cobaltstrike | 42c0b7865a97c5bdf243a9fa8a57a622140eaecb52d831aa2f3141a18619ff7f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
04-07-2022 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42c0b7865a97c5bdf243a9fa8a57a622140eaecb52d831aa2f3141a18619ff7f.msi
Size

3.0MB
MD5

83d7f0fe8d269f04c7665c0b6cbb8ada
SHA1

902921743f59ff19eeb395d2618ef5addeac62fd
SHA256

42c0b7865a97c5bdf243a9fa8a57a622140eaecb52d831aa2f3141a18619ff7f
SHA512

c51cc2f1779bc9fd659cda5524464098fa19dd86910d7a23b4353d944e5dbe56ba43314ecb9b6352b9614e7f43f76d7b61fe60bf5a5c4889ac264dd8a7f845eb

Score

10^/10

cobaltstrike 0 305419896 backdoor trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

305419896

http://47.111.170.180:8888/load

Attributes

access_type
512
host
47.111.170.180,/load
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
polling_time
60000
port_number
8888
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCepxWkRvKff9aSr8NJNjICKAfOAkCwiFfvggEjm6rsOd85r6J2MO/aflKXRMu6HUJ7YdYYiTR4AqWEq0crzforQfGXDqJ355NO17M/jGAEtdClSmPsH/w3g3OgnEq4mk086l68Kw0uE3i/neDyRh+nRllGEVlzNToWUJqwR2asBQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/submit.php
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
watermark
305419896

Extracted

Family

cobaltstrike

Botnet

Attributes

watermark
0

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

30 3716 powershell.exe
36 3716 powershell.exe
Executes dropped EXE 3 IoCs

Processes:

aipackagechainer.exe2.exeword.exe

pid process

4812 aipackagechainer.exe
1992 2.exe
1368 word.exe
Loads dropped DLL 6 IoCs

Processes:

MsiExec.exe

pid process

3204 MsiExec.exe
3204 MsiExec.exe
3204 MsiExec.exe
3204 MsiExec.exe
3204 MsiExec.exe
3204 MsiExec.exe

flow	pid	process
30	3716	powershell.exe
36	3716	powershell.exe

pid	process
4812	aipackagechainer.exe
1992	2.exe
1368	word.exe

pid	process
3204	MsiExec.exe
3204	MsiExec.exe
3204	MsiExec.exe
3204	MsiExec.exe
3204	MsiExec.exe
3204	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in System32 directory 12 IoCs

Processes:

powershell.exeWINWORD.EXE

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442	WINWORD.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177	WINWORD.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EB35376744F392396307460D546222D_DD2D9EEABEF3F0DB36412FEE753FD2DC	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442	WINWORD.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177	WINWORD.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\378B079587A9184B2E2AB859CB263F40_524AD1B9B08D3C6450727265AE77B7D2	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\378B079587A9184B2E2AB859CB263F40_524AD1B9B08D3C6450727265AE77B7D2	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EB35376744F392396307460D546222D_DD2D9EEABEF3F0DB36412FEE753FD2DC	powershell.exe

Drops file in Windows directory 15 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSID8A7.tmp	msiexec.exe
File created	C:\Windows\Installer\e56d2e8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e56d2e5.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6FC0DCAF-2415-4037-9FF4-4C69473B7FC0}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID372.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID74D.tmp	msiexec.exe
File created	C:\Windows\Installer\e56d2e5.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID973.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID9D2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID632.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID6DF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID7AC.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e111c2ed168134740000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e111c2ed0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900e111c2ed000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e111c2ed00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e111c2ed00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies data under HKEY_USERS 64 IoCs

Processes:

WINWORD.EXE2.exepowershell.exepowershell.exeaipackagechainer.exeword.exepowershell.exepowershell.exe

