26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T47a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 56ca24b57c45… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 56ca24b57c45…. Malware family: Trojan.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 3 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/56ca24b57c4559f834c190d50b0fe89dd4a4040a078ca1f267d0bbc7849e9ed7","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","56ca24b57c4559f834c190d50b0fe89dd4a4040a078ca1f267d0bbc7849e9ed7"],"about":{"@type":"SoftwareApplication","name":"1.docx","applicationCategory":["docx","office"],"identifier":"56ca24b57c4559f834c190d50b0fe89dd4a4040a078ca1f267d0bbc7849e9ed7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T63f,"\Sessions\1\BaseNamedObjects\Local\SM0:7464:304:WilStaging_02" "\Sessions\1\BaseNamedObjects\Local\x64_10MU_ACBPIDS_S-1-5-5-0-153026" "\Sessions\1\BaseNamedObjects\Local\x64_10MU_ACB10_S-1-5-5-0-153026" "\Sessions\1\BaseNamedObjects\Global\552FFA80-3393-423d-8671-7BA046BB5906" "\Sessions\1\BaseNamedObjects\Local\SM0:7464:120:WilError_01" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-7FECCE34" "\Sessions\1\BaseNamedObjects\Local\CSI_OMTX:{9CEF24FD-965E-4372-BB22-F487D4860D06}" "\Sessions\1\BaseNamedObjects\Local\CSI_WDW:{0D48D5A8-BB64-4F58-B58D-15009522A762}" "\Sessions\1\BaseNamedObjects\Local\CSI_WDW:{FD770FBE-50C8-4066-ADA6-5EB904302896}" "\Sessions\1\BaseNamedObjects\Local\CSI_WDW:{9CEF24FD-965E-4372-BB22-F487D4860D06}" "\Sessions\1\BaseNamedObjects\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-4607638C" "\Sessions\1\BaseNamedObjects\Global\MsoCsi:GC:C:/Users/6Cke7gA/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF" "\Sessions\1\BaseNamedObjects\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-945B1DDE" "\Sessions\1\BaseNamedObjects\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-ECA41A23" "\Sessions\1\BaseNamedObjects\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-99413D0" "\Sessions\1\BaseNamedObjects\Local\CSI_OMTX:{F7BFAA46-C457-4EE1-A692-B1CC838EC4A5}" "\Sessions\1\BaseNamedObjects\Local\CSI_WDW:{6F8B9749-6620-45C8-996D-44B12D8FF16E}" "\Sessions\1\BaseNamedObjects\Local\CSI_WDW:{CCFB8885-FBCC-428F-93B1-7250F1C7D9DA}"28:T710,".shop_view #s202108027829a3711c294 select.form-control option {" (Indicator: "select") ".is-ie .shop_view #s202108027829a3711c294 select.form-control option {" (Indicator: "select") "#s202108027829a3711c294 select.form-control," (Indicator: "select") "#s202108027829a3711c294 .input_block .select-block .selectbox select {" (Indicator: "select") "#s202108027829a3711c294 .shop-content.shop-style-b.open .opt-group .btn_clse > span {" (Indicator: "open") ".shop_view #s202108027829a3711c294 .shop-content select.form-control," (Indicator: "select") ".booking_view #s202108027829a3711c294 .booking_opt select.form-control," (Indicator: "select") ".shop_view #s202108027829a3711c294 .form-select-wrap .dropdown-menu," (Indicator: "select") ".shop_view #s202108027829a3711c294 .form-select-wrap .dropdown-menu .dropdown-item {" (Indicator: "select") "#s202108027829a3711c294 .seemore_wrap .open:before {" (Indicator: "open") "#s202108027829a3711c294 .item_detail select.form-control," (Indicator: "select") "#s202108027829a3711c294 .booking_opt select.form-control," (Indicator: "select") "#s202108027829a3711c294 .goods_select textarea.form-control," (Indicator: "select") "#s202108027829a3711c294 .goods_select select.form-control," (Indicator: "select") "#s202108027829a3711c294 .goods_select input.form-control," (Indicator: "select") "#s202108027829a3711c294 .form-select-wrap:before {" (Indicator: "select") "#s202108027829a3711c294 .form-select-wrap .dropdown-menu .dropdown-item:hover {" (Indicator: "select") ".doz_sys #s202108027829a3711c294 .shop-content .down-btn select.form-control {" (Indicator: "select") "#s202108027829a3711c294 .form-select-wrap.open .dropdown-toggle," (Indicator: "open") "#s202108027829a3711c294 .form-select-wrap.open .dropdown-menu," (Indicator: "open")29:T426,Launches browser "msedge.exe" (UID: 00000000-00007340) Launches browser "msedge.exe" (UID: 00000000-00006884) Launches browser "msedge.exe" (UID: 00000000-00005508) Launches browser "msedge.exe" (UID: 00000000-00006508) Launches browser "msedge.exe" (UID: 00000000-00002624) Launches browser "msedge.exe" (UID: 00000000-00007416) Launches browser "msedge.exe" (UID: 00000000-00007312) Launches browser "msedge.exe" (UID: 00000000-00008164) Launches browser "msedge.exe" (UID: 00000000-00008088) Launches browser "msedge.exe" (UID: 00000000-00003248) Launches browser "msedge.exe" (UID: 00000000-00007600) Launches browser "msedge.exe" (UID: 00000000-00002628) Launches browser "msedge.exe" (UID: 00000000-00002404) Launches browser "msedge.exe" (UID: 00000000-00006344) Launches browser "msedge.exe" (UID: 00000000-00006572) Launches browser "msedge.exe" (UID: 00000000-00005156) Launches browser "msedge.exe" (UID: 00000000-00006040) Launches browser "msedge.exe" (UID: 00000000-00002988) Launches browser "msedge.exe" (UID: 00000000-00002556)2a:Ta42,Process "msedge.exe" (UID: 00000000-00006112) was launched with new environment variables: "PATH="C:\Program Files (x86)\Microsoft\Edge\Application"" Process "msedge.exe" (UID: 00000000-00006112) was launched with missing environment variables: "MEOW" Process "msedge.exe" (UID: 00000000-00007340) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_6112_UEFCWFBUQTBNEXVA", EDGE_BROWSER_PID="6112"" Process "msedge.exe" (UID: 00000000-00007340) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "msedge.exe" (UID: 00000000-00007340) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00006884) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="0", EDGE_USER_DATA_DIR="C:\Users\6Cke7gA\AppData\Local\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="0"" Process "msedge.exe" (UID: 00000000-00005508) was launched with modified environment variables: "EDGE_METRICS_SESSION_ID, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00006508) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT"" Process "msedge.exe" (UID: 00000000-00006844) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00006844) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "msedge.exe" (UID: 00000000-00006844) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_METRICS_CLIENT_ID_HASH, CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00002404) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_6844_XFIAXKKUILJDQSQR", EDGE_BROWSER_PID="6844"" Process "msedge.exe" (UID: 00000000-00002404) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "msedge.exe" (UID: 00000000-00002404) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00006344) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="14", EDGE_USER_DATA_DIR="C:\Users\6Cke7gA\AppData\Local\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325""2b:Ta9b,Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\Microsof ..." (UID: 00000000-00007340), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00006884), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00005508), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00006508), Spawned