34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 3b:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T439,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample a2b500fbb170… — Score 21/100 — Hybrid Analysis","description":"Suspicious verdict for sample a2b500fbb170…. Threat score 21/100. 1/27 AV engines flagged this file. 1 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a2b500fbb17057bc3dea4b236d0862158914b82cc07ff8b4488c728fef9ee1da","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","a2b500fbb17057bc3dea4b236d0862158914b82cc07ff8b4488c728fef9ee1da"],"about":{"@type":"SoftwareApplication","name":"anyconnect-win-3.1.04072-pre-deploy-k9.msi","applicationCategory":["msi","data"],"identifier":"a2b500fbb17057bc3dea4b236d0862158914b82cc07ff8b4488c728fef9ee1da","additionalType":"Suspicious sample"},"threatScore":21,"antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T461,"~WRS{70CBDE19-DDBB-4AB4-B485-D8ED5E546AB7}.tmp" has type "FoxPro FPT blocks size 0 next free block index 218103808 1st used item "\375"" "~WRD0000.doc" has type "dBase IV DBT of \241.DBF blocks size 14680081 next free block index 13566160 1st item "\312"" "~WRD0001.doc" has type "dBase IV DBT of \241.DBF blocks size 14680081 next free block index 13566160 1st item "\312"" "index.dat" has type "data" "ExcludeDictionaryEN0409.lex" has type "Little-endian UTF-16 Unicode text with no line terminators" "~WRD0002.doc" has type "dBase IV DBT of \241.DBF blocks size 14680081 next free block index 13566160 1st item "\312"" "~WRS{22ABFFC9-2A64-45AB-BE80-6EDFD4F3E114}.tmp" has type "data" "~$Normal.dotm" has type "data" "~$b500fbb17057bc3dea4b236d0862158914b82cc07ff8b4488c728fef9ee1da.rtf" has type "data" "a2b500fbb17057bc3dea4b236d0862158914b82cc07ff8b4488c728fef9ee1da.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Hidden Archive ctime=Tue Aug 30 14:32:03 2016 mtime=Tue Aug 30 14:32:03 2016 atime=Tue Aug 30 23:31:06 2016 length=4295168 window=hide"37:T69a,"WINWORD.EXE" touched file "C:\Windows\Globalization\Sorting\sortdefault.nls" "WINWORD.EXE" touched file "C:\Windows\Fonts\staticcache.dat" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db" "WINWORD.EXE" touched file "C:\Windows\system32\rsaenh.dll" "WINWORD.EXE" touched file "C:\Windows\system32\en-US\KERNELBASE.dll.mui" "WINWORD.EXE" touched file "C:\Windows\System32\msxml6r.dll" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{70CBDE19-DDBB-4AB4-B485-D8ED5E546AB7}.tmp" "WINWORD.EXE" touched file "C:\Windows\system32\en-US\MSCTF.dll.mui" "WINWORD.EXE" touched file "C:\Windows\system32\en-US\mlang.dll.mui" "WINWORD.EXE" touched file "C:\Windows\system32\mlang.dat" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRD0000.doc"38:T890,"WINWORD.EXE" wrote bytes "e99a548af2" to virtual address "0x76613E59" ("SysFreeString@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "ffff558b" to virtual address "0x6E227FA4" (part of module "WPFT632.CNV") "WINWORD.EXE" wrote bytes "dc79c79b" to virtual address "0x682C9904" (part of module "RICHED20.DLL") "WINWORD.EXE" wrote bytes "67726f75" to virtual address "0x6E16BE64" (part of module "MSCONV97.DLL") "WINWORD.EXE" wrote bytes "3818b962" to virtual address "0x6A3FF530" (part of module "WWLIB.DLL") "WINWORD.EXE" wrote bytes "b143b89b" to virtual address "0x683D10AC" (part of module "MSPTLS.DLL") "WINWORD.EXE" wrote bytes "c4ca3d7580bb3d7552ba3d759fbb3d7508bb3d7546ce3d7561383e75de2f3e75d0d93d7500000000177947754f9147757f6f4775f4f7477511f74775f2834775857e477500000000" to virtual address "0x6E3D1000" (part of module "MSIMG32.DLL") "WINWORD.EXE" wrote bytes "e960338bf2" to virtual address "0x76614731" ("SysAllocStringByteLen@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "e923998df2" to virtual address "0x76615DEE" ("VariantChangeType@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "48603cce" to virtual address "0x2FED1B94" (part of module "WINWORD.EXE") "WINWORD.EXE" wrote bytes "89018b4d" to virtual address "0x6E24BE64" (part of module "MSCONV97.DLL") "WINWORD.EXE" wrote bytes "268ffec0" to virtual address "0x67FB2A00" (part of module "CSS7DATA0009.DLL") "WINWORD.EXE" wrote bytes "508d851c" to virtual address "0x6E2363DC" (part of module "WPFT632.CNV") "WINWORD.EXE" wrote bytes "be50d4c0" to virtual address "0x6E213408" (part of module "MSCSS7EN.DLL") "WINWORD.EXE" wrote bytes "f011bb62" to virtual address "0x65C678E4" (part of module "OART.DLL") "WINWORD.EXE" wrote bytes "e936558bf2" to virtual address "0x76613EAE" ("VariantClear@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "e99e48aaf3" to virtual address "0x753E3D01" ("SetUnhandledExceptionFilter@KERNEL32.DLL") "WINWORD.EXE" wrote bytes "e9c53282f2" to virtual address "0x76C46143" ("OleLoadFromStream@OLE32.DLL") "WINWORD.EXE" wrote bytes "74ef8e8b" to virtual address "0x6EF542C4" (part of module "MSPROOF7.DLL") "WINWORD.EXE" wrote bytes "8a620d62" to virtual address "0x690E0BA8" (part of module "MSO.DLL")39:T2029,"D3BE 1{115AD652-3B1F-490A-A5D7-56D1A6117FA6}{58D01F77-4756-41FB-B682-970B1ED9D173}AnyConnect_Secure_Mobility_Client{74634F0A-4634-444F-8726-559733CE1B10}{689CFDD6-0DA0-4DC5-88CD-444AC1519C12}{BE69ABF5-1223-4A54-A2E1-6DCE7CA2B163}{C9AECFAE-EFB3-4E2E-B9DD-937538B652D0}{AAC62CED-8D5F-44E0-95AB-B6EF81E07540}{DDA0BDE3-2C1F-4DB6-A818-05259B47064E}PRE_DEPLOY_DISABLE_VPN=1{11224C5D-0F2B-421E-9815-93DB50C87440}{22AD8AF9-41A6-4744-93A0-49CB627BB739}((NOT VersionNT64) AND (VersionNT < 601)){7DD0DCBC-072D-49AD-98E3-B551855CBFE6}{DF549AF0-B0C3-4BD1-9470-9EA77560657B}{0CAF9786-80A2-42BA-BA92-CD5170B170A5}VersionNT > "601"{1E731D96-C3CC-40BB-912C-DDC5138A9F86}vpndownloader_1{FB38B06B-9B47-41D5-AFEE-8170FF69C1DC}(VersionNT < 600){9576CE16-4C2B-488A-92A4-8F09472325C3}{986883AE-0E84-4029-BF46-E83C3182564F}{6CF1F8A3-99FA-4524-B6FA-7248E01E0DA1}{C8772B8C-DE85-4A67-A8EE-A8684840B5F6}{91EA62DA-26F8-43A8-A5A4-B8BA5F9EB46A}vpnextractor_1{6D240E20-9EEE-46AF-AF37-CF73EDA892B7}{678A6992-1CD8-44D1-A15B-AEFA48DE316A}vpnapi_1{C9A7C2FA-B206-4A5D-A0C7-C0A6CA7CF994}MaxPacketSize{FA4213F5-4837-4974-A20C-C46500D8C174}{E0AAC9F1-2F71-4124-BB81-7366E17D1542}((VersionNT64) AND (VersionNT >= 601)){A7563444-5A94-4923-9876-A0A95ABBE764}{45D7C35A-464B-4D9D-9970-16917957F215}{C7A91E6C-C182-482A-B3D1-780464846B74}vpnui_1{6521A61D-C92E-4B53-B6E6-C3647D06FB03}{558E69CF-9D4E-41EE-B751-5305BD12BF59}New_Value{19555DFC-445C-46E0-8090-5811F55A91C5}{DF717D16-FDBA-4296-9452-5AC6DAB6276C}{5CA86839-FE31-4105-81A3-0C695D9DCDEE}{91FC6A63-4393-4273-B6C4-29D6118FCBF1}{A593538D-FCCA-4D57-86DC-74DD2C4D6C94}{AD71C81B-919E-40CC-8F85-8E7E792FF8BB}(VersionNT64){F083588A-CECE-4F9D-83E5-05D193A7827B}{E2D31641-FED4-4EA2-8D90-B16E7048FE54}RunOnce{0CB566BF-B16E-479A-B02C-4121ECCC4C0D}{D63FBE6E-DA9F-4933-A719-45FEE256C3B4}{E508422D-5EC3-41BD-8807-50BB825FC799}{F62B094C-4F7A-4295-A395-0FCC9DD73B11}{4E32D045-1685-4944-8526-E0DFAF708054}{A74420E7-8448-401B-84FC-440FC88ECC7C}{1D662365-B85E-47D4-AE4F-D2B0353B767D}{47956FC9-674D-481A-B311-93B89DD38A80}{EF64B376-6336-428F-90D0-78C140998B4D}{0FE14FF6-D8ED-4E1E-BC63-02DE92AA5D2C}Application{561D690A-7B5E-4386-BB57-F619747BD6FA}SystemComponent_1ARPSYSTEMCOMPONENT=1{7CBD1171-7A5B-431D-8D95-0EA0CEF2302D}{984207FA-27BF-4964-9AF8-C4619D38516B}{BCA657F8-4263-4531-BC67-F06DEC772DE5}{1E1D3448-C3E3-43C3-880D-106578810E76}UITextODBe RCSQLShowDatabasesTitleThis feature frees up [1] on your hard drive.SelChildCostNegDifferenceVolumeCostDifference{[2] or higher}PrereqReqMinOnly{[3] or lower}PrereqReqMaxOnlyGathering required information...ScriptInProgress

Error loading resource:

"[1]"

HtmlHostNavErrorbytesThis feature will become unavailableSelAdvertiseAbsentBrowsing SQL Servers on the network...SQLBrowseMsgTime remaining: {[1] minutes }{[2] seconds}TimeRemainingVolumeVolumeCostVolumeSelect FolderBrowseFolderSelectFolder[4]PrereqFoundThis feature will be uninstalled completely, you won't be able to run it from the networkSelNetworkAbsentThis feature requires [1] on your hard drive. It has [2] of [3] subfeatures selected. The subfeatures require [4] on your hard drive.SelParentCostPosPos[2]PrereqReqExactThis feature will be completely removedSelLocalAbsentSending collected data...HttpPostMsg[6]PrereqActionFolder name:BrowseFolderNamePrereqLabelEntire feature will be unavailableMenuAbsentWill be installed when requiredSelAdvertiseAdvertiseThis feature will be available to run from