What is akciikov.exe?
akciikov.exe is usually located in the 'c:\downloads\' folder.
Some of the anti-virus scanners at VirusTotal detected akciikov.exe.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
Digital signatures [?]
akciikov.exe is not signed.
VirusTotal report
24 of the 62 anti-virus programs at VirusTotal detected the akciikov.exe file. That's a 39% detection rate.
| Scanner | Detection Name |
|---|---|
| Acronis | suspicious |
| Avast | Win32:Malware-gen |
| AVG | Win32:Malware-gen |
| Comodo | Malware@#320jstz7c3z8k |
| CrowdStrike | win/malicious_confidence_60% (W) |
| Cyren | W32/GenBl.545C5AD9!Olympus |
| Invincea | heuristic |
| Jiangmin | DangerousObject.Multi.k |
| K7AntiVirus | Trojan ( 0052964f1 ) |
| K7GW | Trojan ( 0052964f1 ) |
| Kingsoft | Win32.Troj.Undef.(kcloud) |
| McAfee | Artemis!545C5AD9A8F1 |
| McAfee-GW-Edition | BehavesLike.Win32.SoftPulse.vc |
| NANO-Antivirus | Trojan.Win32.GM.dhxzvo |
| Qihoo-360 | Win32/Trojan.Multi.daf |
| SentinelOne | static engine - malicious |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Win32.Trojan.Spy.Suee |
| Trapmine | malicious.moderate.ml.score |
| VIPRE | Trojan.Win32.Generic!BT |
| ViRobot | Trojan.Win32.Z.Undef.2585562 |
| Webroot | W32.Trojan.Gen |
| Yandex | TrojanSpy.Agent!aZVb2xGmmeQ |
| ZoneAlarm | UDS:DangerousObject.Multi.Generic |
Sandbox Report
The following information was gathered by executing the file inside Cuckoo Sandbox.
Summary
Successfully executed process in sandbox.
Summary
{
"file_created": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00e4\u00ab\u00fa\u00ab\u00f3\u00aba \u00ba\u00e1\u00f1\u00e1G\u00ac\u00e1 \u00ab\u00eda\u00e1\u00ba\u00d1\u00b5.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00c4\u00c5\u00ea\u00e6\u00a3.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\img073.pdf",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\\u00df\u00f3\u00d1\u00f1\u00d1\u00a1\u00bfn \u00ab\u00ed \u00ab\u00edO\u00d1\u00acG\u00e1s \u00a1\u00d1\u00f1\u00f3\u00bf\u00aa\u00bf\u00bc\u00ab\u00dfG\u00bf.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\img074.pdf",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00bb\u00d1a\u00d1t\u00d1\u00a18 \u00f1\u00ab\u00acp\u00bc\u00d1\u00a1G\u00ab\u00f3 \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00e7\u00e1n\u00f3\u00ac\u00e1 \u00a1\u00e1 pt\u00e1\u00dfG\u00bf\u00d1 \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1 \u00ab\u00eda\u00e1\u00ba\u00d1\u00b5 \u00fa\u00ab\u00dfp\u00f1.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00fa\u00ab\u00f3\u00aba \u00acp\u00bb\u00bd\u00bf-\u00bba\u00ab\u00f1\u00e1\u00aa\u00bf \u00bba\u00ab\u00d1\u00acG.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00c4\u00edOn\u00f3\u00bd\u00d1\u00a1\u00bf\u00d1 \u00e1\u00ac\u00b5\u00bf\u00bf \u00e6\u00d1a\u00f3\u00bf\u00df.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\\u00fcps\u00fa\u00e1\u00bdG\u00d1a\u00df\u00ac\u00bf\u00ac \u00ed\u00e1\u00bd\u00e1\u00a1\u00df 1 \u00bb\u00ab\u00bdp\u00fa\u00ab\u00f1\u00bf\u00d1.pdf"
],
"directory_created": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1"
],
"dll_loaded": [
"C:\\Windows\\syswow64\\MSCTF.dll",
"ADVAPI32.dll",
"kernel32.dll",
"UxTheme.dll",
"OLEAUT32.DLL",
"C:\\Windows\\system32\\ole32.dll",
"dwmapi.dll",
"comctl32.dll",
"IMM32.dll"
],
"file_opened": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00e4\u00ab\u00fa\u00ab\u00f3\u00aba \u00ba\u00e1\u00f1\u00e1G\u00ac\u00e1 \u00ab\u00eda\u00e1\u00ba\u00d1\u00b5.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\cff8361b3fd4d8285875d1e385889ed4f69b9d8db963d3949b1a28b58bd5eafd.bin",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00c4\u00c5\u00ea\u00e6\u00a3.doc",
"C:\\Windows\\Fonts\\staticcache.dat",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\img073.pdf",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\\u00df\u00f3\u00d1\u00f1\u00d1\u00a1\u00bfn \u00ab\u00ed \u00ab\u00edO\u00d1\u00acG\u00e1s \u00a1\u00d1\u00f1\u00f3\u00bf\u00aa\u00bf\u00bc\u00ab\u00dfG\u00bf.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\img074.pdf",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00bb\u00d1a\u00d1t\u00d1\u00a18 \u00f1\u00ab\u00acp\u00bc\u00d1\u00a1G\u00ab\u00f3 \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00e7\u00e1n\u00f3\u00ac\u00e1 \u00a1\u00e1 pt\u00e1\u00dfG\u00bf\u00d1 \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1 \u00ab\u00eda\u00e1\u00ba\u00d1\u00b5 \u00fa\u00ab\u00dfp\u00f1.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00fa\u00ab\u00f3\u00aba \u00acp\u00bb\u00bd\u00bf-\u00bba\u00ab\u00f1\u00e1\u00aa\u00bf \u00bba\u00ab\u00d1\u00acG.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00c4\u00edOn\u00f3\u00bd\u00d1\u00a1\u00bf\u00d1 \u00e1\u00ac\u00b5\u00bf\u00bf \u00e6\u00d1a\u00f3\u00bf\u00df.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\\u00fcps\u00fa\u00e1\u00bdG\u00d1a\u00df\u00ac\u00bf\u00ac \u00ed\u00e1\u00bd\u00e1\u00a1\u00df 1 \u00bb\u00ab\u00bdp\u00fa\u00ab\u00f1\u00bf\u00d1.pdf"