description	ioc	process
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\Common\LCCache\WordDocParts	WINWORD.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\User Settings\Mso_Intl	WINWORD.EXE
Key created	\Registry\User\.Default\Software\Microsoft\ASF Stream Descriptor File	WINWORD.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Font Mapping\Century Schoolbook = "NewCenturySchlbk"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word\Large Icon = "[13]"	WINWORD.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\PerpetualLicenseInfo = "std::wstring\|2016"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\winword.exe\ETWMonitor\{BB00E856-A12F-4AB7-B2C8-4E80CAEA5B07}\Categories = 21030000ee0300002c0300002a0300001f030000c60400002b030000	WINWORD.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\IOAV\LastBootTime = "1656689976"	WINWORD.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\PowerPoint\Security\Trusted Locations\Location1\Path = "C:\\Program Files\\Microsoft Office\\Root\\Templates\\"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\PowerPoint\Security\Trusted Locations\Location1\Description = "9"	WINWORD.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\UserInfo\UserName = "SYSTEM"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Licensing\FirstCleanValidation = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	aipackagechainer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\General\Themes = "Themes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\ODBC\ODBC.INI\MS Access Database\Engines\Jet\UserCommitSync = "Yes"	WINWORD.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\Excel\Security\Trusted Locations	WINWORD.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\WINWORD.EXE\ULSMONITOR	WINWORD.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\Word\Options	WINWORD.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Font Mapping\Times = "Times Roman"	WINWORD.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\Common\LCCache\WordDocBibs	WINWORD.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData\1 = 4d736f3a3a436865636b73756d52656769737472793a3a446174617c75696e7436345f747c2d3536383439343335383336313738323035303b456373436f6e666967526573706f6e7365446174617c7b202256657222203a2022696e7433325f747c30222c2022436f6e6649647322203a20227374643a3a77737472696e677c502d522d37363735372d312d322c502d522d32363134362d352d31352c502d442d32393633352d312d312c502d442d32373038372d312d392c502d522d37393638382d312d332c502d522d35333533322d312d352c502d522d35313433362d312d362c502d522d35313432372d31382d31322c502d522d34303436342d31382d392c502d582d39383531382d332d372c502d522d33383339302d31382d32312c626c6f636b65646772617068696373616461707465725f726576323a3137343637342c502d522d35323136392d312d332c502d522d33353039392d322d342c502d522d36313430382d31382d332c502d522d35353734362d322d352c502d522d35333531322d312d342c502d522d34363937342d31382d31382c502d522d33383935332d312d31312c502d522d33363535312d31382d31382c502d522d37313431342d312d362c502d522d34303235332d362d31392c502d522d34303235342d362d31382c502d522d33353430312d362d372c502d522d33323130372d32322d32322c502d522d33393134362d31342d31352c502d522d33393134372d31342d32302c502d522d32383534362d362d31302c502d522d32383136352d362d32382c502d522d32343938302d382d34382c502d522d32343339302d352d31312c502d522d31393034362d322d31392c502d522d31383237392d322d36352c502d442d33343230302d342d352c502d522d35313134352d322d372c502d522d33373732312d31312d34372c502d522d32393932382d322d32302c502d522d37333333342d332d392c502d522d36373933322d312d342c502d522d36373230312d312d342c502d522d36343534352d312d342c502d522d36343033352d312d342c502d522d35333531352d31382d392c502d522d35333238302d312d362c502d522d35323234372d312d352c502d522d35313935382d312d352c502d522d35313834322d312d352c502d522d35313237372d322d362c502d522d34373435312d31382d32302c502d522d34353938342d31382d31372c502d522d34353931392d31382d31392c502d522d34353038352d31382d31322c502d522d34313434322d31382d31382c502d522d33383038352d31322d392c502d522d31383734342d362d32322c502d442d33343235372d392d362c502d442d33343233392d312d362c502d452d32383637372d43312d332c502d522d35353132322d382d382c502d522d35313234342d312d392c502d522d35303235352d31302d392c502d522d34343930372d312d392c502d522d34353331342d31302d31362c502d522d34343936352d43312d362c502d452d33383233312d322d342c502d522d3130383334322d31342d31372c502d522d39353232352d31342d31372c502d522d39343636312d31342d31332c502d522d39343536302d31342d31322c502d522d39343138392d31342d31332c502d522d39333838322d31342d32362c502d522d35343732382d31362d32332c502d522d35343639382d31362d31362c502d522d35343635382d31382d31392c502d522d33383330362d31382d332c502d522d33353731372d352d33302c502d522d33343031392d342d332c502d582d35333834352d312d392c502d582d35333737322d312d332c502d582d35313739302d312d332c502d452d34323730302d322d342c502d522d37313335382d312d342c502d522d37303934312d312d342c502d522d36393036352d312d332c502d522d36373136302d312d372c502d522d35393738312d312d342c502d522d35353633312d312d342c502d522d35343231352d312d342c502d522d35333735312d312d342c502d522d35333735322d312d342c502d522d35333532362d312d342c502d522d35323131302d312d342c502d522d34393736352d31352d33322c502d522d34383831382d31372d32352c502d522d35303637392d312d342c502d522d35303438362d31382d31322c502d522d34343833302d31382d31332c502d522d34393431362d342d31342c502d522d34383639392d4331372d31382c502d522d34383435372d322d362c502d522d34373436382d31362d31392c502d522d34373937342d31362d31382c502d522d34363534342d31382d31312c502d522d34353630392d31342d362c502d522d34353139372d322d362c502d522d34343034362d31382d31312c502d522d34343031352d31382d32302c502d522d34333732332d322d362c502d522d34323435372d31382d352c502d522d34313939342d392d32342c502d522d34313734322d31382d33322c502d522d34313732312d31382d31332c502d522d33373936332d31382d32362c502d522d34303938302d31382d31362c502d522d34303335392d322d31302c502d522d33393032392d352d31382c502d522d33383833352d31382d34382c502d522d33383139332d32382d33392c502d522d33373637362d31382d34362c502d522d33363331352d31302d33312c502d522d33373439322d31382d392c502d522d33373436372d31382d34342c502d522d33363537352d342d362c502d522d33363437382d322d362c502d522d33363331302d342d352c502d522d33353934352d31302d352c502d522d33353134332d342d342c502d522d33333535332d342d362c502d522d33333533362d31322d31332c502d522d32393830392d312d362c502d522d32383237362d312d342c502d522d32363936382d332d392c66697365723139303a34393439382c686170707930333137323032302d313a36313937372c686170707930323036323032302d303a32383432382c502d522d35333534352d342d352c502d522d35303731312d31382d31312c502d522d34393733362d362d32322c502d522d34383730362d31382d31382c502d522d34383436372d31382d31382c502d522d34323639362d31382d31322c502d522d33323130362d372d33332c502d522d33303038352d312d392c502d522d32393133382d33382d38332c502d522d32393331352d33362d36392c502d522d32373537342d362d33382c502d522d32353135372d382d31342c502d522d32343336332d362d31312c502d522d32323233382d31302d32312c502d522d32313633312d31302d36342c502d522d31393839382d312d32322c502d522d31393831342d312d36322c502d522d31393031322d312d35372c502d522d33333535352d312d352c502d582d313031353535342d312d352c502d582d35303232302d312d332c502d582d34393733302d312d332c502d522d36393334372d312d352c502d522d36343537342d312d342c502d522d35343131362d312d342c502d522d35333538352d31382d31382c502d522d35323539342d31382d352c502d522d35323338362d312d342c502d522d35303938302d322d342c502d522d35303933382d312d342c502d522d35303135322d31382d31302c502d522d34393137352d31382d32322c502d522d33363638332d31382d33392c502d522d34373831392d31382d31352c502d522d34373236302d31382d32332c502d522d34363737332d31382d32302c502d522d34333238342d31382d31392c502d522d34333238352d31322d32322c502d522d34323438322d312d342c502d522d34303939302d31322d31352c502d522d33393539342d31382d31342c502d522d33393333332d31382d32382c502d522d33353937322d322d352c502d522d33353537322d322d332c502d522d33353433392d31322d32312c502d522d33333231352d31382d31392c502d522d33313335322d31322d32352c502d522d32383735312d322d32302c502d442d33343236392d322d352c6772736b693435353a3232373433362c67727573653438383a31393737322c677269636f3430363a31393737372c502d452d32393537362d322d372c502d452d32393332352d43312d342c502d522d34393833302d31382d31352c502d522d34303538362d31382d32372c502d522d34303733322d31382d31362c502d522d33393134332d31382d32332c502d522d33323939362d31382d32342c502d442d34303331362d392d352c502d522d35303432392d31382d382c502d522d33363533392d31302d352c502d522d32343038342d312d31362c502d522d36313836312d312d342c502d522d36313733372d312d342c502d522d35313737372d31382d382c502d522d35303932302d312d362c502d522d35303336362d31382d31392c502d522d33353938352d31342d32302c502d522d33353839312d31382d352c502d522d33323030342d322d352c502d522d36383333362d322d342c502d522d36373238362d322d362c502d522d35313531332d322d342c502d522d34393538392d31382d33372c502d522d33393131332d32322d34372c502d522d33353230392d382d362c502d522d37393936332d312d322c502d522d35323034332d312d332c502d522d35313736342d312d342c502d522d34393338382d322d362c502d522d34383333352d342d31362c502d522d34373330382d332d392c502d522d34323339322d322d342c502d522d33393037332d312d352c502d522d313030393835352d31322d31342c502d522d39383835362d31382d34382c502d522d33383431302d31382d32322c502d522d36363433362d312d332c502d522d36343137382d31382d392c502d522d36323837332d312d342c502d522d35313039372d312d352c502d522d35303730362d31382d372c502d522d35303035352d31382d372c502d522d34393331352d31382d352c502d522d34353338322d31382d372c502d522d34323636302d31382d33352c502d522d33363634392d382d382c502d522d34323337392d322d332c502d522d34323337382d322d332c502d522d36363533392d312d342c502d522d36363533382d312d342c502d522d36353237382d312d342c502d522d36353237392d312d342c502d522d35393138302d312d342c502d522d34383037302d312d352c502d522d34373338362d312