process "msedge.exe" with commandline "--type=renderer --first-renderer-process --lang=en-US --js-flags ..." (UID: 00000000-00002624), Spawned process "msedge.exe" with commandline "--type=renderer --lang=en-US --js-flags=--ms-user-locale= --devi ..." (UID: 00000000-00007416), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --disable-gpu-compositing -- ..." (UID: 00000000-00007312), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --disable-gpu-compositing -- ..." (UID: 00000000-00008164), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --disable-gpu-compositing -- ..." (UID: 00000000-00008088), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --disable-gpu-compositing -- ..." (UID: 00000000-00003248), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --disable-gpu-compositing -- ..." (UID: 00000000-00007600), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00002628), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\Microsof ..." (UID: 00000000-00002404) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00006344) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00006572) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00005156) Spawned process "msedge.exe" with commandline "--type=renderer --first-renderer-process --lang=en-US --js-flags ..." (UID: 00000000-00006040) Spawned process "msedge.exe" with commandline "--type=renderer --lang=en-US --js-flags=--ms-user-locale= --devi ..." (UID: 00000000-00002988) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00002556)2c:Tbb5,"1.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Thu Dec 8 08:10:47 2022 mtime=Thu Dec 8 08:10:47 2022 atime=Thu Dec 8 08:11:01 2022 length=514415 window=hide"- Location: [%APPDATA%\Microsoft\Office\Recent\1.LNK]- [targetUID: 00000000-00007464] "~_1.docx" has type "data"- [targetUID: N/A] "index" has type "FoxPro FPT blocks size 768 next free block index 3284796353 field type 0 dBase III DBT version number 0 next free block index 3238251203"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\GrShaderCache\index]- [targetUID: 00000000-00006844] "load_statistics.db-wal" has type "SQLite Write-Ahead Log version 3007000"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db-wal]- [targetUID: 00000000-00006844] "data_2" has type "dBase III DBT version number 0 next free block index 3238316739"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\GrShaderCache\data_2]- [targetUID: 00000000-00006844] "863b4511-fa3d-4155-b158-66f2aafc0771.tmp" has type "UTF-8 Unicode text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\863b4511-fa3d-4155-b158-66f2aafc0771.tmp]- [targetUID: 00000000-00006112] "QuotaManager-journal" has type "SQLite Rollback Journal"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal]- [targetUID: 00000000-00006112] "settings.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\settings.dat]- [targetUID: 00000000-00007340] "data_1" has type "dBase III DBT version number 0 next free block index 3238316739"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\GrShaderCache\data_1]- [targetUID: 00000000-00006844] "~WRS_EAA9DA38-F2CD-49D7-B825-112DF6D135A9_.tmp" has type "Targa image data - RLE 80 x 69 x 32 +72 +65 "X""- [targetUID: N/A] "data_0" has type "FoxPro FPT blocks size 512 next free block index 3284796609 field type 0 dBase III DBT version number 0 next free block index 3238316739"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\GrShaderCache\data_0]- [targetUID: 00000000-00006844] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG]- [targetUID: 00000000-00006844] "index.dat" has type "data"- Location: [%APPDATA%\Microsoft\Office\Recent\index.dat]- [targetUID: 00000000-00007464] "Variations" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Variations]- [targetUID: 00000000-00006844] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log]- [targetUID: 00000000-00006844] "FSF-_0E1EEE64-E8C6-4E2A-9759-63CF07FD8988_.FSF" has type "data"- [targetUID: N/A] "data_3" has type "dBase III DBT version number 0 next free block index 3238316739"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\GrShaderCache\data_3]- [targetUID: 00000000-00006844]2d:T1eaf,Pattern match: "http://www.ries.or.kr/" Pattern match: "http://www.ries.or.kr" Heuristic match: "ries.or.kr" Pattern match: "www.principledtechnologies.com},{applied_policy:block,domain:web.basemark.com},{applied_policy:block,domain:mozilla.github.io},{applied_policy:block,domain:html5test.com},{applied_policy:block,domain:necromanthus.com},{app" Pattern match: "https://www.ries.or.kr//" Pattern match: "https://cdn.imweb.me/upload/S2021072425c3a5f15c741/e09aadbe88c7c.png" Pattern match: "https://www.ries.or.kr/" Pattern match: "https://cdn.imweb.me/upload/S2021072425c3a5f15c741/0751647daa327.ico" Pattern match: "https://cdn.imweb.me/thumbnail/20210724/3ec473ddd9cf3.png" Pattern match: "https://cdn.imweb.me/thumbnail/20210724/61e983c3281a1.png" Pattern match: "https://cdn.imweb.me/thumbnail/20210724/c405541b182ca.png" Pattern match: "https://cdn.imweb.me/thumbnail/20210724/7f602449df6ef.png" Pattern match: "https://cdn.imweb.me/thumbnail/20210724/634ce6d8953c3.png" Pattern match: "https://cdn.imweb.me/thumbnail/20210724/2b45101cb7547.png" Pattern match: "https://cdn.imweb.me/thumbnail/20210724/84d70f49360e7.png" Pattern match: "https://cdn.imweb.me/thumbnail/20210724/7883c120b53f3.png" Pattern match: "https://cdn.imweb.me/thumbnail/20210724/bfe5c8ea5f65c.png" Pattern match: "https://cdn.imweb.me/thumbnail/20210724/facd9d3a26580.png" Pattern match: "https://cdn.imweb.me/thumbnail/20210724/444321b699177.png" Pattern match: "https://cdn.imweb.me/thumbnail/20210724/823fa6ff3a892.png" Pattern match: "https://cdn.imweb.me/thumbnail/20210724/76fd222496912.png" Pattern match: "https://cdn.imweb.me/thumbnail/20210724/50543678a56f1.png" Pattern match: "https://cdn.imweb.me/thumbnail/20210724/11f06574ae36a.png" Pattern match: "https://cdn.imweb.me/thumbnail/20210724/80bd2fc154fff.png" Pattern match: "https://cdn.imweb.me/thumbnail/20210724/7ac60a5e5cc64.png" Pattern match: "https://vendor-cdn.imweb.me/minify_css/vendor_blue_10.css?1653367465'/" Pattern match: "https://vendor-cdn.imweb.me/minify_css/vendor_red_10.css?1653367465'/" Pattern match: "https://vendor-cdn.imweb.me/css/site/bootstrap.css?1590627710'/" Pattern match: "https://vendor-cdn.imweb.me/css/owl.carousel1.css?1577682282'/" Pattern match: "https://vendor-cdn.imweb.me/css/im_component.css?1636689958'/" Pattern match: "https://vendor-cdn.imweb.me/css/site/alarm_menu.css?1648796493'/" Pattern match: "https://vendor-cdn.imweb.me/css/function.css?1666824024'/" Pattern match: "https://vendor-cdn.imweb.me/css/site/site.css?1669163215'/" Pattern match: "https://vendor-cdn.imweb.me/css/site/site2.css?1669875597'/" Pattern match: "https://vendor-cdn.imweb.me/css/site/iefix.css?1590627710'/" Pattern match: "https://vendor-cdn.imweb.me/css/site/iefix2.css?1590627710'/" Pattern match: "https://vendor-cdn.imweb.me/css/animate.css?1577682282'/" Pattern