C9D8B707-9D4E-45CD-A583-52A4A559044B}.tmp","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{5438BA4B-787A-4937-8E10-C4FC5D08C90C}.tmp","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"path":"%TEMP%\\~DF3A20352A6E0864F1.TMP","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"path":"%TEMP%\\~DF637F96ABC945F041.TMP","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"path":"%TEMP%\\~DF90822EA2A075FFF6.TMP","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"path":"%TEMP%\\~DF8889BB56C6575EB8.TMP","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"path":"C:\\~WRD0000.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"path":"%TEMP%\\~DFAFADF8544FAD0956.TMP","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"path":"%TEMP%\\~DF101A84FE17EAF16D.TMP","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\14.0\\OfficeFileCache\\LocalCacheFileEditManager\\FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"path":"C:\\~WRD0003.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"path":"%TEMP%\\~DF38BFA468F7F5C2BA.TMP","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"path":"%TEMP%\\~DFD378D533C17DB72C.TMP","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\REGISTRATION\\","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\REGISTRATION\\HAPUBWS-PC\\{71AF7E84-93E6-4363-9B69-699E04E74071}\\","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\SECURITY\\TRUSTED DOCUMENTS\\","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LANGUAGERESOURCES\\ENABLEDLANGUAGES\\","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\MIGRATION\\OFFICE\\","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\MIGRATION\\WORD\\","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-69486","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"Local\\10MU_ACB10_S-1-5-5-0-69486","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"},{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"Local\\10MU_ACBPIDS_S-1-5-5-0-69486","sources":[{"report_type":"sandbox","report_id":"644cf2d8e17be3d13c0f0fb5"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-1B0BC513","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"Local\\CSI_WDW:{26D44ABF-1F14-48E2-9AC7-94AA83CBB45A}","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"},{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-5B4ADAAD","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-D27BC7C","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"Local\\CSI_WDW:{59B47522-00AE-4903-93D3-58B319D5FC2C}","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"Local\\x64_10MU_ACB10_S-1-5-5-0-69744","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-93FB005A","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-CFAB828B","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-34CC11C4","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"Local\\Csi_CTTxnLock:{17E433C7-FF57-4662-B4E2-C08BEB54D543}","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"Local\\CSI_WDW:{1E3BD067-C8BB-479D-8E31-AF15F7B51556}","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"Global\\MsoShellExtRegAccess_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-F1C16E92","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"Global\\MsoCsi:GC:C:/Users/bWWospi/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"Local\\CSI_WDW:{2DF8987F-173B-4EAD-A5A1-31C0B21248F1}","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-23CA0743","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"Global\\MsoCsi:GC:C:/Users/bWWospi/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"Local\\CSI_OMTX:{0F17DDA5-7C9F-4697-AC9A-BD1A09AFD9CB}","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"Local\\x64_10MU_ACBPIDS_S-1-5-5-0-69744","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"Local\\CSI_WDW:{4B71E84E-4B61-40C4-8A45-09ED867DCB2A}","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"Local\\CSI_WDW:{0F17DDA5-7C9F-4697-AC9A-BD1A09AFD9CB}","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"Local\\CSI_OMTX:{26D44ABF-1F14-48E2-9AC7-94AA83CBB45A}","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-D27BC7C","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-F1C16E92","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_OMTX:{0F17DDA5-7C9F-4697-AC9A-BD1A09AFD9CB}","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{59B47522-00AE-4903-93D3-58B319D5FC2C}","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{4B71E84E-4B61-40C4-8A45-09ED867DCB2A}","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{0F17DDA5-7C9F-4697-AC9A-BD1A09AFD9CB}","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-34CC11C4","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoCsi:GC:C:/Users/bWWospi/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-CFAB828B","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-93FB005A","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-23CA0743","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_OMTX:{26D44ABF-1F14-48E2-9AC7-94AA83CBB45A}","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{1E3BD067-C8BB-479D-8E31-AF15F7B51556}","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{2DF8987F-173B-4EAD-A5A1-31C0B21248F1}","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{26D44ABF-1F14-48E2-9AC7-94AA83CBB45A}","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-1B0BC513","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoCsi:GC:C:/Users/bWWospi/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-5B4ADAAD","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Csi_CTTxnLock:{17E433C7-FF57-4662-B4E2-C08BEB54D543}","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoShellExtRegAccess_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"644fb041194426b2650fe6be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACBPIDS_S-1-5-5-0-193556","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACB10_S-1-5-5-0-193556","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"name":"\\BaseNamedObjects\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6164:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6164:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6164:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"name":"\\BaseNamedObjects\\MTX_MSO_Formal1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\BaseNamedObjects\\MTX_MSO_AdHoc1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"},{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"Local\\SM0:6164:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"name":"SM0:6164:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"name":"x64_10MU_ACBPIDS_S-1-5-5-0-193556","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"name":"x64_10MU_ACB10_S-1-5-5-0-193556","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"name":"Local\\SM0:6164:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"646cd474830c196388091ba5"}]},{"name":"Local\\CSI_WDW:{DF50175A-AD41-4C12-9747-A9C9FB69BC8C}","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-6C6D6FF4","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"Local\\x64_10MU_ACBPIDS_S-1-5-5-0-70464","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"Local\\CSI_WDW:{93AC6FDE-A664-4AAF-BCB0-44C3C24BF3C2}","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"Local\\x64_10MU_ACB10_S-1-5