d342c502d522d35353334322d322d322c502d522d35333337372d322d362c502d522d35323438312d322d352c502d522d34393735392d322d382c502d522d34363130302d32302d392c502d522d33383531302d322d31302c502d522d33373535302d32302d31332c502d522d33323138362d32382d32392c502d522d35383133352d322d342c502d522d35363631382d312d332c502d522d35363032372d312d342c502d522d35323930362d312d342c502d522d36313731382d31382d332c502d522d34363134352d31382d31382c502d522d33353531332d342d342c502d522d33333839322d312d382c502d522d33333639362d312d352c502d522d33333536392d312d392c502d522d33313938372d312d362c502d522d35353734392d312d342c502d522d35333636322d312d342c502d522d35323234362d312d342c502d522d35323234352d312d342c502d522d35323233382d312d352c502d522d34333634342d362d31332c502d522d33393931322d312d322c502d522d33393238332d342d31302c502d522d35303338302d31382d31382c502d522d35303337392d31382d31372c502d522d36383134362d312d352c502d522d36333430392d312d352c502d522d35303534322d31382d31342c502d522d35303530302d31382d31362c502d522d34383336352d31382d32342c502d522d34383136312d31382d33322c502d522d34363539372d312d342c502d522d33333934332d35342d34342c502d522d33333733372d312d342c502d452d32393636322d322d332c502d522d35363635342d322d342c502d522d35333738352d31382d392c502d522d35333235362d322d31312c502d522d35313730332d312d352c502d522d35303133332d322d392c502d522d34373234322d31382d31312c502d522d34363431302d312d352c502d522d34353535302d4331372d34362c502d522d34353537392d31382d382c502d522d34353439302d31362d392c502d522d34343838352d31382d32302c502d522d34323531322d312d322c502d522d34303136392d382d31332c502d522d33393730302d322d372c502d522d33383730342d342d362c502d522d33383231322d322d31312c502d522d33373331332d31382d32322c502d522d33363636342d342d332c502d522d33363338352d31382d32302c502d522d33353937332d322d342c502d522d33353934362d362d342c502d522d33353834362d382d342c502d522d33353437362d322d352c502d522d33353430372d342d332c502d522d33353233372d31342d31312c502d522d33353233342d31342d31302c502d522d33353135302d322d342c502d522d33353132392d322d342c502d522d33353035362d342d352c502d522d33343838392d382d342c502d522d33343034342d322d342c502d522d33333731382d362d352c502d522d33333435392d312d352c502d522d33333033382d43312d332c502d522d33323235322d34302d36332c502d522d33313932312d32302d36382c502d522d33303239322d342d372c502d522d32383634342d312d342c502d522d32343033372d312d362c502d522d32333434352d332d362c502d522d32333431302d312d362c502d522d32333337302d322d372c502d522d32333438352d312d372c502d522d32333433342d332d372c502d522d32333430332d332d382c502d522d31383531332d312d33302c502d522d31393032342d32322d36312c502d442d33343639392d342d342c502d442d33343639372d322d342c502d442d33343637352d312d342c502d442d33343637332d312d342c502d442d33343635342d312d342c502d442d33343630392d312d332c502d442d33343538372d332d352c502d442d33343236362d312d342c502d442d33343236322d312d352c502d442d33343236302d312d352c502d442d33343235382d322d352c502d442d33343235302d312d332c502d442d33323436352d312d352c502d442d33323435392d322d342c502d442d33323435382d352d342c502d522d36393532392d312d352c502d522d36353031312d312d332c502d522d35333632322d31382d342c502d522d35303534312d322d372c502d522d34393839332d32322d392c502d522d33363933322d322d31332c502d522d36393233322d31382d31332c502d522d32363434322d312d382c502d522d32333638312d322d372c502d442d33323530322d322d332c502d442d33323530312d322d332c502d442d33323431352d322d332c502d522d36343531332d31382d31302c502d522d35313931362d38342d33312c502d522d313031353538352d342d362c502d522d313030393731372d332d352c502d522d34353836352d31312d31372c502d522d313030373534302d342d362c502d522d32353236392d31322d31372c502d522d313030303036312d322d342c502d522d3131373534382d322d342c502d522d3131353934362d332d352c502d522d3131313638322d312d332c502d522d3130353733312d33362d33382c502d522d3130343433352d31302d31322c502d522d3130303239342d312d332c502d522d39393633332d312d332c502d522d39383932392d312d332c502d522d39383833372d312d332c502d522d39383235302d312d332c502d522d39333037372d312d332c502d522d39303839352d332d352c502d522d38363131382d312d332c502d522d38303531372d362d382c502d522d37383332382d322d342c502d522d37383131322d342d362c502d522d37383038362d372d392c502d522d37373831352d322d342c502d522d37373134302d322d342c502d522d37363931382d322d342c502d522d37363732312d312d332c502d522d37353434302d322d342c502d522d37333637362d312d332c502d522d37323434392d372d31302c502d522d37323033302d342d362c502d522d34363034312d342d382c502d522d34363036322d342d382c502d522d34363036362d342d382c502d522d34363035362d342d382c502d522d34363035382d342d382c502d522d34363035352d332d372c502d522d34363036352d342d382c502d522d34363036372d342d382c502d522d34363036342d342d382c502d522d34363035342d342d382c502d522d34363036302d342d382c502d522d32333734362d32372d33332c502d522d34363233332d342d31302c502d522d37313334362d312d332c502d522d34393433352d392d32312c502d522d35393534352d342d382c502d522d35363230392d352d31312c502d522d36383237372d322d342c502d522d36383036392d322d342c502d522d36363937352d312d332c502d522d36363735372d372d392c502d522d36353536372d312d332c502d522d34393832332d32332d33362c502d522d36323539362d312d332c502d522d36323231322d322d342c502d522d36303630322d312d332c502d522d35383437312d322d342c502d522d35383039332d312d332c502d522d35343034302d342d362c502d522d35323633332d312d332c502d522d35323233362d322d342c502d522d35323137312d322d342c502d522d35323031312d322d342c502d522d35313932312d382d31302c502d522d35313235382d362d382c502d522d35303735322d322d342c502d522d35303638312d322d342c502d522d35303539392d342d362c502d522d35303539362d342d382c502d522d35303538352d31312d31332c502d522d35303535332d312d332c502d522d34393539372d332d352c502d522d34393435382d322d342c502d522d34383533302d352d372c502d522d34373939392d332d352c502d522d34373934382d312d342c502d522d34373536342d342d362c502d522d34363834352d382d31302c502d522d34363834342d352d372c502d522d34363834312d342d362c502d522d34363538302d332d352c502d522d34363438342d392d31312c502d522d34363132322d312d332c502d522d34353835382d322d342c502d522d34343935302d312d332c502d522d34333936362d322d342c502d522d34333530322d31392d32312c502d522d34333233382d332d352c502d522d34333138382d362d382c502d522d33383234382d31352d31392c502d522d34313433302d312d332c502d522d34303735312d382d31302c502d522d34303237332d342d362c502d522d33393233382d322d342c502d522d33383837382d322d342c502d522d33383638322d332d352c502d522d33373538382d322d342c502d522d33343335352d352d372c502d522d32363236362d342d392c502d522d32363833342d332d382c502d522d32343636322d31352d32312c502d522d32373437392d362d31312c502d522d32363035362d372d31352c502d522d32373030362d372d31322c502d522d33323139312d392d31312c502d522d33303333382d332d372c502d522d33303137382d37342d37362c502d522d33303035332d372d392c502d522d32373435382d312d352c502d522d32353832322d31352d31382c502d522d32353635332d332d362c502d522d32353038332d362d392c502d522d32343639302d33312d33352c502d522d32343638392d322d352c502d522d32343636362d322d352c502d522d32343636332d362d31312c502d522d32343635392d372d31302c502d522d32333736322d352d382c502d	WINWORD.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	word.exe
Key created	\Registry\User\.Default\Software\Microsoft\MSDAIPP\Providers\{9FECD571-B9D4-11D1-9C78-0000F875AC61}	WINWORD.EXE
Key created	\Registry\User\.Default\SOFTWARE\ODBC\ODBC.INI\dBASE Files\Engines\Xbase	WINWORD.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\ODBC\ODBC.INI\Excel Files\Engines\Jet\Threads = "3"	WINWORD.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	WINWORD.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\Common\LCCache\WordDocParts\1033	WINWORD.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	WINWORD.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	2.exe
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\User Settings\AccessDE_Core	WINWORD.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\ODBC\ODBC.INI\Excel Files\Engines\Jet\FirstRowHasNames = 01	WINWORD.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Font Mapping\Zapf Chancery = "Monotype Corsiva"	WINWORD.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\winword.exe\ETWMonitor	WINWORD.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Licensing\BootTimeSkuOverride\{DC5CCACD-A7AC-4FD3-9F70-9454B5DE5161} = "{85DD8B5F-EAA4-4AF3-A628-CCE9E77C9A03}"	WINWORD.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\UISnapshotLanguages = "en-us"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\UIFallbackLanguages = "x-none;en-us"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\PowerPoint\Security\Trusted Locations\Location3\AllowSubFolders = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData\ChunkCount = "uint64_t\|0"	WINWORD.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Office\16.0\Common\LCCache	WINWORD.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Experiment\word\Language = "en-US"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\LicenseCategoryInfo = "std::wstring\|3"	WINWORD.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\ODBC\ODBC.INI\Excel Files\Engines\Jet\UserCommitSync = "Yes"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\ProtocolExecute\excel\WarnOnOpen = "0"	WINWORD.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Internet Explorer\ProtocolExecute\ms-excel	WINWORD.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\winword.exe\ETWMonitor	WINWORD.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Excel\Addins\PowerPivotExcelClientAddIn.NativeEntry.1\LoadBehavior = "2"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared Tools\Font Mapping\Courier 5cpi = "Roman 5cpi"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Netscape\Netscape Navigator\Suffixes\application/rtf = "RTF"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\Licensing\RetailDemo = "0"	WINWORD.EXE
Key created	\Registry\User\.Default\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE

Modifies registry class 21 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FACD0CF651427304F94FC49674B3F70C\ProductName = "\u007f\u007f\u007f\u007f\u007f\u007f\u007f"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FACD0CF651427304F94FC49674B3F70C\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FACD0CF651427304F94FC49674B3F70C\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FACD0CF651427304F94FC49674B3F70C\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FACD0CF651427304F94FC49674B3F70C\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FACD0CF651427304F94FC49674B3F70C\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FACD0CF651427304F94FC49674B3F70C\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FACD0CF651427304F94FC49674B3F70C\_	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B22BFFB44A7AFFB4EA01F4C48AB561D0\FACD0CF651427304F94FC49674B3F70C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FACD0CF651427304F94FC49674B3F70C\SourceList\PackageName = "42c0b7865a97c5bdf243a9fa8a57a622140eaecb52d831aa2f3141a18619ff7f.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FACD0CF651427304F94FC49674B3F70C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FACD0CF651427304F94FC49674B3F70C\PackageCode = "5AE4DB11F422BB54C91A75E2D53B6327"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FACD0CF651427304F94FC49674B3F70C\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B22BFFB44A7AFFB4EA01F4C48AB561D0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FACD0CF651427304F94FC49674B3F70C\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FACD0CF651427304F94FC49674B3F70C\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FACD0CF651427304F94FC49674B3F70C\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FACD0CF651427304F94FC49674B3F70C\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FACD0CF651427304F94FC49674B3F70C	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FACD0CF651427304F94FC49674B3F70C\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FACD0CF651427304F94FC49674B3F70C\InstanceType = "0"	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