match: "https://vendor-cdn.imweb.me/css/chosen.css?1617331870'/" Pattern match: "https://vendor-cdn.imweb.me/css/chosenImage.css?1617331762'/" Pattern match: "https://vendor-cdn.imweb.me/fonts/im-icon/style.css?1666824024'/" Pattern match: "https://vendor-cdn.imweb.me/fonts/pretendard/web/variable/pretendardvariable.css?1669875619'/" Pattern match: "https://vendor-cdn.imweb.me/fonts/pretendard/web/static/pretendard.css?1669875619'/" Pattern match: "https://vendor-cdn.imweb.me/fonts/froala-emoji-tap/style.css?1669163161'/" Pattern match: "https://vendor-cdn.imweb.me/css/tailwind.css?1670395877'/" Pattern match: "https://vendor-cdn.imweb.me/css/emoji.css?1669163161'/" Pattern match: "https://vendor-cdn.imweb.me/css/font-awesome5.min.css?1669163183'/" Pattern match: "https://vendor-cdn.imweb.me/js/jquery.js?1627517460" Pattern match: "https://vendor-cdn.imweb.me/js/jquery-ui.design.js?1627517437" Pattern match: "https://vendor-cdn.imweb.me/js/lodash.min.js?1656295899" Pattern match: "https://cdn.imweb.me/upload/" Pattern match: "https://cdn.imweb.me/thumbnail/" Pattern match: "https://vendor-cdn.imweb.me" Pattern match: "www.ries.or.kr\/,_img:https:\/\/cdn.imweb.me\/upload\/S2021072425c3a5f15c741\/e09aadbe88c7c.png,_security_post_url:aHR0cHM6Ly93d3cucmllcy5vci5rci8=" Pattern match: "https://t1.daumcdn.net/mapjsapi/bundle/postcode/prod/postcode.v2.js" Pattern match: "https://page.stibee.com/archives/73242" Pattern match: "https://cdn.imweb.me/thumbnail/20211029/3e26c251546c5.png" Pattern match: "https://cdn.imweb.me/thumbnail/20211029/b3a05bde6cfb1.png" Pattern match: "https://vendor-cdn.imweb.me/js/bootstrap.min.js?1630317768" Pattern match: "https://vendor-cdn.imweb.me/js/html5shiv.min.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/respond.min.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/placeholders.min.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/PIE_IE678.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/jquery.fileupload.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/jquery.lazyload.min.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/common.js?1669875619" Pattern match: "https://vendor-cdn.imweb.me/js/im_component.js?1636940317" Pattern match: "https://vendor-cdn.imweb.me/js/site_common.js?1670386807" Pattern match: "https://vendor-cdn.imweb.me/js/imagesloaded.pkgd.min.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/jquery.smooth-scroll.min.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/gambit-smoothscroll-min.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/ThreeCanvas.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/snow.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/masonry.pkgd.min.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/lightgallery-all.min.js?1596595980" Pattern match: "https://vendor-cdn.imweb.me/js/bootstrap.slide-menu.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/bootstrap.slide-menu-alarm.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/bootstrap-hover-dropdown.min.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/jquery-scrolltofixed.js?1669067096" Pattern match: "https://vendor-cdn.imweb.me/js/jquery.trackpad-scroll-emulator.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/modernizr.custom.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/classie.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/jquery.exif.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/jquery.canvasResize.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/autosize.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/owl.carousel2.js?1638150602" Pattern match: "https://vendor-cdn.imweb.me/js/owl.carousel1.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/slick.min.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/jquery.number.min.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/nprogress.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/tinycolor-min.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/moment.min.js?1629764594" Pattern match: "https://vendor-cdn.imweb.me/js/moment-with-locales.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/bootstrap-datepicker.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/jquery.timepicker.min.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/ie-checker-min.js?1577682292" Pattern match: "https://vendor-cdn.imweb.me/js/jquery.chosen.js?1619084781" Pattern match: "https://wcs.naver.net/wcslog.js" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4wtc3?ver=79e5,PORTRAIT:https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4wqHh?ver=0f07,copyright:Yuanping"2e:T5e4,"" (Indicator: "https://") "" (Indicator: "https://") "" (Indicator: "https://") "" (Indicator: "https://") "" (Indicator: "https://") "" (Indicator: "https://") "" (Indicator: "https://") "" (Indicator: "https://") "" (Indicator: "https://") "" (Indicator: "https://") "" (Indicator: "https://")2f:T934,"2022/12/08-00:14:24.352 12e8 Reusing MANIFEST C:\Users\6Cke7gA\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001 2022/12/08-00:14:24.455 12e8 Recovering log #3 2022/12/08-00:14:24.468 12e8 Reusing old log C:\Users\6Cke7gA\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log" (Indicator: "microsoft\edge\user data") in Source: LOG "2022/12/08-00:14:24.352 12e8 Reusing MANIFEST C:\Users\6Cke7gA\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001" (Indicator: "microsoft\edge\user data") in Source: LOG "2022/12/08-00:14:24.468 12e8 Reusing old log C:\Users\6Cke7gA\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log" (Indicator: "microsoft\edge\user data") in Source: LOG "2022/12/08-00:14:12.533 298 Reusing MANIFEST C:\Users\6Cke7gA\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001 2022/12/08-00:14:12.628 298 Recovering log #3 2022/12/08-00:14:12.630 298 Reusing old log C:\Users\6Cke7gA\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log" (Indicator: "microsoft\edge\user data") in Source: LOG "2022/12/08-00:14:12.533 298 Reusing MANIFEST C:\Users\6Cke7gA\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001" (Indicator: "microsoft\edge\user data") in Source: LOG "2022/12/08-00:14:12.630 298 Reusing old log C:\Users\6Cke7gA\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log" (Indicator: "microsoft\edge\user data") in Source: LOG "2022/12/08-00:14:16.183 1fec Reusing MANIFEST C:\Users\6Cke7gA\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001 2022/12/08-00:14:16.300 1fec Recovering log #3 2022/12/08-00:14:16.302 1fec Reusing old log C:\Users\6Cke7gA\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log" (Indicator: "microsoft\edge\user data") in Source: LOG "2022/12/08-00:14:16.183 1fec Reusing MANIFEST C:\Users\6Cke7gA\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001" (Indicator: "microsoft\edge\user data") in Source: LOG "2022/12/08-00:14:16.302 1fec Reusing old log C:\Users\6Cke7gA\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log" (Indicator: "microsoft\edge\user data") in Source: LOG1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"56ca24b57c4559f834c190d50b0fe89dd4a4040a078ca1f267d0bbc7849e9ed7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790794176704,"unified_at":"2026-09-30T18:49:36.704Z","metadata":{"hashes":{"sha256":"56ca24b57c4559f834c190d50b0fe89dd4a4040a078ca1f267d0bbc7849e9ed7","sha1":"a31a6f77f1595cdb3224f535ace59b313affd764","md5":"44ac1b727c9a4c94598b7b8fb25e2d2f","sha512":"6cf2d34ba40655cd52842b4ca37120bb6612de6a5fe5891208ab28e5d72888091e263a58d21c2aee1959f035aa9319d5fc55045d31ee026397d742905689313f","ssdeep":"12288:VB6/6dIL4wtP0AeFD9E8eSoslQKB+oHVfQA5vYTNveKzI:VB26dbweAeFi1S1QBE1vA8","ssdeep_chunks":["12288:VB6/6dI","12288:B6/6dIL","12288:6/6dIL4","12288:/6dIL4w","12288:6dIL4wt","12288:dIL4wtP","12288:IL4wtP0","12288:L4wtP0A","12288:4wtP0Ae","12288:wtP0AeF","12288:tP0AeFD","12288:P0AeFD9","12288:0AeFD9E","12288:AeFD9E8","12288:eFD9E8e","12288:FD9E8eS","12288:D9E8eSo","12288:9E8eSos","12288:E8eSosl","12288:8eSoslQ","12288:eSoslQK","12288:SoslQKB","12288:oslQKB+","12288:slQKB+o","12288:lQKB+oH","12288:QKB+oHV","12288:KB+oHVf","12288:B+oHVfQ","12288:+oHVfQA","12288:oHVfQA5","12288:HVfQA5v","12288:VfQA5vY","12288:fQA5vYT","12288:QA5vYTN","12288:A5vYTNv","12288:5vYTNve","12288:vYTNveK","12288:YTNveKz","12288:TNveKzI","24576:VB6/6dI","24576:B6/6dIL","24576:6/6dIL4","24576:/6dIL4w","24576:6dIL4wt","24576:dIL4wtP","24576:IL4wtP0","24576:L4wtP0A","24576:4wtP0Ae","24576:wtP0AeF","24576:tP0AeFD","24576:P0AeFD9","24576:0AeFD9E","24576:AeFD9E8","24576:eFD9E8e","24576:FD9E8eS","24576:D9E8eSo","24576:9E8eSos","24576:E8eSosl","24576:8eSoslQ","24576:eSoslQK","24576:SoslQKB","24576:oslQKB+","24576:slQKB+o","24576:lQKB+oH","24576:QKB+oHV","24576:KB+oHVf","24576:B+oHVfQ","24576:+oHVfQA","24576:oHVfQA5","24576:HVfQA5v","24576:VfQA5vY","24576:fQA5vYT","24576:QA5vYTN","24576:A5vYTNv","24576:5vYTNve","24576:vYTNveK","24576:YTNveKz","24576:TNveKzI","12288:VB26dbw","12288:B26dbwe","12288:26dbweA","12288:6dbweAe","12288:dbweAeF","12288:bweAeFi","12288:weAeFi1","12288:eAeFi1S","12288:AeFi1S1","12288:eFi1S1Q","12288:Fi1S1QB","12288:i1S1QBE","12288:1S1QBE1","12288:S1QBE1v","12288:1QBE1vA","12288:QBE1vA8"],"imphash":"Unknown"},"file_info":{"file_name":"1.docx","file_type":["docx","office"],"file_type_id":"docx","file_size":514415,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1670486796000,"last_seen":1690922409000,"last_multi_scan":1690922409000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":10,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":5},"sandbox_signatures":{"informative_count":20,"suspicious_count":4,"malicious_count":3,"total":27},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Downloader/DOC.Kimsuky.SC184472","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/Word.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.64108480","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.64108480 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Downloader.MSOffice.Agent.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DocDl-AGTB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Trojan.49CCAC41","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Trojan.49CCAC41","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"URL/CVE170199.HB.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found browser information locations related strings"},{"type":"informative","value":"Found browsers sensitive information related strings"},{"type":"informative","value":"Tries to access browsers sensitive information (file access)"},{"type":"suspicious","value":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"34.98.99.30:443\"\n \"18.160.181.129:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$27","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"~_1.docx\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$28","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"\"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/4.0 (\")\n \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .N\" (Indicator: \"mozilla/4.0 (\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"$29","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 46E50000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$2a","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ms-office.services\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$2b","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$2c","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops LNK files (Windows shortcut)","description":"\"1.LNK\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Thu Dec 8 08:10:47 2022 mtime=Thu Dec 8 08:10:47 2022 atime=Thu Dec 8 08:11:01 2022 length=514415 window=hide\"- Location: [%APPDATA%\\Microsoft\\Office\\Recent\\1.LNK]- [targetUID: 00000000-00007464]","origin":"Binary File","relevance":5,"id":"binary-31","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"1.0.0.23\" found in string \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Trust Protection Lists\\1.0.0.23\\Mu\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2d","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"\"HTTPS traffic to 34.98.99.30 on port 443\"\n \"HTTPS traffic to 18.160.181.129 on port 443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"\" (Indicator: \"youtube\")\n \"var section_youtube_list = [];\" (Indicator: \"youtube\")\n \"var video_autoplay_youtube_list = [];\" (Indicator: \"youtube\")\n \"function onYouTubeIframeAPIReady() {\" (Indicator: \"youtube\")\n \"$.each(section_youtube_list,function(_e, _data){\" (Indicator: \"youtube\")\n \"yt_player[_data.slide_code] = new SITE_SECTION_YOUTUBE();\" (Indicator: \"youtube\")\n \"$.each(video_autoplay_youtube_list, function(k, v){\" (Indicator: \"youtube\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found browsers sensitive information related strings","description":"\"2022/12/08-00:14:24.352 12e8 Reusing MANIFEST %LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb/MANIFEST-000001\n2022/12/08-00:14:24.455 12e8 Recovering log #3\n2022/12/08-00:14:24.468 12e8 Reusing old log %LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb/000003.log\" in Source: LOG\n \"2022/12/08-00:14:24.352 12e8 Reusing MANIFEST %LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb/MANIFEST-000001\" in Source: LOG\n \"2022/12/08-00:14:24.468 12e8 Reusing old log %LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb/000003.log\" in Source: LOG","origin":"File/Memory","mitre_attack_id":"T1005","relevance":3,"id":"string-133","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Tries to access browsers sensitive information (file access)","description":"\"msedge.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Local Storage\\leveldb\\000003.log\"\n \"msedge.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\LEVELDB__TMP_FOR_REBUILD\"\n \"msedge.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb\\LOG\"\n \"msedge.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb\\LOG.old\"\n \"msedge.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb\\CURRENT\"\n \"msedge.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb\\MANIFEST-000001\"\n \"msedge.