-5-0-70464","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"Local\\CSI_WDW:{C7302C34-715D-4BEC-B6DF-598B643E0168}","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"Local\\CSI_WDW:{ACE481A6-F878-4DBF-8202-4A3EE51934BA}","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-FA37FDFC","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-FBF487B4","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-75D27445","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-157D110B","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-2C96BCB3","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"Local\\CSI_WDW:{3E23E505-6816-4C4A-ABB5-AF38CB87EDF6}","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"Local\\CSI_WDW:{326848B9-8C53-4587-B51A-E5195EDFD8B0}","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"Local\\CSI_OMTX:{93AC6FDE-A664-4AAF-BCB0-44C3C24BF3C2}","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"Local\\Csi_CTTxnLock:{8ED72602-8A37-4AF4-B425-E1C8CB72ABFE}","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-EA00DE80","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"Global\\MsoCsi:GC:C:/Users/ZgKxbTG/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-8CB19DCF","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"Local\\CSI_OMTX:{DF50175A-AD41-4C12-9747-A9C9FB69BC8C}","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"Global\\MsoCsi:GC:C:/Users/ZgKxbTG/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-2C96BCB3","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-FA37FDFC","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_OMTX:{DF50175A-AD41-4C12-9747-A9C9FB69BC8C}","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{ACE481A6-F878-4DBF-8202-4A3EE51934BA}","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{326848B9-8C53-4587-B51A-E5195EDFD8B0}","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{DF50175A-AD41-4C12-9747-A9C9FB69BC8C}","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-157D110B","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoCsi:GC:C:/Users/ZgKxbTG/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-75D27445","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-FBF487B4","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-8CB19DCF","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_OMTX:{93AC6FDE-A664-4AAF-BCB0-44C3C24BF3C2}","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{C7302C34-715D-4BEC-B6DF-598B643E0168}","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{3E23E505-6816-4C4A-ABB5-AF38CB87EDF6}","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{93AC6FDE-A664-4AAF-BCB0-44C3C24BF3C2}","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-6C6D6FF4","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoCsi:GC:C:/Users/ZgKxbTG/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-EA00DE80","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Csi_CTTxnLock:{8ED72602-8A37-4AF4-B425-E1C8CB72ABFE}","sources":[{"report_type":"sandbox","report_id":"646cd0c3678b940dca0f3297"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-75547354","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"Local\\SM0:1612:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-22444497","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"CSI_OMTX:{4DC05BB2-A34D-471B-9FDD-4990E7F500BE}","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"CSI_WDW:{4DC05BB2-A34D-471B-9FDD-4990E7F500BE}","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-79BFADB7","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"SM0:1612:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"CSI_WDW:{3859687C-2DBF-47B0-B596-8633861DFE3A}","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-E9D70AF5","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"x64_10MU_ACBPIDS_S-1-5-5-0-198919","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"Local\\SM0:1612:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"CSI_WDW:{0D48D5A8-BB64-4F58-B58D-15009522A762}","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"Csi_TableRuntimeBucketsLock:{0D48D5A8-BB64-4F58-B58D-15009522A762}","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"CSI_WDW:{42B67F3C-FEE9-4A54-BD64-EC1F8EE8C396}","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"CSI_WDW:{62E571F8-F095-41DA-93D2-1BAE07AA595D}","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"x64_10MU_ACB10_S-1-5-5-0-198919","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1612:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACBPIDS_S-1-5-5-0-198919","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACB10_S-1-5-5-0-198919","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1612:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1612:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-22444497","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_OMTX:{4DC05BB2-A34D-471B-9FDD-4990E7F500BE}","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_WDW:{0D48D5A8-BB64-4F58-B58D-15009522A762}","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_WDW:{3859687C-2DBF-47B0-B596-8633861DFE3A}","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_WDW:{4DC05BB2-A34D-471B-9FDD-4990E7F500BE}","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-1BAFE92F","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\BaseNamedObjects\\MsoCsi:GC:C:/Users/MyzPNJV/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-AECCD20","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-75547354","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-E9D70AF5","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_OMTX:{62E571F8-F095-41DA-93D2-1BAE07AA595D}","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_WDW:{F91758B8-5125-4938-8999-D482A61FA91E}","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_WDW:{42B67F3C-FEE9-4A54-BD64-EC1F8EE8C396}","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_WDW:{62E571F8-F095-41DA-93D2-1BAE07AA595D}","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-47E025E5","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\BaseNamedObjects\\MsoCsi:GC:C:/Users/MyzPNJV/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-79BFADB7","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Csi_CTTxnLock:{1FA12FD0-FCA4-47A3-B095-D5AABB6DDEE2}","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Csi_TableRuntimeBucketsLock:{0D48D5A8-BB64-4F58-B58D-15009522A762}","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]},{"name":"\\BaseNamedObjects\\MsoShellExtRegAccess_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"646cdbaabe515a74d50bbe18"}]}]}},"report_ids":{"sandbox_job_ids":["646cdbaabe515a74d50bbe18","646cd0c3678b940dca0f3297","644cf2d8e17be3d13c0f0fb5","646cd474830c196388091ba5","644fb041194426b2650fe6be"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 0d01b24f7666… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0d01b24f7666…. Malware family: Trojan.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 0d01b24f7666… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0d01b24f7666…. Malware family: Trojan.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 0d01b24f7666… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0d01b24f7666…. Malware family: Trojan.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3e","11",{}]]