],
"regkey_opened": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\Tracing",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Microsoft Sans Serif",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback",
"HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\LayoutIcon\\0409\\0000041d",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\cff8361b3fd4d8285875d1e385889ed4f69b9d8db963d3949b1a28b58bd5eafd.bin",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLEAUT",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0"
],
"file_written": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00e4\u00ab\u00fa\u00ab\u00f3\u00aba \u00ba\u00e1\u00f1\u00e1G\u00ac\u00e1 \u00ab\u00eda\u00e1\u00ba\u00d1\u00b5.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00c4\u00c5\u00ea\u00e6\u00a3.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\img073.pdf",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\\u00df\u00f3\u00d1\u00f1\u00d1\u00a1\u00bfn \u00ab\u00ed \u00ab\u00edO\u00d1\u00acG\u00e1s \u00a1\u00d1\u00f1\u00f3\u00bf\u00aa\u00bf\u00bc\u00ab\u00dfG\u00bf.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\img074.pdf",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00bb\u00d1a\u00d1t\u00d1\u00a18 \u00f1\u00ab\u00acp\u00bc\u00d1\u00a1G\u00ab\u00f3 \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00e7\u00e1n\u00f3\u00ac\u00e1 \u00a1\u00e1 pt\u00e1\u00dfG\u00bf\u00d1 \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1 \u00ab\u00eda\u00e1\u00ba\u00d1\u00b5 \u00fa\u00ab\u00dfp\u00f1.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00fa\u00ab\u00f3\u00aba \u00acp\u00bb\u00bd\u00bf-\u00bba\u00ab\u00f1\u00e1\u00aa\u00bf \u00bba\u00ab\u00d1\u00acG.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00c4\u00edOn\u00f3\u00bd\u00d1\u00a1\u00bf\u00d1 \u00e1\u00ac\u00b5\u00bf\u00bf \u00e6\u00d1a\u00f3\u00bf\u00df.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\\u00fcps\u00fa\u00e1\u00bdG\u00d1a\u00df\u00ac\u00bf\u00ac \u00ed\u00e1\u00bd\u00e1\u00a1\u00df 1 \u00bb\u00ab\u00bdp\u00fa\u00ab\u00f1\u00bf\u00d1.pdf"
],
"file_exists": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00e4\u00ab\u00fa\u00ab\u00f3\u00aba \u00ba\u00e1\u00f1\u00e1G\u00ac\u00e1 \u00ab\u00eda\u00e1\u00ba\u00d1\u00b5.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00c4\u00edOn\u00f3\u00bd\u00d1\u00a1\u00bf\u00d1 \u00e1\u00ac\u00b5\u00bf\u00bf \u00e6\u00d1a\u00f3\u00bf\u00df.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00c4\u00c5\u00ea\u00e6\u00a3.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\",
"C:\\Users\\cuck\\AppData",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\img073.pdf",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\\u00fcps\u00fa\u00e1\u00bdG\u00d1a\u00df\u00ac\u00bf\u00ac \u00ed\u00e1\u00bd\u00e1\u00a1\u00df 1 \u00bb\u00ab\u00bdp\u00fa\u00ab\u00f1\u00bf\u00d1.pdf",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\",
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\\u00df\u00f3\u00d1\u00f1\u00d1\u00a1\u00bfn \u00ab\u00ed \u00ab\u00edO\u00d1\u00acG\u00e1s \u00a1\u00d1\u00f1\u00f3\u00bf\u00aa\u00bf\u00bc\u00ab\u00dfG\u00bf.doc",
"C:\\Users\\cuck",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\img074.pdf",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00e7\u00e1n\u00f3\u00ac\u00e1 \u00a1\u00e1 pt\u00e1\u00dfG\u00bf\u00d1 \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1 \u00ab\u00eda\u00e1\u00ba\u00d1\u00b5 \u00fa\u00ab\u00dfp\u00f1.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00fa\u00ab\u00f3\u00aba \u00acp\u00bb\u00bd\u00bf-\u00bba\u00ab\u00f1\u00e1\u00aa\u00bf \u00bba\u00ab\u00d1\u00acG.doc",
"C:\\Users",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00bb\u00d1a\u00d1t\u00d1\u00a18 \u00f1\u00ab\u00acp\u00bc\u00d1\u00a1G\u00ab\u00f3 \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1",
"C:\\Users\\cuck\\AppData\\Local"
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\cff8361b3fd4d8285875d1e385889ed4f69b9d8db963d3949b1a28b58bd5eafd.bin",
"C:\\Windows\\Fonts\\staticcache.dat"
],
"regkey_read": [