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb\\000003.log\"\n \"msedge.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\LEVELDB__TMP_FOR_REBUILD\"","origin":"API Call","mitre_attack_id":"T1005","relevance":5,"id":"api-132","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"1.LNK\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\1.LNK]- [targetUID: 00000000-00007464]\n Dropped file: \"index.dat\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\index.dat]- [targetUID: 00000000-00007464]","origin":"Binary File","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"15/64 Antivirus vendors marked sample as malicious (23% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 34.98.99.30 on port 443 is sent without HTTP header\n TCP traffic to 18.160.181.129 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1005","relevance":5,"id":"string-93","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"\"WINWORD.EXE\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\History\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: msoffice/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"15/64 Antivirus vendors marked sample as malicious (23% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]}]},"activity":{"stats":{"process_count":22,"spawned_processes_count":22,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":78,"imported_dlls_count":185,"dropped_files_count":0,"extracted_files_count":24,"files_written_count":34,"files_deleted_count":0,"registry_keys_created_count":15,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":15,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Carved Files","Sample not shared","User Comment"],"sandbox_reports":[{"id":"6439ba4d41ccb103e306233d","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"The sample's file type, \"GENERIC_ZIP_ARCHIVE\" is not supported.","verdict":"undetected","submit_name":"56ca24b57c4559f834c190d50b0fe89dd4a4040a078ca1f267d0bbc7849e9ed7","analysis_start_time":"2023-04-14T20:40:45+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"63919b0c379b8b7a7d5ef1f5","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"CVE-2017-0199","contacted_countries":["USA"],"submit_name":"1.docx","analysis_start_time":"2022-12-08T08:06:37+00:00","indicators_count":{"informative":20,"suspicious":4,"malicious":3},"tags":["Multi-Process","Network Traffic","Extracted Files","Carved Files","Sample not shared","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"34.98.99.30","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"address":"18.160.181.129","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]}],"dns_resolutions":[{"domain":"ms-office.services","address":"34.98.99.30","ttl":600,"country":"United States","registrar_name":"GoDaddy.com, LLC","registrar_organization":"Domains By Proxy, LLC","registrar_name_servers":"ns41.domaincontrol.com","registrar_creation_date":"2022-10-24T09:08:59+00:00","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}],"processes":[{"pid":7464,"ppid":0,"name":"WINWORD.EXE","command_line":"/n \"C:\\1.docx\"","sha256":"007b8c7a282521d8981386fb31abda08f3710239c7bb83d8da3b5a9826ebe246","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","uid":"00000000-00007464","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACkUlEQVR42u2XWYviUBBG+4/P0O5bNO5L3Nc/5Mv0Qw++yCgKgqAmRq3Ol3hjjIla9jwNEyhakeacKm/VLd/e/j8ez3A4JMRgMKB+v0+9Xo+63R51ul3qdDrUbrep1WpRs9miRrNJ9UaDlHqdFKVOtZpCTeOzYrFI3xI4Ho83cXDGwR0HOp1ONBqNaDKZmFIvSyBzAHVdpz1iL2JPmgjN+qtqIjRTAgLr9Zo+P39TTVFIfkUCZfcSsOF4fUdgtVrRcrmkXx8fVKnWSJZlngS+cwjs/QQ0K1TNW2CxWNB8PqfpdErj8ZjK5QpPAAfOFvArvwPsFpAk6Sqy+TxPAKfdFNg/UX71IoDXMyPzPzMRM6MaS8rmckwBo9WEgObMXMA9yi8Eds7YqcY5OpCcZQqgz9FqD+Gu7K8FVFsgI2d5AhgyloB+Bb4++dr97A2B7VkgnWF2ASYchos3GO+16/L7ZC8EpEyGJ4DxalbgptedZfeDX7IXAql0mieAMYoK3IDV27J7wUX2toDEFMDFgp62IT4n/hFcCCRTElNAqbsqoF2HJ1y7gVsCOiWSKZ4ArlS7Ai6oJ9gjcxGYpvFkkidQrdUsAfUR+D58u92ZArEEU6BSrZJuCOx8oc/BN2eBaDzBEyhXKg8ELPAjuC0Qi/MESmW3gHqJe2AXXAhEojGmQKlsto+APYSeY+OCC4FwNMoTKJZKpsD2CahX1m6BUIQpUDD2uKcE7oCdAsFwhCeQL9wT2D0FdgoEQmGeQC5fMCeYgHGAngLBEE8AOxz+cfMNsFPgnS1g7HD2RvwX4mcgyBPADoc1CpsMlgnc57hScavhYsFsx3jFhMOQQZ+j1XDaceDwnaPsyBzwH++B13+m/fPPF5bXZc63W0KBAAAAAElFTkSuQmCC"},{"pid":6112,"ppid":0,"name":"msedge.exe","command_line":"--single-argument C:\\extra_0.html","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00006112","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACkUlEQVR42u2XWYviUBBG+4/P0O5bNO5L3Nc/5Mv0Qw++yCgKgqAmRq3Ol3hjjIla9jwNEyhakeacKm/VLd/e/j8ez3A4JMRgMKB+v0+9Xo+63R51ul3qdDrUbrep1WpRs9miRrNJ9UaDlHqdFKVOtZpCTeOzYrFI3xI4Ho83cXDGwR0HOp1ONBqNaDKZmFIvSyBzAHVdpz1iL2JPmgjN+qtqIjRTAgLr9Zo+P39TTVFIfkUCZfcSsOF4fUdgtVrRcrmkXx8fVKnWSJZlngS+cwjs/QQ0K1TNW2CxWNB8PqfpdErj8ZjK5QpPAAfOFvArvwPsFpAk6Sqy+TxPAKfdFNg/UX71IoDXMyPzPzMRM6MaS8rmckwBo9WEgObMXMA9yi8Eds7YqcY5OpCcZQqgz9FqD+Gu7K8FVFsgI2d5AhgyloB+Bb4++dr97A2B7VkgnWF2ASYchos3GO+16/L7ZC8EpEyGJ4DxalbgptedZfeDX7IXAql0mieAMYoK3IDV27J7wUX2toDEFMDFgp62IT4n/hFcCCRTElNAqbsqoF2HJ1y7gVsCOiWSKZ4ArlS7Ai6oJ9gjcxGYpvFkkidQrdUsAfUR+D58u92ZArEEU6BSrZJuCOx8oc/BN2eBaDzBEyhXKg8ELPAjuC0Qi/MESmW3gHqJe2AXXAhEojGmQKlsto+APYSeY+OCC4FwNMoTKJZKpsD2CahX1m6BUIQpUDD2uKcE7oCdAsFwhCeQL9wT2D0FdgoEQmGeQC5fMCeYgHGAngLBEE8AOxz+cfMNsFPgnS1g7HD2RvwX4mcgyBPADoc1CpsMlgnc57hScavhYsFsx3jFhMOQQZ+j1XDaceDwnaPsyBzwH++B13+m/fPPF5bXZc63W0KBAAAAAElFTkSuQmCC"},{"pid":7340,"ppid":6112,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=108.0.5359.95 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=108.0.1462.42 --initial-client-data=0x148,0x14c,0x150,0xb0,0x158,0x7ffb4ac7f2e8,0x7ffb4ac7f2f8,0x7ffb4ac7f308","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006112","uid":"00000000-00007340"},{"pid":6884,"ppid":6112,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 --field-trial-handle=1824,i,3558189489587122558,13555647572299671042,131072 /prefetch:2","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006112","uid":"00000000-00006884"},{"pid":5508,"ppid":6112,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1824,i,3558189489587122558,13555647572299671042,131072 /prefetch:3","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006112","uid":"00000000-00005508"},{"pid":6508,"ppid":6112,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2276 --field-trial-handle=1824,i,3558189489587122558,13555647572299671042,131072 /prefetch:8","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006112","uid":"00000000-00006508"},{"pid":2624,"ppid":6112,"name":"msedge.exe","command_line":"--type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1670485898615982 --launch-time-ticks=1325626595 --mojo-platform-channel-handle=3176 --field-trial-handle=1824,i,3558189489587122558,13555647572299671042,131072 /prefetch:1","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006112","uid":"00000000-00002624"},{"pid":7416,"ppid":6112,"name":"msedge.exe","command_line":"--type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1670485898615982 --launch-time-ticks=1326875274 --mojo-platform-channel-handle=3280 --field-trial-handle=1824,i,3558189489587122558,13555647572299671042,131072 /prefetch:1","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006112","uid":"00000000-00007416"},{"pid":7312,"ppid":6112,"name":"msedge.exe","command_line":"--type=renderer --extension-process --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1670485898615982 --launch-time-ticks=1328247583 --mojo-platform-channel-handle=4080 --field-trial-handle=1824,i,3558189489587122558,13555647572299671042,131072 /prefetch:1","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006112","uid":"00000000-00007312"},{"pid":8164,"ppid":6112,"name":"msedge.exe","command_line":"--type=renderer --extension-process --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --time-ticks-at-unix-epoch=-1670485898615982 --launch-time-ticks=1329531367 --mojo-platform-channel-handle=4216 --field-trial-handle=1824,i,3558189489587122558,13555647572299671042,131072 /prefetch:1","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006112","uid":"00000000-00008164"},{"pid":8088,"ppid":6112,"name":"msedge.exe","command_line":"--type=renderer --extension-process --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1670485898615982 --launch-time-ticks=1331105496 --mojo-platform-channel-handle=4368 --field-trial-handle=1824,i,3558189489587122558,13555647572299671042,131072 /prefetch:1","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006112","uid":"00000000-00008088"},{"pid":3248,"ppid":6112,"name":"msedge.exe","command_line":"--type=renderer --extension-process --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1670485898615982 --launch-time-ticks=1332682331 --mojo-platform-channel-handle=4392 --field-trial-handle=1824,i,3558189489587122558,13555647572299671042,131072 /prefetch:1","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006112","uid":"00000000-00003248"},{"pid":7600,"ppid":6112,"name":"msedge.exe","command_line":"--type=renderer --extension-process --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1670485898615982 --launch-time-ticks=1333700798 --mojo-platform-channel-handle=4424 --field-trial-handle=1824,i,3558189489587122558,13555647572299671042,131072 /prefetch:1","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006112","uid":"00000000-00007600"},{"pid":2628,"ppid":6112,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3216 --field-trial-handle=1824,i,3558189489587122558,13555647572299671042,131072 /prefetch:8","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006112","uid":"00000000-00002628"},{"pid":6844,"ppid":0,"name":"msedge.exe","command_line":"--single-argument C:\\extra_1.html","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00006844","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACkUlEQVR42u2XWYviUBBG+4/P0O5bNO5L3Nc/5Mv0Qw++yCgKgqAmRq3Ol3hjjIla9jwNEyhakeacKm/VLd/e/j8ez3A4JMRgMKB+v0+9Xo+63R51ul3qdDrUbrep1WpRs9miRrNJ9UaDlHqdFKVOtZpCTeOzYrFI3xI4Ho83cXDGwR0HOp1ONBqNaDKZmFIvSyBzAHVdpz1iL2JPmgjN+qtqIjRTAgLr9Zo+P39TTVFIfkUCZfcSsOF4fUdgtVrRcrmkXx8fVKnWSJZlngS+cwjs/QQ0K1TNW2CxWNB8PqfpdErj8ZjK5QpPAAfOFvArvwPsFpAk6Sqy+TxPAKfdFNg/UX71IoDXMyPzPzMRM6MaS8rmckwBo9WEgObMXMA9yi8Eds7YqcY5OpCcZQqgz9FqD+Gu7K8FVFsgI2d5AhgyloB+Bb4++dr97A2B7VkgnWF2ASYchos3GO+16/L7ZC8EpEyGJ4DxalbgptedZfeDX7IXAql0mieAMYoK3IDV27J7wUX2toDEFMDFgp62IT4n/hFcCCRTElNAqbsqoF2HJ1y7gVsCOiWSKZ4ArlS7Ai6oJ9gjcxGYpvFkkidQrdUsAfUR+D58u92ZArEEU6BSrZJuCOx8oc/BN2eBaDzBEyhXKg8ELPAjuC0Qi/MESmW3gHqJe2AXXAhEojGmQKlsto+APYSeY+OCC4FwNMoTKJZKpsD2CahX1m6BUIQpUDD2uKcE7oCdAsFwhCeQL9wT2D0FdgoEQmGeQC5fMCeYgHGAngLBEE8AOxz+cfMNsFPgnS1g7HD2RvwX4mcgyBPADoc1CpsMlgnc57hScavhYsFsx3jFhMOQQZ+j1XDaceDwnaPsyBzwH++B13+m/fPPF5bXZc63W0KBAAAAAElFTkSuQmCC"},{"pid":2404,"ppid":6844,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=108.0.5359.95 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=108.0.1462.42 --initial-client-data=0x148,0x14c,0x150,0xa8,0x168,0x7ffb4ac7f2e8,0x7ffb4ac7f2f8,0x7ffb4ac7f308","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006844","uid":"00000000-00002404"},{"pid":6344,"ppid":6844,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 --field-trial-handle=3360,i,14676776068055816507,820743937535827349,131072 /prefetch:2","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006844","uid":"00000000-00006344"},{"pid":6572,"ppid":6844,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=3360,i,14676776068055816507,820743937535827349,131072 /prefetch:3","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006844","uid":"00000000-00006572"},{"pid":5156,"ppid":6844,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2184 --field-trial-handle=3360,i,14676776068055816507,820743937535827349,131072 /prefetch:8","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006844","uid":"00000000-00005156"},{"pid":6040,"ppid":6844,"name":"msedge.exe","command_line":"--type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1670485898615809 --launch-time-ticks=1359652181 --mojo-platform-channel-handle=2884 --field-trial-handle=3360,i,14676776068055816507,820743937535827349,131072 /prefetch:1","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006844","uid":"00000000-00006040"},{"pid":2988,"ppid":6844,"name":"msedge.exe","command_line":"--type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1670485898615809 --launch-time-ticks=1360716864 --mojo-platform-channel-handle=2892 --field-trial-handle=3360,i,14676776068055816507,820743937535827349,131072 /prefetch:1","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006844","uid":"00000000-00002988"},{"pid":2556,"ppid":6844,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4088 --field-trial-handle=3360,i,14676776068055816507,820743937535827349,131072 /prefetch:8","sha256":"1c4d1f6291d083bb6adb681e6cb50b2fd7d4c5b26efdfcd108f901194abb3a7d","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006844","uid":"00000000-00002556"}],"all_imported_dlls":["msimg32.dll","RICHED20.DLL","microsoft_apis.dll","setupapi.dll","wlanapi.dll","mscoree.dll","ntmarta.dll","CoreMessaging.dll","drprov.dll","d3d11.dll","linkinfo.dll","wintrust.dll","atlthunk.dll","ucrtbase.dll","imagehlp.dll","USP10.DLL","mfperfhelper.dll","DolbyDecMFT.dll","cryptnet.dll","kernel32.dll","apphelp.dll","gdi32.dll","WWLIB.DLL","dhcpcsvc.dll","wininet.dll","TextInputFramework.dll","ntlanman.dll","mpr.dll","ninput.dll","MSO.DLL","rasadhlp.dll","msedge.dll","DWrite.dll","twinapi.dll","Windows.UI.dll","KernelBase.dll","msvcrt.dll","rpcrt4.dll","bcryptprimitives.dll","win32u.dll","coml2.dll","libGLESv2.dll","libEGL.dll","winmmbase.dll","oleaccrc.dll","shell32.dll","windows.storage.dll","bcrypt.dll","IPHLPAPI.DLL","VxSSL64.dll","OSPPC.DLL","npmproxy.dll","urlmon.dll","advapi32.dll","oleaut32.dll","ws2_32.dll","msctf.dll","cldapi.dll","davclnt.dll","WindowsCodecs.dll","OneCoreCommonProxyStub.dll","imm32.dll","cryptbase.dll","dcomp.dll","dpapi.dll","vulkan-1.dll","wevtapi.dll","msxml6r.dll","secur32.dll","webio.dll","twinapi.appcore.dll","nlaapi.dll","RTWorkQ.dll","directmanipulation.dll","sechost.dll","userenv.dll","msxml6.dll","schannel.dll","ole32.dll","mscoreei.dll","msIso.dll","winsta.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","dbghelp.