CDSelAdvertiseCDRequiredVolumeCostRequiredMust InstallPrereqMandatoryInstallActionThis feature requires [1] on your hard drive.SelChildCostPosUnused drivesVolumeCostOthersGroupThis feature will be available to run from the networkSelAdvertiseNetworkThis feature will be installed on your local hard driveSelAdvertiseLocalThis feature will be removed from your local hard drive, but will be set to be installed when requiredSelLocalAdvertiseThis feature will be removed from your local hard drive, but will be still available to run from CDSelLocalCDWarningEntire feature will be installed to run from networkMenuAllNetworkEntire feature will be installed on local hard driveMenuAllLocalThis feature will be removed from your local hard drive, but will be still available to run from the networkSelLocalNetworkThis feature will remain on you local hard driveSelLocalLocalThis feature frees up [1] on your hard drive. It has [2] of [3] subfeatures selected. The subfeatures free up [4] on your hard drive.SelParentCostNegNegFeature will be installed when requiredMenuAdvertiseWill be installed to run from CDMenuCDThis feature will remain uninstalledSelAbsentAbsentWill be installed to run from networkMenuNetworkPlease wait while testing the connection...ODBCTestMsgWill be installed on local hard driveMenuLocalConnecting to database server...SQLShowDatabasesMsgCompiling cost for this feature...SelCostPendingPrereqInstallActionSkipPrereqSkipActionSQLSQLBrowseTitleInsufficient spaceVolumeCostBadGroupBrowseFolderLocation HttpPostTitleThis feature will be set to be installed when requiredSelAbsentAdvertiseThis feature will be installed to run from CDSelAbsentCDThis feature will be uninstalled completely, you won't be able to run it from CDSelCDAbsentGBAbsentPathThis feature will be installed to run from the networkSelAbsentNetworkInstallation drivesVolumeCostDrivesGroupThis feature will be installed on the local hard driveSelAbsentLocalDisk SizeVolumeCostSizeKBMBPrereqInstalledThis feature will change from run from CD state to set to be installed when requiredSelCDAdvertiseThis feature will remain to be run from CDSelCDCDAvailableVolumeCostAvailableThis feature frees up [1] on your hard drive. It has [2] of [3] subfeatures selected. The subfeatures require [4] on your hard drive.SelParentCostNegPosThis feature requires [1] on your hard drive. It has [2] of [3] subfeatures selected. The subfeatures free up [4] on your hard drive.SelParentCostPosNegEntire feature will be installed to run from CDMenuAllCDThis feature will change from run from network state to set to be installed when requiredSelNetworkAdvertiseThis feature will change from run from CD state to be installed on the local hard driveSelCDLocal{[2] - [3]}PrereqReqThis feature will remain to be run from the networkSelNetworkNetworkThis feature will change from run from network state to be installed on the local hard driveSelNetworkLocalODBCTestTitleInstallExecuteSequence(REMOVE = "ALL") AND (VersionNT64) AND (VersionNT < 602)(AI_BUILD_NAME = "PreDeploy") AND (REMOVE = "ALL") AND (NOINSTALLACTIVEX <> 1)InstallExecute(NOT Installed) AND (RESET_ADAPTER_MTU) AND (RESET_ADAPTER_MTU <> 0)(REMOVE = "ALL") AND (NOT VersionNT64) AND (VersionNT < 602)((VersionNT64) AND (VersionNT >= 601)) AND (Not Installed)(VersionNT64) AND (VersionNT < 601)(AI_BUILD_NAME = "PreDeploy")((NOT VersionNT64) AND (VersionNT < 601)) AND (Not Installed)RedirectedDllSupportIsolateComponents((VersionNT64) AND (VersionNT < 601)) AND ((REMOVE = "ALL") AND (NOT UPGRADINGPRODUCTCODE))(NOT Installed) AND (VersionNT64) AND (VersionNT < 601)(NOT VersionNT64) AND (VersionNT >= 601)AI_NEWERPRODUCTFOUND AND (UILevel <> 5)AI_EXTREG <> "No"(AI_BUILD_NAME = "PreDeploy") AND NOT (PRE_DEPLOY_DISABLE_VPN=1)AI_UPGRADE<>"No"(NOT Installed) AND NOT (PRE_DEPLOY_DISABLE_VPN=1)Not Installed(VersionNT64) AND (VersionNT >= 601)((VersionNT64) AND (VersionNT < 601)) AND (Not Installed)(NOT VersionNT64) AND (VersionNT < 601)((NOT VersionNT64) AND (VersionNT < 601)) AND (REMOVE = "ALL")(AI_BUILD_NAME = "PreDeploy") AND (NOT Installed) AND (NOINSTALLACTIVEX <> 1)(REMOVE = "ALL") AND (NOT VersionNT64) AND (VersionNT >= 601)(NOT VersionNT64) AND (VersionNT < 602)(Not Installed) AND (LOCKDOWN) AND (LOCKDOWN <> 0)((NOT VersionNT64) AND (VersionNT < 601)) AND ((REMOVE = "ALL") AND (NOT UPGRADINGPRODUCTCODE))(VersionNT < 601) AND ((REMOVE = "ALL") AND (NOT UPGRADINGPRODUCTCODE))((NOT VersionNT64) AND (VersionNT >= 601)) AND (REMOVE = "ALL")MsiCo@HA=1`/EjC$Wn ;4IdppC+*7O&*xW>HV}T)Y#>-HNyXeOOe%WP])GL(*4Or<\\$-)mKjC$>hC9Kjlr8LroH ZgYT5/\\';;v7pfZKsPEUmp.pdb%F{ %Fk5]~R1HVXKr?