1872 WINWORD.EXE
1872 WINWORD.EXE

pid	process
1872	WINWORD.EXE
1872	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

msiexec.exeword.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1568	msiexec.exe
1568	msiexec.exe
1368	word.exe
3716	powershell.exe
3716	powershell.exe
2264	powershell.exe
2264	powershell.exe
2264	powershell.exe
404	powershell.exe
404	powershell.exe
404	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exe

description	pid	process
Token: SeShutdownPrivilege	948	msiexec.exe
Token: SeIncreaseQuotaPrivilege	948	msiexec.exe
Token: SeSecurityPrivilege	1568	msiexec.exe
Token: SeCreateTokenPrivilege	948	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	948	msiexec.exe
Token: SeLockMemoryPrivilege	948	msiexec.exe
Token: SeIncreaseQuotaPrivilege	948	msiexec.exe
Token: SeMachineAccountPrivilege	948	msiexec.exe
Token: SeTcbPrivilege	948	msiexec.exe
Token: SeSecurityPrivilege	948	msiexec.exe
Token: SeTakeOwnershipPrivilege	948	msiexec.exe
Token: SeLoadDriverPrivilege	948	msiexec.exe
Token: SeSystemProfilePrivilege	948	msiexec.exe
Token: SeSystemtimePrivilege	948	msiexec.exe
Token: SeProfSingleProcessPrivilege	948	msiexec.exe
Token: SeIncBasePriorityPrivilege	948	msiexec.exe
Token: SeCreatePagefilePrivilege	948	msiexec.exe
Token: SeCreatePermanentPrivilege	948	msiexec.exe
Token: SeBackupPrivilege	948	msiexec.exe
Token: SeRestorePrivilege	948	msiexec.exe
Token: SeShutdownPrivilege	948	msiexec.exe
Token: SeDebugPrivilege	948	msiexec.exe
Token: SeAuditPrivilege	948	msiexec.exe
Token: SeSystemEnvironmentPrivilege	948	msiexec.exe
Token: SeChangeNotifyPrivilege	948	msiexec.exe
Token: SeRemoteShutdownPrivilege	948	msiexec.exe
Token: SeUndockPrivilege	948	msiexec.exe
Token: SeSyncAgentPrivilege	948	msiexec.exe
Token: SeEnableDelegationPrivilege	948	msiexec.exe
Token: SeManageVolumePrivilege	948	msiexec.exe
Token: SeImpersonatePrivilege	948	msiexec.exe
Token: SeCreateGlobalPrivilege	948	msiexec.exe
Token: SeBackupPrivilege	924	vssvc.exe
Token: SeRestorePrivilege	924	vssvc.exe
Token: SeAuditPrivilege	924	vssvc.exe
Token: SeBackupPrivilege	1568	msiexec.exe
Token: SeRestorePrivilege	1568	msiexec.exe
Token: SeRestorePrivilege	1568	msiexec.exe
Token: SeTakeOwnershipPrivilege	1568	msiexec.exe
Token: SeRestorePrivilege	1568	msiexec.exe
Token: SeTakeOwnershipPrivilege	1568	msiexec.exe
Token: SeRestorePrivilege	1568	msiexec.exe
Token: SeTakeOwnershipPrivilege	1568	msiexec.exe
Token: SeRestorePrivilege	1568	msiexec.exe
Token: SeTakeOwnershipPrivilege	1568	msiexec.exe
Token: SeRestorePrivilege	1568	msiexec.exe
Token: SeTakeOwnershipPrivilege	1568	msiexec.exe
Token: SeRestorePrivilege	1568	msiexec.exe
Token: SeTakeOwnershipPrivilege	1568	msiexec.exe
Token: SeRestorePrivilege	1568	msiexec.exe
Token: SeTakeOwnershipPrivilege	1568	msiexec.exe
Token: SeRestorePrivilege	1568	msiexec.exe
Token: SeTakeOwnershipPrivilege	1568	msiexec.exe
Token: SeRestorePrivilege	1568	msiexec.exe
Token: SeTakeOwnershipPrivilege	1568	msiexec.exe
Token: SeRestorePrivilege	1568	msiexec.exe
Token: SeTakeOwnershipPrivilege	1568	msiexec.exe
Token: SeRestorePrivilege	1568	msiexec.exe
Token: SeTakeOwnershipPrivilege	1568	msiexec.exe
Token: SeRestorePrivilege	1568	msiexec.exe
Token: SeTakeOwnershipPrivilege	1568	msiexec.exe
Token: SeRestorePrivilege	1568	msiexec.exe
Token: SeTakeOwnershipPrivilege	1568	msiexec.exe
Token: SeRestorePrivilege	1568	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

msiexec.exeaipackagechainer.exe

pid process

948 msiexec.exe
948 msiexec.exe
4812 aipackagechainer.exe
4812 aipackagechainer.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

1872 WINWORD.EXE
1872 WINWORD.EXE
1872 WINWORD.EXE
1872 WINWORD.EXE
1872 WINWORD.EXE
1872 WINWORD.EXE
1872 WINWORD.EXE

pid	process
948	msiexec.exe
948	msiexec.exe
4812	aipackagechainer.exe
4812	aipackagechainer.exe

pid	process
1872	WINWORD.EXE
1872	WINWORD.EXE
1872	WINWORD.EXE
1872	WINWORD.EXE
1872	WINWORD.EXE
1872	WINWORD.EXE
1872	WINWORD.EXE