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\PageAllocatorUseSystemHeap",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\PageAllocatorSystemHeapIsPrivate",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16"
],
"directory_enumerated": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\cff8361b3fd4d8285875d1e385889ed4f69b9d8db963d3949b1a28b58bd5eafd.bin",
"C:\\Users\\cuck\\AppData",
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Users\\cuck",
"C:\\Users",
"C:\\Users\\cuck\\AppData\\Local"
]
}Dropped
[
{
"yara": [],
"sha1": "2ab1b071a9eb156ba10212299fc8a3816818cc78",
"name": "b72f913adb80785e_\u00c3\u00a7\u00c3\u00a1n\u00c3\u00b3\u00c2\u00ac\u00c3\u00a1 \u00c2\u00a1\u00c3\u00a1 pt\u00c3\u00a1\u00c3\u009fg\u00c2\u00bf\u00c3\u00b1 \u00c3\u00b3 \u00c3\u00a1p\u00c2\u00ac\u00c2\u00b5\u00c2\u00bf\u00c2\u00ab\u00c2\u00a1\u00c3\u00b1 \u00c2\u00ab\u00c3\u00ada\u00c3\u00a1\u00c2\u00ba\u00c3\u00b1\u00c2\u00b5 \u00c3\u00ba\u00c2\u00ab\u00c3\u009fp\u00c3\u00b1.doc",
"type": "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Author: , Template: Normal, Revision Number: 3, Name of Creating Application: Microsoft Office Word, Total Editing Time: 05:00, Last Printed: Fri Nov 21 06:29:00 2008, Create Time\/Date: Mon May 30 07:28:00 2011, Last Saved Time\/Date: Mon May 30 07:59:00 2011, Number of Pages: 2, Number of Words: 620, Number of Characters: 3539, Security: 0",
"sha256": "b72f913adb80785ea6534aaf40814e88a8f48345a841f7741056d36b74856e6a",
"urls": [
"http:\/\/schemas.openxmlformats.org\/drawingml\/2006\/main"
],
"crc32": "C2ED47F5",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/10467\/files\/b72f913adb80785e_\u00c3\u00a7\u00c3\u00a1n\u00c3\u00b3\u00c2\u00ac\u00c3\u00a1 \u00c2\u00a1\u00c3\u00a1 pt\u00c3\u00a1\u00c3\u009fg\u00c2\u00bf\u00c3\u00b1 \u00c3\u00b3 \u00c3\u00a1p\u00c2\u00ac\u00c2\u00b5\u00c2\u00bf\u00c2\u00ab\u00c2\u00a1\u00c3\u00b1 \u00c2\u00ab\u00c3\u00ada\u00c3\u00a1\u00c2\u00ba\u00c3\u00b1\u00c2\u00b5 \u00c3\u00ba\u00c2\u00ab\u00c3\u009fp\u00c3\u00b1.doc",
"ssdeep": null,
"size": 34304,
"sha512": "45bc452d18b49691867f03087332634dffc7b823090a65cb25df3b9455c65b155b1a621a2a135a16f0f6a5fc02b78b94d69c75ad8f94040c19e522a36e66ce58",
"md5": "10c3d13807189ee6ecc61474c6c80842"
},
{
"yara": [],
"sha1": "e065e69ae8ac3dce0f3f671d5a07b91876e1f33b",
"name": "8f76749589773c28_\u00c3\u00bcps\u00c3\u00ba\u00c3\u00a1\u00c2\u00bdg\u00c3\u00b1a\u00c3\u009f\u00c2\u00ac\u00c2\u00bf\u00c2\u00ac \u00c3\u00ad\u00c3\u00a1\u00c2\u00bd\u00c3\u00a1\u00c2\u00a1\u00c3\u009f 1 \u00c2\u00bb\u00c2\u00ab\u00c2\u00bdp\u00c3\u00ba\u00c2\u00ab\u00c3\u00b1\u00c2\u00bf\u00c3\u00b1.pdf",
"type": "PDF document, version 1.0",
"sha256": "8f76749589773c28de5f4fe5ae7c028182f6e265e6b857a67ab5d6586c96a741",
"urls": [],
"crc32": "0951B869",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/10467\/files\/8f76749589773c28_\u00c3\u00bcps\u00c3\u00ba\u00c3\u00a1\u00c2\u00bdg\u00c3\u00b1a\u00c3\u009f\u00c2\u00ac\u00c2\u00bf\u00c2\u00ac \u00c3\u00ad\u00c3\u00a1\u00c2\u00bd\u00c3\u00a1\u00c2\u00a1\u00c3\u009f 1 \u00c2\u00bb\u00c2\u00ab\u00c2\u00bdp\u00c3\u00ba\u00c2\u00ab\u00c3\u00b1\u00c2\u00bf\u00c3\u00b1.pdf",
"ssdeep": null,
"size": 321202,
"sha512": "07abbbcfb4722983f81ce17ed4c7ddea11833d321999cacae9017a131761770f61c2ff0c9ef02078c9d96944bfcdf351b368cbafda16bb5331e811224a123452",
"md5": "9075c91502a2abb543d97a1b0b8d79be"
},
{
"yara": [],
"sha1": "db14978fbeea6b4bf72f001c95bcff7ea9cf583a",
"name": "7fb583b46f9d441d_\u00c3\u00b1\u00c2\u00ab\u00c3\u00ba\u00c2\u00ab\u00c3\u00b3\u00c2\u00aba \u00c2\u00acp\u00c2\u00bb\u00c2\u00bd\u00c2\u00bf-\u00c2\u00bba\u00c2\u00ab\u00c3\u00b1\u00c3\u00a1\u00c2\u00aa\u00c2\u00bf \u00c2\u00bba\u00c2\u00ab\u00c3\u00b1\u00c2\u00acg.doc",
"type": "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Title: _____, Author: fim, Template: Normal, Revision Number: 5, Name of Creating Application: Microsoft Office Word, Total Editing Time: 20:00, Last Printed: Tue Feb 2 05:31:00 2010, Create Time\/Date: Wed Nov 24 11:16:00 2010, Last Saved Time\/Date: Wed Oct 12 12:17:00 2011, Number of Pages: 3, Number of Words: 931, Number of Characters: 5308, Security: 0",
"sha256": "7fb583b46f9d441ddd86df454d0e5d8c622e10cd126ff87114bba710c257076b",
"urls": [
"http:\/\/schemas.openxmlformats.org\/drawingml\/2006\/main"
],
"crc32": "AC9ACB09",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/10467\/files\/7fb583b46f9d441d_\u00c3\u00b1\u00c2\u00ab\u00c3\u00ba\u00c2\u00ab\u00c3\u00b3\u00c2\u00aba \u00c2\u00acp\u00c2\u00bb\u00c2\u00bd\u00c2\u00bf-\u00c2\u00bba\u00c2\u00ab\u00c3\u00b1\u00c3\u00a1\u00c2\u00aa\u00c2\u00bf \u00c2\u00bba\u00c2\u00ab\u00c3\u00b1\u00c2\u00acg.doc",
"ssdeep": null,
"size": 46080,