&Mo0J_o*9s--o'61V^z2[J'ka]6fC-v_{<2jo&\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"WINWORD.EXE\" created file \"%TEMP%\\~DF6413D64CFA613CB5.TMP\"\n \"WINWORD.EXE\" created file \"%TEMP%\\~DF1F8ACB1F7EA2317F.TMP\"\n \"WINWORD.EXE\" created file \"%TEMP%\\~DFA7F07A3205A513BA.TMP\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-60390\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-60390\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 68280000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$36","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.example.com\"\n Pattern match: \"http://www.yahoo.com\"\n Pattern match: \"http://www.google.com\"\n Heuristic match: \"vpnva.cat\"\n Heuristic match: \"vpnva64.cat\"\n Heuristic match: \"acsint.cat\"\n Heuristic match: \"acsmux.cat\"\n Heuristic match: \"acsock.cat\"\n Heuristic match: \"acsint64.cat\"\n Heuristic match: \"acsmux64.cat\"\n Heuristic match: \"acsock64.cat\"\n Heuristic match: \"vpnva_6.cat\"\n Pattern match: \"https://www.verisign.com/rpa\"\n Pattern match: \"http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D\"\n Pattern match: \"https://www.verisign.com/rpa0\"\n Pattern match: \"http://ocsp.verisign.com0\"\n Pattern match: \"http://csc3-2010-aia.verisign.com/CSC3-2010.cer0\"\n Pattern match: \"https://www.verisign.com/cps0*\"\n Pattern match: \"http://logo.verisign.com/vslogo.gif04\"\n Pattern match: \"http://crl.verisign.com/pca3-g5.crl04\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$37","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"127.0.0.1\"\n Heuristic match: \"{\\*\\generator Msftedit 5.41.21.2509;}\\viewkind4\\uc1\\pard\\sb2\\sa2\\b\\f0\\fs24 Supplemental \\cf1 End User License Agreement for Cisco Systems AnyConnect Secure Mobility and other related Client Software\\cf0 \\line\\par\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains a remote desktop related string","description":"\"% bmz+u*KvnctdLH?*)Y)=7\" (Indicator for product: Generic VNC)","origin":"File/Memory","relevance":10,"id":"string-27","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"SysFreeString@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"SysAllocStringByteLen@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantChangeType@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantClear@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"OleLoadFromStream@OLE32.DLL\" in \"WINWORD.EXE\"","origin":"Hook Detection","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded string with suspicious keywords","description":"Found suspicious keyword \"Put\" which indicates: \"May write to a file (if combined with Open)\"\n Found suspicious keyword \"Lib\" which indicates: \"May run code from a DLL\"\n Found suspicious keyword \"Write\" which indicates: \"May write to a file (if combined with Open)\"\n Found suspicious keyword \"Open\" which indicates: \"May open a file\"\n Found suspicious keyword \"Environ\" which indicates: \"May read system environment variables\"\n Found suspicious keyword \"Chr\" which indicates: \"May attempt to obfuscate specific strings\"","origin":"File/Memory","relevance":10,"id":"string-21","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$38","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"$39","origin":"File/Memory","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains a remote desktop related string"}],"sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":9,"imported_dlls_count":80,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":73,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":133,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":133,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"57c597e4aac2ed086d0f9a85","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"suspicious","threat_score":21,"submit_name":"anyconnect-win-3.1.04072-pre-deploy-k9.msi","analysis_start_time":"2016-08-30T16:30:39+00:00","indicators_count":{"informative":7,"suspicious":6,"malicious":1},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}],"processes":[{"pid":2576,"ppid":0,"name":"WINWORD.EXE","command_line":"/n \"C:\\a2b500fbb17057bc3dea4b236d0862158914b82cc07ff8b4488c728fef9ee1da.rtf\"","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","uid":"00028347-00002576","icon":"$3a"}],"all_imported_dlls":["OART.DLL","cryptbase.dll","mscoreei.dll","cfgmgr32.dll","rsaenh.dll","ntshrui.dll","Wldap32.dll","msvcp90.dll","NL7MODELS0009.dll","ole32.dll","propsys.dll","CSS7DATA0009.DLL","lpk.dll","imm32.dll","MSOINTL.DLL","urlmon.dll","MSSP7EN.DLL","KernelBase.dll","uxtheme.dll","dwmapi.dll","msxml6r.dll","MSGR3EN.DLL","linkinfo.dll","msvcr90.dll","oleaut32.dll","wtsapi32.dll","MSO.DLL","shlwapi.dll","MSORES.DLL","MSPTLS.DLL","RICHED20.DLL","msi.dll","WWINTL.DLL","powrprof.dll","clbcatq.dll","ntmarta.dll","cryptsp.dll","RpcRtRemote.dll","crypt32.dll","kernel32.dll","GFX.DLL","msimg32.dll","setupapi.dll","devobj.dll","profapi.dll","userenv.dll","msvcrt.dll","wininet.dll","USP10.DLL","srvcli.dll","mscss7en.dll","imageres.dll","apphelp.dll","version.dll","MSCONV97.DLL","GdiPlus.dll","sechost.dll","gdi32.dll","user32.dll","usp10.dll","mscoree.dll","ntdll.dll","comctl32.dll","msctf.dll","WWLIB.DLL","rpcss.dll","msxml6.dll","sspicli.dll","sxs.dll","shell32.dll","msasn1.dll","mlang.dll","cscapi.dll","msproof7.dll","rpcrt4.dll","OSPPC.DLL","iertutil.dll","slc.dll","ALRTINTL.DLL","advapi32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"~WRS{70CBDE19-DDBB-4AB4-B485-D8ED5E546AB7}.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"name":"~WRD0000.doc","sha256":"cf625606ffefbd4b28c719a656acb01c30e6761315a40b93495bef4a14ad6202","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"name":"~WRD0001.doc","sha256":"cf625606ffefbd4b28c719a656acb01c30e6761315a40b93495bef4a14ad6202","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"name":"index.dat","sha256":"7aa902b13b566314f27dcc21ae3839fdd36fb99fb37a556f846f96f03f5e6a31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"name":"ExcludeDictionaryEN0409.lex","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"name":"~WRD0002.doc","sha256":"f5ba0e80150072cf4b4609d2092adcd5357d1dcc6cdf5e3668012e4599a08b1b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"name":"~WRS{22ABFFC9-2A64-45AB-BE80-6EDFD4F3E114}.tmp","sha256":"9fc1287ce61c1737da07c8221295934cbe034f7abcc64572caa0d7cc1093b5b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"name":"~$Normal.dotm","sha256":"44fd9331ed206b5454e8e59205b8aa6bae8c4ef03a7d781acb70cd99d5c160be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"name":"~$b500fbb17057bc3dea4b236d0862158914b82cc07ff8b4488c728fef9ee1da.rtf","sha256":"44fd9331ed206b5454e8e59205b8aa6bae8c4ef03a7d781acb70cd99d5c160be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"name":"a2b500fbb17057bc3dea4b236d0862158914b82cc07ff8b4488c728fef9ee1da.LNK","sha256":"397174b93531441f59d8225b7a8b51c7443c7a55c89d83731b77f31a4af5dcca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]}],"files_written":[{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\office14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE.config","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%APPDATA%\\Microsoft\\Templates","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\~$Normal.dotm","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\Normal.dotm","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{70CBDE19-DDBB-4AB4-B485-D8ED5E546AB7}.tmp","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%TEMP%\\~DF6413D64CFA613CB5.TMP","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"C:\\~$b500fbb17057bc3dea4b236d0862158914b82cc07ff8b4488c728fef9ee1da.rtf","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%SAMPLEDIR%\\~$b500fbb17057bc3dea4b236d0862158914b82cc07ff8b4488c728fef9ee1da.rtf","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%TEMP%\\~DF1F8ACB1F7EA2317F.TMP","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%TEMP%\