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","d3dcompiler_47.dll","AcSpecfc.dll","combase.dll","user32.dll","mscms.dll","msmpeg2vdec.dll","shlwapi.dll","msvcr90.dll","dxgi.dll","msvcp110_win.dll","AcGenral.dll","dwmapi.dll","msproof7.dll","wkscli.dll","dmcmnutils.dll","dsreg.dll","mfsensorgroup.dll","kernel.appcore.dll","netprofm.dll","cryptsp.dll","Csi.dll","dnsapi.dll","oleacc.dll","vaultcli.dll","ntdll.dll","comctl32.dll","winhttp.dll","OnDemandConnRouteHelper.dll","Windows.Media.dll","policymanager.dll","srvcli.dll","cscapi.dll","CompPkgSup.dll","crypt32.dll","msasn1.dll","rpcss.dll","ffmpeg.dll","UIAutomationCore.dll","GFX.DLL","clbcatq.dll","normaliz.dll","mlang.dll","gpapi.dll","devobj.dll","Windows.Security.Authentication.Web.Core.dll","dhcpcsvc6.dll","iertutil.dll","netapi32.dll","winnlsres.dll","hlink.dll","wldp.dll","OART.DLL","sxs.dll","sfc_os.dll","rmclient.dll","mfplat.dll","Windows.Web.dll","ResourcePolicyClient.dll","ntshrui.dll","ntasn1.dll","sspicli.dll","SHCore.dll","winnsi.dll","FWPUCLNT.DLL","WinTypes.dll","fltLib.dll","ExplorerFrame.dll","msedge_elf.dll","mf.dll","dxva2.dll","vk_swiftshader.dll","ShellPreviewHandler3D.dll","mswsock.dll","rsaenh.dll","OneCoreUAPCommonProxyStub.dll","actxprxy.dll","profapi.dll","uxtheme.dll","aepic.dll","propsys.dll","netutils.dll","edputil.dll","KBDUS.DLL","ncrypt.dll","gdi32full.dll","msvcp_win.dll","CoreUIComponents.dll","winmm.dll","msvproc.dll","GdiPlus.dll","wtsapi32.dll","srpapi.dll","powrprof.dll","msi.dll","cfgmgr32.dll","version.dll","MSPTLS.DLL","nsi.dll","davhlpr.dll","DataExchange.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"~_1.docx","sha256":"2820507593b307075160abd5158557826ee851a7792cb937cbac4998a1043c05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"1.LNK","sha256":"71d534569cc4420a9aaee6efe1c0217f4b954267166b7ff119b6bd8a1680f93c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"index.dat","sha256":"984d1304354bdf19efb4b391b9110785417559984bd6b4f48cb8020c2d03359c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"07786b6f-4188-4ae8-af18-ca1a268cd123.tmp","sha256":"8a705c5b11e602650723f2346fd668e7216a9721a018cb81b8006f7b2d6782ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"4b913735-8b2a-4945-bc12-dc7d9e5529e2.tmp","sha256":"111e5bb8005ba5c938f60d421224729643d7dd31b710d8a7ceaa20afe1a9d8d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"7f868412-27a6-4bae-969c-42c494f98d33.tmp","sha256":"5d04bf3038f6f4ed03389192dd0e8f63ac64848d304285d7a84135efdd8f8f5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"settings.dat","sha256":"c2c3fd57046874bdf3cd8344e6e889cc903126dc001d0cd1e1d91765a516583c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"238760ce-1de0-437b-9c73-5fbe4fe41e47.tmp","sha256":"c6130dd1a98142f7812bd54371b65f6c76f87c36c70a12f04276ac757ec7d1c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"64408f26-3ccd-49b8-9057-bbec7bdca66a.tmp","sha256":"cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"86349057-69e0-411d-afea-503b3b7c96ea.tmp","sha256":"922d78909a6116002c129f01e8d21d551a0f9d1aed69cb4988b0debf65e94de2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"863b4511-fa3d-4155-b158-66f2aafc0771.tmp","sha256":"db12ca6199eb4ddb8a063ea9815ace6ace9cf47cd64d47753d6576322f479d84","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"88eee6b8-c3c3-404b-b9ff-0d0285bb3031.tmp","sha256":"cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"History","sha256":"103cd11030f36bd94e7c558a3f9fc87085042ff17d8e60ecd5ecac1eff8ee78b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"History-journal","sha256":"bf9259ee8710b7439c43bdf4f0df9ed5db4dbef644a11ce8e34e111d1639b568","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"HubApps Icons","sha256":"f41510509250a92b45670fd48029a2fe4a7f2ee4a822f4761ed9207a36893b07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"HubApps Icons-journal","sha256":"b2faad9a8f845ff4467804e2aa68b2e05c95d7000147f128ed8a1306a8909e94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"000003.log","sha256":"14a526be01345835fe3e467dded7a342e031359f13626b5697ad6bbf630a1474","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"LOG","sha256":"99332d813ae0c8a7added79fa8c6d814ee9d9324dde27ed2c661c3e1a2658ded","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"index.txt.tmp","sha256":"11995e7d40b5a01b13df2cd723ef3e9c47c078df6d7b75d1c20c1c4f09f3f8f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Session_13314960826393714","sha256":"cba1a648a4eb1f642253e2f77f0d141f7952090db47d2daeadcb83d6da75178d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Session_13314960871277082","sha256":"67d9d13061e517705c345b29f029c605bfd17f74fb1f97bbdf0fa450eddc17fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"extra_0.bin","sha256":"8d25557572fef00e90c8ebc8d16024a9dff8f780697424052678c68759a97f86","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"extra_1.bin","sha256":"1a473b2ccf7ee8b34bff27409cf1933b208438f74256348bd2e90032339e5dd6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"~_Normal.dotm","sha256":"2820507593b307075160abd5158557826ee851a7792cb937cbac4998a1043c05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\1C0E0314.png","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\14.0","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\07786b6f-4188-4ae8-af18-ca1a268cd123.tmp","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Local State~RF13e320.TMP","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Sync Data\\LevelDB\\LOG.old~RF13e9a8.TMP","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgePushStorageWithConnectTokenAndKey\\LOG.old~RF13e9c7.TMP","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgePushStorageWithConnectTokenAndKey\\LOG.old~RF13e9d6.TMP","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension Scripts\\LOCK","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\88eee6b8-c3c3-404b-b9ff-0d0285bb3031.tmp","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\LOG.old~RF13eeb8.TMP","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Service Worker\\Database\\LOG.old~RF13f83e.TMP","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Platform Notifications\\LOG.old~RF13f8bb.TMP","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\metadata\\LOG.old~RF13fc36.TMP","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\shared_proto_db\\LOG.old~RF13fd6e.TMP","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\GPUCache\\index","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\DawnCache\\index","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\DawnCache\\data_0","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\DawnCache\\data_1","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\DawnCache\\data_2","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\DawnCache\\data_3","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Extension State\\LOG.old~RF1406e4.TMP","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\a0876482-5356-4aac-a9fc-b9d5114ac0f4.tmp","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Local State~RF140993.TMP","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Service