"sha512": "daeab9664211d50559192d6780888b0dc42d2e75a688a9d01a40108783ec5f399de6920bb3573c76bfe1c91501974e663fd13e07435dec6b34df991fb0094edb",
"md5": "5c293345ee4ece7064f4bedaea769873"
},
{
"yara": [],
"sha1": "a5743bff4771e053d50c7c7f77389d133a78458d",
"name": "f88b9363dfe2ca98_\u00c3\u00a4\u00c2\u00ab\u00c3\u00ba\u00c2\u00ab\u00c3\u00b3\u00c2\u00aba \u00c2\u00ba\u00c3\u00a1\u00c3\u00b1\u00c3\u00a1g\u00c2\u00ac\u00c3\u00a1 \u00c2\u00ab\u00c3\u00ada\u00c3\u00a1\u00c2\u00ba\u00c3\u00b1\u00c2\u00b5.doc",
"type": "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Title: N___, Template: Normal, Revision Number: 3, Name of Creating Application: Microsoft Office Word, Total Editing Time: 06:37:00, Last Printed: Mon May 30 08:16:00 2011, Create Time\/Date: Mon May 30 07:44:00 2011, Last Saved Time\/Date: Mon May 30 14:57:00 2011, Number of Pages: 2, Number of Words: 1186, Number of Characters: 6765, Security: 0",
"sha256": "f88b9363dfe2ca9815c76c43b31e53d55a8a090cdfe098a87c104ce15e02dff0",
"urls": [
"http:\/\/schemas.openxmlformats.org\/drawingml\/2006\/main"
],
"crc32": "FD3740BC",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/10467\/files\/f88b9363dfe2ca98_\u00c3\u00a4\u00c2\u00ab\u00c3\u00ba\u00c2\u00ab\u00c3\u00b3\u00c2\u00aba \u00c2\u00ba\u00c3\u00a1\u00c3\u00b1\u00c3\u00a1g\u00c2\u00ac\u00c3\u00a1 \u00c2\u00ab\u00c3\u00ada\u00c3\u00a1\u00c2\u00ba\u00c3\u00b1\u00c2\u00b5.doc",
"ssdeep": null,
"size": 54784,
"sha512": "bd91fd799383e8dc5ff0bdac9bf6e0944253e8ad1bf53d2c2f2644ef46ef2e8b61bd051e06b6ae83c68d470be480ee6acf422a34d4ad9319865bf55af59f7238",
"md5": "066771fafeae40faac89dd2cbd2ef7ea"
},
{
"yara": [],
"sha1": "98b5147f4631963fadb4e506a266a42742edf430",
"name": "634b5f0d3c82d4c7_img074.pdf",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\img074.pdf",
"type": "PDF document, version 1.0",
"sha256": "634b5f0d3c82d4c75bb5f4bc2cfba0a69fa234378af097c53687501ca533193d",
"urls": [],
"crc32": "4E5938A6",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/10467\/files\/634b5f0d3c82d4c7_img074.pdf",
"ssdeep": null,
"size": 14056,
"sha512": "6a46920d8c0b2667446d23c5c5164c84663da22e666b9703f8e0305a5f15ed8f3e0131f1ecd6af1b7dd076b8ffc63f3ac0ef8daacbfb8655b00ca76d9635b6c9",
"pids": [
1512
],
"md5": "bde94810f25a6400aad3113200849c70"
},
{
"yara": [],
"sha1": "9b6306e32328c066a3ffcf4ef3f9c0fa6212c39e",
"name": "bb40c0c15de83dc3_img073.pdf",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\img073.pdf",
"type": "PDF document, version 1.0",
"sha256": "bb40c0c15de83dc35c3448aa1765aadc1ca4df46f9928bfad032a1d1c77442d5",
"urls": [],
"crc32": "B062CAE3",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/10467\/files\/bb40c0c15de83dc3_img073.pdf",
"ssdeep": null,
"size": 15825,
"sha512": "3e01af4f8e987489820f23a006585503f3b4e30dd7a1db3892bc5a67ce2ccf9f16fd0fe46e883adc14af16c946eb57ffb566b0f65e5a05a099612ee44ade7662",
"pids": [
1512
],
"md5": "08bbd3fa81f006d28971d54b1d716342"
},
{
"yara": [],
"sha1": "ad88f1c4566e83b33ec349ae470cc76334b055a3",
"name": "c8e73bcaf4d70b6f_\u00c2\u00bb\u00c3\u00b1a\u00c3\u00b1t\u00c3\u00b1\u00c2\u00a18 \u00c3\u00b1\u00c2\u00ab\u00c2\u00acp\u00c2\u00bc\u00c3\u00b1\u00c2\u00a1g\u00c2\u00ab\u00c3\u00b3 \u00c3\u00b1\u00c2\u00bdn pt\u00c3\u00a1\u00c3\u009fg\u00c2\u00bfn.doc",
"type": "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Title: , Author: GAV, Template: Normal, Revision Number: 7, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:45:00, Create Time\/Date: Thu Nov 21 07:51:00 2002, Last Saved Time\/Date: Wed Oct 12 12:19:00 2011, Number of Pages: 1, Number of Words: 276, Number of Characters: 1579, Security: 0",
"sha256": "c8e73bcaf4d70b6f2ac155110644033f0a3a912685c910f022a272f2b3cd9e68",
"urls": [
"http:\/\/schemas.openxmlformats.org\/drawingml\/2006\/main"
],
"crc32": "7EEDC93F",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/10467\/files\/c8e73bcaf4d70b6f_\u00c2\u00bb\u00c3\u00b1a\u00c3\u00b1t\u00c3\u00b1\u00c2\u00a18 \u00c3\u00b1\u00c2\u00ab\u00c2\u00acp\u00c2\u00bc\u00c3\u00b1\u00c2\u00a1g\u00c2\u00ab\u00c3\u00b3 \u00c3\u00b1\u00c2\u00bdn pt\u00c3\u00a1\u00c3\u009fg\u00c2\u00bfn.doc",
"ssdeep": null,
"size": 27136,
"sha512": "a39a211a44f022cc59171418aee0b7d0d4595087f245f31fd336a097d6b29c875e4ba043b67243f55fb60e6857abf27e930efcde073cf9488151115dd44a7d61",
"md5": "310fed9dcb0a97700a189824887e5427"
},
{
"yara": [],
"sha1": "72ccc52bf8f29b09c7d73646a538c12488792024",
"name": "aa03338e84cdaf3e_\u00c3\u009f\u00c3\u00b3\u00c3\u00b1\u00c3\u00b1\u00c3\u00b1\u00c2\u00a1\u00c2\u00bfn \u00c2\u00ab\u00c3\u00ad \u00c2\u00ab\u00c3\u00ado\u00c3\u00b1\u00c2\u00acg\u00c3\u00a1s \u00c2\u00a1\u00c3\u00b1\u00c3\u00b1\u00c3\u00b3\u00c2\u00bf\u00c2\u00aa\u00c2\u00bf\u00c2\u00bc\u00c2\u00ab\u00c3\u009fg\u00c2\u00bf.doc",