\~DFA7F07A3205A513BA.TMP","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%WINDIR%\\system32\\en-US\\mlang.dll.mui","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%WINDIR%\\system32\\mlang.dat","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{22ABFFC9-2A64-45AB-BE80-6EDFD4F3E114}.tmp","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRD0000.doc","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRD0002.doc","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{37C3B3AA-99D2-4ECD-8E2D-C9C176EAEC76}.tmp","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%APPDATA%\\Microsoft\\Office\\review.rcd","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%APPDATA%\\Microsoft\\Office\\adhoc.rcd","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"C:\\Users\\wEBRd76","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%APPDATA%\\Microsoft\\Office","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\a2b500fbb17057bc3dea4b236d0862158914b82cc07ff8b4488c728fef9ee1da","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"C:\\a2b500fbb17057bc3dea4b236d0862158914b82cc07ff8b4488c728fef9ee1da.rtf","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\a2b500fbb17057bc3dea4b236d0862158914b82cc07ff8b4488c728fef9ee1da.LNK","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\CUSTOM.DIC","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%APPDATA%\\Microsoft\\Office\\MSO1033.acl","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\1033\\Bibliography\\BibForm.XML","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"C:\\","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%PROGRAMFILES%\\Microsoft Office","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\Bibliography","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\Bibliography\\Style","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\OFFICE14\\PROOF\\MSSP7EN.LEX","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\OFFICE14\\PROOF\\MSSP7EN.dub","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\ExcludeDictionaryEN0409.lex","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\OFFICE14\\PROOF\\mssp7EN.lex","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\NL7Models0009.dll","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\CMAdj.9.bin","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\OFFICE14\\PROOF\\MSGR3EN.LEX","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"path":"%WINDIR%\\system32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LCCACHE\\THEMES\\1033\\NEXTUPDATE\\NEXTUPDATE","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LCCACHE\\WORDDOCPARTS\\1033\\NEXTUPDATE\\NEXTUPDATE","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\LCCACHE\\SMARTART\\1033\\NEXTUPDATE\\NEXTUPDATE","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\+DE\\+DE","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\MAX DISPLAY\\MAX DISPLAY","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 1\\ITEM 1","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 2\\ITEM 2","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 3\\ITEM 3","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 4\\ITEM 4","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 5\\ITEM 5","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 6\\ITEM 6","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 7\\ITEM 7","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 8\\ITEM 8","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 9\\ITEM 9","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 10\\ITEM 10","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 11\\ITEM 11","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 12\\ITEM 12","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 13\\ITEM 13","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 14\\ITEM 14","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 15\\ITEM 15","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 16\\ITEM 16","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 17\\ITEM 17","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 18\\ITEM 18","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 19\\ITEM 