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

msiexec.exeaipackagechainer.exe2.exepowershell.exe

description	pid	process	target process
PID 1568 wrote to memory of 100	1568	msiexec.exe	srtasks.exe
PID 1568 wrote to memory of 100	1568	msiexec.exe	srtasks.exe
PID 1568 wrote to memory of 3204	1568	msiexec.exe	MsiExec.exe
PID 1568 wrote to memory of 3204	1568	msiexec.exe	MsiExec.exe
PID 1568 wrote to memory of 3204	1568	msiexec.exe	MsiExec.exe
PID 1568 wrote to memory of 4812	1568	msiexec.exe	aipackagechainer.exe
PID 1568 wrote to memory of 4812	1568	msiexec.exe	aipackagechainer.exe
PID 1568 wrote to memory of 4812	1568	msiexec.exe	aipackagechainer.exe
PID 4812 wrote to memory of 1992	4812	aipackagechainer.exe	2.exe
PID 4812 wrote to memory of 1992	4812	aipackagechainer.exe	2.exe
PID 4812 wrote to memory of 1992	4812	aipackagechainer.exe	2.exe
PID 1992 wrote to memory of 1368	1992	2.exe	word.exe
PID 1992 wrote to memory of 1368	1992	2.exe	word.exe
PID 1992 wrote to memory of 1872	1992	2.exe	WINWORD.EXE
PID 1992 wrote to memory of 1872	1992	2.exe	WINWORD.EXE
PID 4812 wrote to memory of 3716	4812	aipackagechainer.exe	powershell.exe
PID 4812 wrote to memory of 3716	4812	aipackagechainer.exe	powershell.exe
PID 4812 wrote to memory of 3716	4812	aipackagechainer.exe	powershell.exe
PID 3716 wrote to memory of 2264	3716	powershell.exe	powershell.exe
PID 3716 wrote to memory of 2264	3716	powershell.exe	powershell.exe
PID 3716 wrote to memory of 2264	3716	powershell.exe	powershell.exe
PID 3716 wrote to memory of 404	3716	powershell.exe	powershell.exe
PID 3716 wrote to memory of 404	3716	powershell.exe	powershell.exe
PID 3716 wrote to memory of 404	3716	powershell.exe	powershell.exe
PID 3716 wrote to memory of 3560	3716	powershell.exe	powershell.exe
PID 3716 wrote to memory of 3560	3716	powershell.exe	powershell.exe
PID 3716 wrote to memory of 3560	3716	powershell.exe	powershell.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\42c0b7865a97c5bdf243a9fa8a57a622140eaecb52d831aa2f3141a18619ff7f.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:948

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:100

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding CEC92956AE77AF645A393FD3449A747F
2⤵
- Loads dropped DLL
PID:3204

C:\Users\Admin\AppData\Roaming\Microsoft\\prerequisites\aipackagechainer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\\prerequisites\aipackagechainer.exe"
2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4812

C:\Users\Admin\AppData\Roaming\Microsoft\\prerequisites\\2.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\\prerequisites\\2.exe"
3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1992

C:\windows\temp\word.exe
"C:\windows\temp\word.exe"
4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1368

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\windows\temp\补充材料.docx" /o ""
4⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1872

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -NoLogo -ExecutionPolicy RemoteSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_E19B.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Microsoft\\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Microsoft\\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Microsoft\' -retry_count 10"
3⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3716

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2264

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:404

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3560

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AI_E19B.ps1
Filesize
13KB

MD5
bc738a907de8fd82f60b3076399d2919

SHA1
b1ba780669af90d283ee41b46fd3a9c0be63289e

SHA256
b2d5923658a04edcff416e46d17c64badd95d02df97601e141ade64474c9e3f0

SHA512
70a66f14b056aa2c92df10f5875e835642ced758512c54a85739ddf208362f080644d72d50129ba0adcb941c02a0398c90f1a6ad1762a8070c3f872a84679d9b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\\prerequisites\aipackagechainer.exe
Filesize
748KB

MD5
cf23d98b7e5d4f005b90c14e99ef146a

SHA1
a89c40cc44930374ac4510f4978990f987975e7d

SHA256
6306724878799a05095288abdafb4d8e2a741f66f33ccebf5d834fbb08da7d8f

SHA512
176ba66df9f050cc932b6367c47e1c9ccfec3e2813234545cdc55eed13ddb72034d2d6984a9cd2fef9ed13ffdd5b698b275ad7c940ba74cf62c1fa2c4a3de579

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\\prerequisites\aipackagechainer.exe
Filesize
748KB

MD5
cf23d98b7e5d4f005b90c14e99ef146a

SHA1
a89c40cc44930374ac4510f4978990f987975e7d

SHA256
6306724878799a05095288abdafb4d8e2a741f66f33ccebf5d834fbb08da7d8f

SHA512
176ba66df9f050cc932b6367c47e1c9ccfec3e2813234545cdc55eed13ddb72034d2d6984a9cd2fef9ed13ffdd5b698b275ad7c940ba74cf62c1fa2c4a3de579

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\\prerequisites\aipackagechainer.ini
Filesize
1KB

MD5
aa344a2c80996664a3487d188bb8db38

SHA1
df818590e6b6c6f00a8636630e3382932e283059

SHA256
671eb170889772d3db273ac5e69a0c0a3bc842721c583d164afb7f1e34033c82

SHA512
46e39a5a55789b7f05f7107d1fef1b5271bfc61741c7d3018e8661b6d2f9bb604c1081a130c557b01c005ae6bbd3836d7cf25e0fb79a7d7de54222dcb56edca5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\\prerequisites\file_deleter.ps1
Filesize
13KB

MD5
bc738a907de8fd82f60b3076399d2919

SHA1
b1ba780669af90d283ee41b46fd3a9c0be63289e

SHA256
b2d5923658a04edcff416e46d17c64badd95d02df97601e141ade64474c9e3f0

SHA512
70a66f14b056aa2c92df10f5875e835642ced758512c54a85739ddf208362f080644d72d50129ba0adcb941c02a0398c90f1a6ad1762a8070c3f872a84679d9b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\\prerequisites\\2.exe
Filesize
681KB

MD5
0340cd41dc46e57d7a496c55e735f8b3

SHA1
78ef3380bb7307d5b2020a35c5a845160b9405e3

SHA256
bf4d9742ea09c84b3057aac8c456efd3b069a5d181f70ccd6e7524278c281596

SHA512
7ee2732940b0626d0d45f364e35ed7207b09b9ba979468dfce281293d3817fac50379e43f1fa43affb7a7e22413b08352a024d19f089d3213af662ab4b103066

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\\prerequisites\\2.exe
Filesize
681KB