"type": "Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1251, Author: Admin, Template: Normal.dotm, Last Saved By: Admin, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:00, Create Time\/Date: Wed Oct 12 06:17:00 2011, Last Saved Time\/Date: Wed Oct 12 06:18:00 2011, Number of Pages: 9, Number of Words: 4, Number of Characters: 23, Security: 0",
"sha256": "aa03338e84cdaf3e8b7d3adf6b3d8c0ab7f73c7a19e2ce3b8b84eaeff02437f0",
"urls": [
"http:\/\/schemas.openxmlformats.org\/drawingml\/2006\/main"
],
"crc32": "909A435C",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/10467\/files\/aa03338e84cdaf3e_\u00c3\u009f\u00c3\u00b3\u00c3\u00b1\u00c3\u00b1\u00c3\u00b1\u00c2\u00a1\u00c2\u00bfn \u00c2\u00ab\u00c3\u00ad \u00c2\u00ab\u00c3\u00ado\u00c3\u00b1\u00c2\u00acg\u00c3\u00a1s \u00c2\u00a1\u00c3\u00b1\u00c3\u00b1\u00c3\u00b3\u00c2\u00bf\u00c2\u00aa\u00c2\u00bf\u00c2\u00bc\u00c2\u00ab\u00c3\u009fg\u00c2\u00bf.doc",
"ssdeep": null,
"size": 2361856,
"sha512": "7b27dbfac1a900098f9e16ed7f8963b3c674f6238f03c56940e953be2d150e4e3d8189ad1f1cf55b312840ae7a2a5ba55ad72d6f23799b54a34da512a742949e",
"md5": "d0125e7ef34474ac29fa5deea925b202"
},
{
"yara": [],
"sha1": "714a60a8a991a39af129841a646e65a1ac4401ba",
"name": "d99c08b58320d3e2_\u00c3\u00a4\u00c3\u00a5\u00c3\u00aa\u00c3\u00a6\u00c2\u00a3.doc",
"type": "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Template: Normal, Revision Number: 3, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:00, Last Printed: Wed Jul 9 09:32:00 2003, Create Time\/Date: Mon May 30 07:50:00 2011, Last Saved Time\/Date: Mon May 30 07:51:00 2011, Number of Pages: 1, Number of Words: 222, Number of Characters: 1272, Security: 0",
"sha256": "d99c08b58320d3e28058feea92a76355237247b95b6a4eb00bda7eec5978e4b0",
"urls": [
"http:\/\/schemas.openxmlformats.org\/drawingml\/2006\/main"
],
"crc32": "4EA50C06",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/10467\/files\/d99c08b58320d3e2_\u00c3\u00a4\u00c3\u00a5\u00c3\u00aa\u00c3\u00a6\u00c2\u00a3.doc",
"ssdeep": null,
"size": 25088,
"sha512": "10f4c68e25421d439d50051fe482cb3be4780854a93880a82ecdd2726895affddff83a91c79601f1183bdd20ebd69ff783e615b7675faf6f762e735048104c26",
"md5": "e0ade6ce4779cf7a9d17d27f983fc4e9"
},
{
"yara": [],
"sha1": "fddaae6a524efd1284da65ba32621c5aa3ddedf0",
"name": "64b4bb1a05852116_\u00c3\u00a4\u00c3\u00adon\u00c3\u00b3\u00c2\u00bd\u00c3\u00b1\u00c2\u00a1\u00c2\u00bf\u00c3\u00b1 \u00c3\u00a1\u00c2\u00ac\u00c2\u00b5\u00c2\u00bf\u00c2\u00bf \u00c3\u00a6\u00c3\u00b1a\u00c3\u00b3\u00c2\u00bf\u00c3\u009f.doc",
"type": "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Title: , Author: kma, Template: Normal, Revision Number: 5, Name of Creating Application: Microsoft Office Word, Total Editing Time: 29:00, Last Printed: Wed Jul 14 06:34:00 2010, Create Time\/Date: Wed Oct 12 08:32:00 2011, Last Saved Time\/Date: Wed Oct 12 14:05:00 2011, Number of Pages: 1, Number of Words: 707, Number of Characters: 4036, Security: 0",
"sha256": "64b4bb1a058521161e15b66e42541a66f592a09edb1d6217584070252c8589ba",
"urls": [
"http:\/\/schemas.openxmlformats.org\/drawingml\/2006\/main"
],
"crc32": "3CF5B8AC",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/10467\/files\/64b4bb1a05852116_\u00c3\u00a4\u00c3\u00adon\u00c3\u00b3\u00c2\u00bd\u00c3\u00b1\u00c2\u00a1\u00c2\u00bf\u00c3\u00b1 \u00c3\u00a1\u00c2\u00ac\u00c2\u00b5\u00c2\u00bf\u00c2\u00bf \u00c3\u00a6\u00c3\u00b1a\u00c3\u00b3\u00c2\u00bf\u00c3\u009f.doc",
"ssdeep": null,
"size": 53760,
"sha512": "b2bff7054fb63c786c2bf5fc8a18d916cfcb3ad1f48f5dad8b067e4d60d83b470045f923a74edf46a687d5006112898de49205141af4a670a78227e3e157298d",
"md5": "9a49b05379ac47899fd20f05254ea268"
}
]Generic
[
{
"process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\cff8361b3fd4d8285875d1e385889ed4f69b9d8db963d3949b1a28b58bd5eafd.bin",
"process_name": "cff8361b3fd4d8285875d1e385889ed4f69b9d8db963d3949b1a28b58bd5eafd.bin",
"pid": 1512,
"summary": {