19","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 20\\ITEM 20","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 21\\ITEM 21","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 22\\ITEM 22","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 23\\ITEM 23","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 24\\ITEM 24","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 25\\ITEM 25","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 26\\ITEM 26","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 27\\ITEM 27","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 28\\ITEM 28","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 29\\ITEM 29","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 30\\ITEM 30","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 31\\ITEM 31","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 32\\ITEM 32","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 33\\ITEM 33","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 34\\ITEM 34","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 35\\ITEM 35","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 36\\ITEM 36","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 37\\ITEM 37","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 38\\ITEM 38","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 39\\ITEM 39","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 40\\ITEM 40","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 41\\ITEM 41","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 42\\ITEM 42","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 43\\ITEM 43","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 44\\ITEM 44","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 45\\ITEM 45","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 46\\ITEM 46","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 47\\ITEM 47","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 48\\ITEM 48","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 49\\ITEM 49","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\PLACE MRU\\ITEM 50\\ITEM 50","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 1\\SITE 1","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 2\\SITE 2","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 3\\SITE 3","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 4\\SITE 4","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 5\\SITE 5","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 6\\SITE 6","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 7\\SITE 7","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 8\\SITE 8","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 9\\SITE 9","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 10\\SITE 10","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 11\\SITE 11","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 12\\SITE 12","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 13\\SITE 13","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 14\\SITE 14","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 15\\SITE 15","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 16\\SITE 16","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 17\\SITE 17","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 18\\SITE 18","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 19\\SITE 19","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\RECENT LOCATIONS\\SHAREPOINT\\SITE 20\\SITE 20","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\MAX DISPLAY\\MAX DISPLAY","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 1\\ITEM 1","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 2\\ITEM 2","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 3\\ITEM 3","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 4\\ITEM 4","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 5\\ITEM 5","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 6\\ITEM 6","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 7\\ITEM 7","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 8\\ITEM 8","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 9\\ITEM 9","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 