MD5
0340cd41dc46e57d7a496c55e735f8b3

SHA1
78ef3380bb7307d5b2020a35c5a845160b9405e3

SHA256
bf4d9742ea09c84b3057aac8c456efd3b069a5d181f70ccd6e7524278c281596

SHA512
7ee2732940b0626d0d45f364e35ed7207b09b9ba979468dfce281293d3817fac50379e43f1fa43affb7a7e22413b08352a024d19f089d3213af662ab4b103066

Download Submit
C:\Windows\Installer\MSID372.tmp
Filesize
549KB

MD5
822ec3c1b42ffdf6db9a15936f4512cf

SHA1
6ea07cae9eea92dd58bb6a81d3795033825e7045

SHA256
94cc96b889d32f8df13878f3ce538a741fa2d48444285c5c36849a817fc25597

SHA512
0d124c4964db15240213d9c6c93a756c7d4d97d05a2acf2a00851d26b0f0b947b5927847aa05b60a6fac674111243f897706f764964e3d2d7a639e84a36819f4

Download Submit
C:\Windows\Installer\MSID372.tmp
Filesize
549KB

MD5
822ec3c1b42ffdf6db9a15936f4512cf

SHA1
6ea07cae9eea92dd58bb6a81d3795033825e7045

SHA256
94cc96b889d32f8df13878f3ce538a741fa2d48444285c5c36849a817fc25597

SHA512
0d124c4964db15240213d9c6c93a756c7d4d97d05a2acf2a00851d26b0f0b947b5927847aa05b60a6fac674111243f897706f764964e3d2d7a639e84a36819f4

Download Submit
C:\Windows\Installer\MSID632.tmp
Filesize
549KB

MD5
822ec3c1b42ffdf6db9a15936f4512cf

SHA1
6ea07cae9eea92dd58bb6a81d3795033825e7045

SHA256
94cc96b889d32f8df13878f3ce538a741fa2d48444285c5c36849a817fc25597

SHA512
0d124c4964db15240213d9c6c93a756c7d4d97d05a2acf2a00851d26b0f0b947b5927847aa05b60a6fac674111243f897706f764964e3d2d7a639e84a36819f4

Download Submit
C:\Windows\Installer\MSID632.tmp
Filesize
549KB

MD5
822ec3c1b42ffdf6db9a15936f4512cf

SHA1
6ea07cae9eea92dd58bb6a81d3795033825e7045

SHA256
94cc96b889d32f8df13878f3ce538a741fa2d48444285c5c36849a817fc25597

SHA512
0d124c4964db15240213d9c6c93a756c7d4d97d05a2acf2a00851d26b0f0b947b5927847aa05b60a6fac674111243f897706f764964e3d2d7a639e84a36819f4

Download Submit
C:\Windows\Installer\MSID6DF.tmp
Filesize
549KB

MD5
822ec3c1b42ffdf6db9a15936f4512cf

SHA1
6ea07cae9eea92dd58bb6a81d3795033825e7045

SHA256
94cc96b889d32f8df13878f3ce538a741fa2d48444285c5c36849a817fc25597

SHA512
0d124c4964db15240213d9c6c93a756c7d4d97d05a2acf2a00851d26b0f0b947b5927847aa05b60a6fac674111243f897706f764964e3d2d7a639e84a36819f4

Download Submit
C:\Windows\Installer\MSID6DF.tmp
Filesize
549KB

MD5
822ec3c1b42ffdf6db9a15936f4512cf

SHA1
6ea07cae9eea92dd58bb6a81d3795033825e7045

SHA256
94cc96b889d32f8df13878f3ce538a741fa2d48444285c5c36849a817fc25597

SHA512
0d124c4964db15240213d9c6c93a756c7d4d97d05a2acf2a00851d26b0f0b947b5927847aa05b60a6fac674111243f897706f764964e3d2d7a639e84a36819f4

Download Submit
C:\Windows\Installer\MSID74D.tmp
Filesize
549KB

MD5
822ec3c1b42ffdf6db9a15936f4512cf

SHA1
6ea07cae9eea92dd58bb6a81d3795033825e7045

SHA256
94cc96b889d32f8df13878f3ce538a741fa2d48444285c5c36849a817fc25597

SHA512
0d124c4964db15240213d9c6c93a756c7d4d97d05a2acf2a00851d26b0f0b947b5927847aa05b60a6fac674111243f897706f764964e3d2d7a639e84a36819f4

Download Submit
C:\Windows\Installer\MSID74D.tmp
Filesize
549KB

MD5
822ec3c1b42ffdf6db9a15936f4512cf

SHA1
6ea07cae9eea92dd58bb6a81d3795033825e7045

SHA256
94cc96b889d32f8df13878f3ce538a741fa2d48444285c5c36849a817fc25597

SHA512
0d124c4964db15240213d9c6c93a756c7d4d97d05a2acf2a00851d26b0f0b947b5927847aa05b60a6fac674111243f897706f764964e3d2d7a639e84a36819f4

Download Submit
C:\Windows\Installer\MSID7AC.tmp
Filesize
631KB

MD5
825dfb5d9b0e8a8e6035741c984b60a8

SHA1
c6f9d30ec90eb4e814c45acacbe4822f1c8bf02a

SHA256
68d1fe2093524c1845f844e4ac9accb71b52aee735250225ecadd33a04f9e1aa

SHA512
4cdb95f81c29d4b26ce39fd781b4ef191a28f3961942dbfa345495db8b43b5d705b7310527cd4bd19ade5bb5c1d7d5f9fed6316d1e628e98e18ab938d729ff35

Download Submit
C:\Windows\Installer\MSID7AC.tmp
Filesize
631KB

MD5
825dfb5d9b0e8a8e6035741c984b60a8

SHA1
c6f9d30ec90eb4e814c45acacbe4822f1c8bf02a

SHA256
68d1fe2093524c1845f844e4ac9accb71b52aee735250225ecadd33a04f9e1aa

SHA512
4cdb95f81c29d4b26ce39fd781b4ef191a28f3961942dbfa345495db8b43b5d705b7310527cd4bd19ade5bb5c1d7d5f9fed6316d1e628e98e18ab938d729ff35

Download Submit
C:\Windows\Installer\MSID973.tmp
Filesize
631KB

MD5
825dfb5d9b0e8a8e6035741c984b60a8

SHA1
c6f9d30ec90eb4e814c45acacbe4822f1c8bf02a

SHA256
68d1fe2093524c1845f844e4ac9accb71b52aee735250225ecadd33a04f9e1aa

SHA512
4cdb95f81c29d4b26ce39fd781b4ef191a28f3961942dbfa345495db8b43b5d705b7310527cd4bd19ade5bb5c1d7d5f9fed6316d1e628e98e18ab938d729ff35