"file_created": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00e4\u00ab\u00fa\u00ab\u00f3\u00aba \u00ba\u00e1\u00f1\u00e1G\u00ac\u00e1 \u00ab\u00eda\u00e1\u00ba\u00d1\u00b5.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00c4\u00c5\u00ea\u00e6\u00a3.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\img073.pdf",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\\u00df\u00f3\u00d1\u00f1\u00d1\u00a1\u00bfn \u00ab\u00ed \u00ab\u00edO\u00d1\u00acG\u00e1s \u00a1\u00d1\u00f1\u00f3\u00bf\u00aa\u00bf\u00bc\u00ab\u00dfG\u00bf.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\img074.pdf",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00bb\u00d1a\u00d1t\u00d1\u00a18 \u00f1\u00ab\u00acp\u00bc\u00d1\u00a1G\u00ab\u00f3 \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00e7\u00e1n\u00f3\u00ac\u00e1 \u00a1\u00e1 pt\u00e1\u00dfG\u00bf\u00d1 \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1 \u00ab\u00eda\u00e1\u00ba\u00d1\u00b5 \u00fa\u00ab\u00dfp\u00f1.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00fa\u00ab\u00f3\u00aba \u00acp\u00bb\u00bd\u00bf-\u00bba\u00ab\u00f1\u00e1\u00aa\u00bf \u00bba\u00ab\u00d1\u00acG.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00c4\u00edOn\u00f3\u00bd\u00d1\u00a1\u00bf\u00d1 \u00e1\u00ac\u00b5\u00bf\u00bf \u00e6\u00d1a\u00f3\u00bf\u00df.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\\u00fcps\u00fa\u00e1\u00bdG\u00d1a\u00df\u00ac\u00bf\u00ac \u00ed\u00e1\u00bd\u00e1\u00a1\u00df 1 \u00bb\u00ab\u00bdp\u00fa\u00ab\u00f1\u00bf\u00d1.pdf"
],
"directory_created": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1"
],
"dll_loaded": [
"C:\\Windows\\syswow64\\MSCTF.dll",
"ADVAPI32.dll",
"kernel32.dll",
"UxTheme.dll",
"OLEAUT32.DLL",
"C:\\Windows\\system32\\ole32.dll",
"dwmapi.dll",
"comctl32.dll",
"IMM32.dll"
],
"file_opened": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00e4\u00ab\u00fa\u00ab\u00f3\u00aba \u00ba\u00e1\u00f1\u00e1G\u00ac\u00e1 \u00ab\u00eda\u00e1\u00ba\u00d1\u00b5.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\cff8361b3fd4d8285875d1e385889ed4f69b9d8db963d3949b1a28b58bd5eafd.bin",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00c4\u00c5\u00ea\u00e6\u00a3.doc",
"C:\\Windows\\Fonts\\staticcache.dat",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\img073.pdf",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\\u00df\u00f3\u00d1\u00f1\u00d1\u00a1\u00bfn \u00ab\u00ed \u00ab\u00edO\u00d1\u00acG\u00e1s \u00a1\u00d1\u00f1\u00f3\u00bf\u00aa\u00bf\u00bc\u00ab\u00dfG\u00bf.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\img074.pdf",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00bb\u00d1a\u00d1t\u00d1\u00a18 \u00f1\u00ab\u00acp\u00bc\u00d1\u00a1G\u00ab\u00f3 \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00e7\u00e1n\u00f3\u00ac\u00e1 \u00a1\u00e1 pt\u00e1\u00dfG\u00bf\u00d1 \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1 \u00ab\u00eda\u00e1\u00ba\u00d1\u00b5 \u00fa\u00ab\u00dfp\u00f1.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00fa\u00ab\u00f3\u00aba \u00acp\u00bb\u00bd\u00bf-\u00bba\u00ab\u00f1\u00e1\u00aa\u00bf \u00bba\u00ab\u00d1\u00acG.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00c4\u00edOn\u00f3\u00bd\u00d1\u00a1\u00bf\u00d1 \u00e1\u00ac\u00b5\u00bf\u00bf \u00e6\u00d1a\u00f3\u00bf\u00df.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\\u00fcps\u00fa\u00e1\u00bdG\u00d1a\u00df\u00ac\u00bf\u00ac \u00ed\u00e1\u00bd\u00e1\u00a1\u00df 1 \u00bb\u00ab\u00bdp\u00fa\u00ab\u00f1\u00bf\u00d1.pdf"
],
"regkey_opened": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\Tracing",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Microsoft Sans Serif",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback",
"HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\LayoutIcon\\0409\\0000041d",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\cff8361b3fd4d8285875d1e385889ed4f69b9d8db963d3949b1a28b58bd5eafd.bin",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLEAUT",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0"
],
"file_written": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00e4\u00ab\u00fa\u00ab\u00f3\u00aba \u00ba\u00e1\u00f1\u00e1G\u00ac\u00e1 \u00ab\u00eda\u00e1\u00ba\u00d1\u00b5.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00c4\u00c5\u00ea\u00e6\u00a3.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\img073.pdf",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\\u00df\u00f3\u00d1\u00f1\u00d1\u00a1\u00bfn \u00ab\u00ed \u00ab\u00edO\u00d1\u00acG\u00e1s \u00a1\u00d1\u00f1\u00f3\u00bf\u00aa\u00bf\u00bc\u00ab\u00dfG\u00bf.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\img074.pdf",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00bb\u00d1a\u00d1t\u00d1\u00a18 \u00f1\u00ab\u00acp\u00bc\u00d1\u00a1G\u00ab\u00f3 \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00e7\u00e1n\u00f3\u00ac\u00e1 \u00a1\u00e1 pt\u00e1\u00dfG\u00bf\u00d1 \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1 \u00ab\u00eda\u00e1\u00ba\u00d1\u00b5 \u00fa\u00ab\u00dfp\u00f1.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00fa\u00ab\u00f3\u00aba \u00acp\u00bb\u00bd\u00bf-\u00bba\u00ab\u00f1\u00e1\u00aa\u00bf \u00bba\u00ab\u00d1\u00acG.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00c4\u00edOn\u00f3\u00bd\u00d1\u00a1\u00bf\u00d1 \u00e1\u00ac\u00b5\u00bf\u00bf \u00e6\u00d1a\u00f3\u00bf\u00df.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\\u00fcps\u00fa\u00e1\u00bdG\u00d1a\u00df\u00ac\u00bf\u00ac \u00ed\u00e1\u00bd\u00e1\u00a1\u00df 1 \u00bb\u00ab\u00bdp\u00fa\u00ab\u00f1\u00bf\u00d1.pdf"