10\\ITEM 10","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 11\\ITEM 11","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 12\\ITEM 12","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 13\\ITEM 13","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 14\\ITEM 14","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 15\\ITEM 15","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 16\\ITEM 16","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 17\\ITEM 17","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 18\\ITEM 18","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 19\\ITEM 19","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 20\\ITEM 20","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 21\\ITEM 21","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 22\\ITEM 22","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 23\\ITEM 23","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 24\\ITEM 24","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 25\\ITEM 25","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 26\\ITEM 26","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 27\\ITEM 27","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 28\\ITEM 28","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 29\\ITEM 29","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 30\\ITEM 30","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 31\\ITEM 31","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 32\\ITEM 32","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 33\\ITEM 33","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 34\\ITEM 34","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 35\\ITEM 35","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 36\\ITEM 36","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 37\\ITEM 37","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 38\\ITEM 38","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 39\\ITEM 39","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 40\\ITEM 40","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 41\\ITEM 41","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 42\\ITEM 42","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 43\\ITEM 43","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 44\\ITEM 44","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 45\\ITEM 45","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 46\\ITEM 46","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 47\\ITEM 47","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 48\\ITEM 48","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 49\\ITEM 49","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\FILE MRU\\ITEM 50\\ITEM 50","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\$NE\\$NE","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\=:E\\=:E","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\\","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-60390","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-60390","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"57c597e4aac2ed086d0f9a85"}]}]}},"report_ids":{"sandbox_job_ids":["57c597e4aac2ed086d0f9a85"]}}}]]}] 2c:[["$","title","0",{"children":"Suspicious Sample a2b500fbb170… — Score 21/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample a2b500fbb170…. Threat score 21/100. 1/27 AV engines flagged this file. 1 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a2b500fbb17057bc3dea4b236d0862158914b82cc07ff8b4488c728fef9ee1da"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample a2b500fbb170… — Score 21/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample a2b500fbb170…. Threat score 21/100. 1/27 AV engines flagged this file. 1 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a2b500fbb17057bc3dea4b236d0862158914b82cc07ff8b4488c728fef9ee1da"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample a2b500fbb170… — Score 21/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample a2b500fbb170…. Threat score 21/100. 1/27 AV engines flagged this file. 1 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3b","11",{}]] 32:null