Worker\\CacheStorage\\3cedfb74d44f2e84198d23075aef16c34a668ceb\\index.txt.tmp","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\EdgePushStorageWithConnectTokenAndKey\\LOG.old~RF140a8d.TMP","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Service Worker\\CacheStorage\\3cedfb74d44f2e84198d23075aef16c34a668ceb\\index.txt~RF140a9d.TMP","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\IndexedDB\\https_ntp.msn.com_0.indexeddb.leveldb\\LOCK","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\DATACOLLECTION\\","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\DATACOLLECTION\\","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"key":"HKCU\\\\","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\EDGE\\BLBEACON\\\\","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\EDGE\\\\","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\\\","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"key":"HKCU\\SOFTWARE\\\\","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\EDGEUPDATE\\CLIENTSTATEMEDIUM\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\EDGE\\THIRDPARTY\\\\","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\EDGEUPDATE\\CLIENTSTATE\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACBPIDS_S-1-5-5-0-153026","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACB10_S-1-5-5-0-153026","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7464:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-7FECCE34","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_OMTX:{9CEF24FD-965E-4372-BB22-F487D4860D06}","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{0D48D5A8-BB64-4F58-B58D-15009522A762}","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{FD770FBE-50C8-4066-ADA6-5EB904302896}","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{9CEF24FD-965E-4372-BB22-F487D4860D06}","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-4607638C","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoCsi:GC:C:/Users/6Cke7gA/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-945B1DDE","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-ECA41A23","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-99413D0","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_OMTX:{F7BFAA46-C457-4EE1-A692-B1CC838EC4A5}","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{6F8B9749-6620-45C8-996D-44B12D8FF16E}","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{CCFB8885-FBCC-428F-93B1-7250F1C7D9DA}","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{F7BFAA46-C457-4EE1-A692-B1CC838EC4A5}","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-6333BD2A","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoCsi:GC:C:/Users/6Cke7gA/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-14850FB4","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Csi_CTTxnLock:{1FA12FD0-FCA4-47A3-B095-D5AABB6DDEE2}","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoShellExtRegAccess_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-6333BD2A","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-7FECCE34","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-4607638C","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Global\\MsoShellExtRegAccess_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\SM0:7464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\CSI_OMTX:{9CEF24FD-965E-4372-BB22-F487D4860D06}","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\SM0:7464:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Global\\MsoCsi:GC:C:/Users/6Cke7gA/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\CSI_WDW:{CCFB8885-FBCC-428F-93B1-7250F1C7D9DA}","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-14850FB4","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-99413D0","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\x64_10MU_ACB10_S-1-5-5-0-153026","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\x64_10MU_ACBPIDS_S-1-5-5-0-153026","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-945B1DDE","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\CSI_OMTX:{F7BFAA46-C457-4EE1-A692-B1CC838EC4A5}","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\CSI_WDW:{0D48D5A8-BB64-4F58-B58D-15009522A762}","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\Csi_CTTxnLock:{1FA12FD0-FCA4-47A3-B095-D5AABB6DDEE2}","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Global\\MsoCsi:GC:C:/Users/6Cke7gA/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\CSI_WDW:{F7BFAA46-C457-4EE1-A692-B1CC838EC4A5}","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-ECA41A23","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\CSI_WDW:{FD770FBE-50C8-4066-ADA6-5EB904302896}","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\CSI_WDW:{6F8B9749-6620-45C8-996D-44B12D8FF16E}","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\CSI_WDW:{9CEF24FD-965E-4372-BB22-F487D4860D06}","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6112:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\SM0:6112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\SM0:6112:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6884:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\SM0:6884:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6508:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\SM0:6508:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6844:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\SM0:6844:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\SM0:6844:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6844:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6344:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\SM0:6344:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\SM0:6572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5156:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\SM0:5156:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2556:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]},{"name":"Local\\SM0:2556:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63919b0c379b8b7a7d5ef1f5"}]}]}},"report_ids":{"sandbox_job_ids":["63919b0c379b8b7a7d5ef1f5"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 56ca24b57c45… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 56ca24b57c45…. Malware family: Trojan.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 3 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/56ca24b57c4559f834c190d50b0fe89dd4a4040a078ca1f267d0bbc7849e9ed7"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 56ca24b57c45… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 56ca24b57c45…. Malware family: Trojan.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 3 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/56ca24b57c4559f834c190d50b0fe89dd4a4040a078ca1f267d0bbc7849e9ed7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 56ca24b57c45… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 56ca24b57c45…. Malware family: Trojan.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 3 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]