],
"file_exists": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00e4\u00ab\u00fa\u00ab\u00f3\u00aba \u00ba\u00e1\u00f1\u00e1G\u00ac\u00e1 \u00ab\u00eda\u00e1\u00ba\u00d1\u00b5.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00c4\u00edOn\u00f3\u00bd\u00d1\u00a1\u00bf\u00d1 \u00e1\u00ac\u00b5\u00bf\u00bf \u00e6\u00d1a\u00f3\u00bf\u00df.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00c4\u00c5\u00ea\u00e6\u00a3.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\",
"C:\\Users\\cuck\\AppData",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\img073.pdf",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\\u00fcps\u00fa\u00e1\u00bdG\u00d1a\u00df\u00ac\u00bf\u00ac \u00ed\u00e1\u00bd\u00e1\u00a1\u00df 1 \u00bb\u00ab\u00bdp\u00fa\u00ab\u00f1\u00bf\u00d1.pdf",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\",
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\\u00df\u00f3\u00d1\u00f1\u00d1\u00a1\u00bfn \u00ab\u00ed \u00ab\u00edO\u00d1\u00acG\u00e1s \u00a1\u00d1\u00f1\u00f3\u00bf\u00aa\u00bf\u00bc\u00ab\u00dfG\u00bf.doc",
"C:\\Users\\cuck",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\img074.pdf",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00e7\u00e1n\u00f3\u00ac\u00e1 \u00a1\u00e1 pt\u00e1\u00dfG\u00bf\u00d1 \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1 \u00ab\u00eda\u00e1\u00ba\u00d1\u00b5 \u00fa\u00ab\u00dfp\u00f1.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00fa\u00ab\u00f3\u00aba \u00acp\u00bb\u00bd\u00bf-\u00bba\u00ab\u00f1\u00e1\u00aa\u00bf \u00bba\u00ab\u00d1\u00acG.doc",
"C:\\Users",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00bb\u00d1a\u00d1t\u00d1\u00a18 \u00f1\u00ab\u00acp\u00bc\u00d1\u00a1G\u00ab\u00f3 \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn.doc",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1",
"C:\\Users\\cuck\\AppData\\Local"
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\cff8361b3fd4d8285875d1e385889ed4f69b9d8db963d3949b1a28b58bd5eafd.bin",
"C:\\Windows\\Fonts\\staticcache.dat"
],
"regkey_read": [
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\PageAllocatorUseSystemHeap",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\PageAllocatorSystemHeapIsPrivate",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16"
],
"directory_enumerated": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\cff8361b3fd4d8285875d1e385889ed4f69b9d8db963d3949b1a28b58bd5eafd.bin",
"C:\\Users\\cuck\\AppData",
"C:\\Users\\cuck\\AppData\\Local\\Temp",
"C:\\Users\\cuck",
"C:\\Users",
"C:\\Users\\cuck\\AppData\\Local"
]
},
"first_seen": 1604080387.578125,
"ppid": 2892
},
{
"process_path": "C:\\Windows\\System32\\lsass.exe",
"process_name": "lsass.exe",
"pid": 476,
"summary": {},
"first_seen": 1604080387.328125,
"ppid": 376
}
]Signatures
[
{
"markcount": 10,
"families": [],
"description": "Creates (office) documents on the filesystem",
"severity": 2,
"marks": [
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00e4\u00ab\u00fa\u00ab\u00f3\u00aba \u00ba\u00e1\u00f1\u00e1G\u00ac\u00e1 \u00ab\u00eda\u00e1\u00ba\u00d1\u00b5.doc",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00c4\u00c5\u00ea\u00e6\u00a3.doc",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\img073.pdf",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\\u00df\u00f3\u00d1\u00f1\u00d1\u00a1\u00bfn \u00ab\u00ed \u00ab\u00edO\u00d1\u00acG\u00e1s \u00a1\u00d1\u00f1\u00f3\u00bf\u00aa\u00bf\u00bc\u00ab\u00dfG\u00bf.doc",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\img074.pdf",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00bb\u00d1a\u00d1t\u00d1\u00a18 \u00f1\u00ab\u00acp\u00bc\u00d1\u00a1G\u00ab\u00f3 \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn.doc",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00acp\u00bc\u00d1\u00a1Gd \u00f1\u00bdn pt\u00e1\u00dfG\u00bfn \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1\\\u00e7\u00e1n\u00f3\u00ac\u00e1 \u00a1\u00e1 pt\u00e1\u00dfG\u00bf\u00d1 \u00f3 \u00e1p\u00ac\u00b5\u00bf\u00ab\u00a1\u00d1 \u00ab\u00eda\u00e1\u00ba\u00d1\u00b5 \u00fa\u00ab\u00dfp\u00f1.doc",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00fa\u00ab\u00f3\u00aba \u00acp\u00bb\u00bd\u00bf-\u00bba\u00ab\u00f1\u00e1\u00aa\u00bf \u00bba\u00ab\u00d1\u00acG.doc",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00c4\u00edOn\u00f3\u00bd\u00d1\u00a1\u00bf\u00d1 \u00e1\u00ac\u00b5\u00bf\u00bf \u00e6\u00d1a\u00f3\u00bf\u00df.doc",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\\u00ea\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn \u00bb\u00ab \u00bba\u00ab\u00f1\u00e1\u00aa\u00d1 \u00e1\u00ac\u00b5\u00bf\u00ac \u00c4\u00c7\u00c4 \u00e6\u00d1a\u00f3\u00bf\u00df\\\u00f1\u00ab\u00bb. \u00bf\u00a1S\u00aba\u00bc\u00e1\u00b5\u00bfn\\\u00fcps\u00fa\u00e1\u00bdG\u00d1a\u00df\u00ac\u00bf\u00ac \u00ed\u00e1\u00bd\u00e1\u00a1\u00df 1 \u00bb\u00ab\u00bdp\u00fa\u00ab\u00f1\u00bf\u00d1.pdf",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "creates_doc"
}
]Yara
The Yara rules did not detect anything in the file.
Network
{
"tls": [],
"udp": [
{
"src": "192.168.56.101",
"dst": "192.168.56.255",
"offset": 662,
"time": 6.208482027053833,
"dport": 137,
"sport": 137
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 5190,
"time": 6.169864177703857,
"dport": 5355,
"sport": 51001
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 5518,
"time": 4.1649510860443115,
"dport": 5355,
"sport": 53595
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 5846,
"time": 6.181207180023193,
"dport": 5355,
"sport": 53848
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 6174,
"time": 4.7838451862335205,
"dport": 5355,
"sport": 54255
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 6502,
"time": 3.0453100204467773,
"dport": 5355,
"sport": 55314
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 6830,
"time": 4.251440048217773,
"dport": 1900,
"sport": 1900
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 18678,
"time": 4.194594144821167,
"dport": 3702,
"sport": 49152
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 22870,
"time": 6.255638122558594,
"dport": 1900,
"sport": 53598
}
],
"dns_servers": [],
"http": [],
"icmp": [],
"smtp": [],
"tcp": [],
"smtp_ex": [],
"mitm": [],
"hosts": [],
"pcap_sha256": "4179dffe9f6a42de6ea2e8a060ef5274a2fa2cb6811521d0311e44670f7058a8",
"dns": [],
"http_ex": [],
"domains": [],
"dead_hosts": [],
"sorted_pcap_sha256": "a8e57a67178cae223c9f919329f3a7db834d6439335baf7d5719cbd7dc5aea94",
"irc": [],
"https_ex": []
}Screenshots
akciikov.exe removal instructions
The instructions below shows how to remove akciikov.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the akciikov.exe file for removal, restart your computer and scan it again to verify that akciikov.exe has been successfully removed. Here are the removal instructions in more detail:
- Download and install FreeFixer: http://www.freefixer.com/download.html
- Start FreeFixer and press the Start Scan button. The scan will finish in approximately five minutes.
- When the scan is finished, locate akciikov.exe in the scan result and tick the checkbox next to the akciikov.exe file. Do not check any other file for removal unless you are 100% sure you want to delete it. Tip: Press CTRL-F to open up FreeFixer's search dialog to quickly locate akciikov.exe in the scan result.
c:\downloads\akciikov.exe 
- Scroll down to the bottom of the scan result and press the Fix button. FreeFixer will now delete the akciikov.exe file.
- Restart your computer.
- Start FreeFixer and scan your computer again. If akciikov.exe still remains in the scan result, proceed with the next step. If akciikov.exe is gone from the scan result you're done.
- If akciikov.exe still remains in the scan result, check its checkbox again in the scan result and click Fix.
- Restart your computer.
- Start FreeFixer and scan your computer again. Verify that akciikov.exe no longer appear in the scan result.
Hashes [?]
| Property | Value |
|---|---|
| MD5 | 545c5ad9a8f14b77191ba3459476152e |
| SHA256 | cff8361b3fd4d8285875d1e385889ed4f69b9d8db963d3949b1a28b58bd5eafd |
Error Messages
These are some of the error messages that can appear related to akciikov.exe:
akciikov.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
akciikov.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.
akciikov.exe has stopped working.
End Program - akciikov.exe. This program is not responding.
akciikov.exe is not a valid Win32 application.
akciikov.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.
What will you do with akciikov.exe?
To help other users, please let us know what you will do with akciikov.exe:
Comments
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
No comments posted yet.