Download Submit
C:\Windows\Installer\MSID973.tmp
Filesize
631KB

MD5
825dfb5d9b0e8a8e6035741c984b60a8

SHA1
c6f9d30ec90eb4e814c45acacbe4822f1c8bf02a

SHA256
68d1fe2093524c1845f844e4ac9accb71b52aee735250225ecadd33a04f9e1aa

SHA512
4cdb95f81c29d4b26ce39fd781b4ef191a28f3961942dbfa345495db8b43b5d705b7310527cd4bd19ade5bb5c1d7d5f9fed6316d1e628e98e18ab938d729ff35

Download Submit
C:\Windows\Temp\word.exe
Filesize
2.3MB

MD5
6493f2382748d4577a21197714ba9a1c

SHA1
1a9783715f9c03f281cba6ace448f4c1fdc563ff

SHA256
a138863ad495030913fd42f7fce827f0542ef144490b727ee22b4b2f7f503fc3

SHA512
d7d4661f602deaf6345d846259da72cf202ba278da9028bc37e8e3a6168bdf7832eb0ff19adc683e63f6c9eac0733cbf1ffb7d9e7537d56ad1fcad716bd22a73

Download Submit
C:\windows\temp\word.exe
Filesize
2.3MB

MD5
6493f2382748d4577a21197714ba9a1c

SHA1
1a9783715f9c03f281cba6ace448f4c1fdc563ff

SHA256
a138863ad495030913fd42f7fce827f0542ef144490b727ee22b4b2f7f503fc3

SHA512
d7d4661f602deaf6345d846259da72cf202ba278da9028bc37e8e3a6168bdf7832eb0ff19adc683e63f6c9eac0733cbf1ffb7d9e7537d56ad1fcad716bd22a73

Download Submit
C:\windows\temp\补充材料.docx
Filesize
17KB

MD5
1615c36dd074f6bafbba308c90fb6c53

SHA1
14077a3d2a45618ae070a0b7065ff9f4da675e3a

SHA256
427043c0b132467069aed626ccd18ddf42bfefbd0e2be4cce8cf2cdad4cc830c

SHA512
6aacff7796b7edfae30620f72e9bdbc607b8a34d9d00d43845e83e3805a4a2329fc3116045873e370b8a012226e2e06dfc2d1999ee6877f800ee77fe0fdac175

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
23.0MB

MD5
59c99605d2a78530a305f20694cc2045

SHA1
a87273715834e427ee4fe0929677cbaa10789879

SHA256
0ddce63aac7a9121d626a8fa52085c11760146d7c89aae408bfde651531a4f0a

SHA512
2c588f83d31a47ce00f22e3b78232f080c018352958f13948e81948354911f63bc38f208a717b0d5f3877ba55f96d1bdbafa103cb9870b4797e948f977600c1c

Download Submit
\??\Volume{edc211e1-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2daa749b-a92d-4084-a3b5-be48988ff643}_OnDiskSnapshotProp
Filesize
5KB

MD5
696d86a0ba5cf1249ca59f9bf6160e76

SHA1
01b2a39cba9c60a490c4fbd1fc9c328c7fd1321c

SHA256
708bd9f596249c46d7cefef93ecfc4a73c68f407cf4b033c9da07d1e8df99d34

SHA512
99f4241efa7156cf909a95fdd2de83ff64fd65c64e2a7979961717ba71ab0b9a02ea1d20aef34747fdd8ea919fe3439c48ef354b80e83f18ff11bb372083ccd8

Download Submit
memory/100-130-0x0000000000000000-mapping.dmp

Download
memory/404-184-0x0000000006E70000-0x0000000006E8A000-memory.dmp

Filesize
104KB

Download
memory/404-183-0x0000000007190000-0x0000000007226000-memory.dmp

Filesize
600KB

Download
memory/404-176-0x0000000000000000-mapping.dmp

Download
memory/1368-181-0x000000001E020000-0x000000001E06C000-memory.dmp

Filesize
304KB

Download
memory/1368-180-0x000000001DFE0000-0x000000001E020000-memory.dmp

Filesize
256KB

Download
memory/1368-165-0x00007FFD507D0000-0x00007FFD51291000-memory.dmp

Filesize
10.8MB

Download
memory/1368-150-0x0000000000000000-mapping.dmp

Download
memory/1368-157-0x0000000002850000-0x0000000002872000-memory.dmp

Filesize
136KB

Download
memory/1368-182-0x00007FFD507D0000-0x00007FFD51291000-memory.dmp

Filesize
10.8MB

Download
memory/1368-154-0x0000000000400000-0x000000000064E000-memory.dmp

Filesize
2.3MB

Download
memory/1872-161-0x00007FFD30710000-0x00007FFD30720000-memory.dmp

Filesize
64KB

Download
memory/1872-163-0x00007FFD30710000-0x00007FFD30720000-memory.dmp

Filesize
64KB

Download
memory/1872-153-0x0000000000000000-mapping.dmp

Download
memory/1872-160-0x00007FFD30710000-0x00007FFD30720000-memory.dmp

Filesize
64KB

Download
memory/1872-162-0x00007FFD30710000-0x00007FFD30720000-memory.dmp

Filesize
64KB

Download
memory/1872-170-0x00007FFD2E5B0000-0x00007FFD2E5C0000-memory.dmp

Filesize
64KB

Download
memory/1872-171-0x00007FFD2E5B0000-0x00007FFD2E5C0000-memory.dmp

Filesize
64KB

Download
memory/1872-164-0x00007FFD30710000-0x00007FFD30720000-memory.dmp

Filesize
64KB

Download
memory/1992-147-0x0000000000000000-mapping.dmp

Download
memory/2264-175-0x0000000000000000-mapping.dmp

Download
memory/2264-186-0x0000000007740000-0x0000000007CE4000-memory.dmp

Filesize
5.6MB

Download
memory/2264-185-0x0000000007010000-0x0000000007032000-memory.dmp

Filesize
136KB

Download
memory/3204-131-0x0000000000000000-mapping.dmp

Download
memory/3560-177-0x0000000000000000-mapping.dmp

Download
memory/3716-168-0x0000000005E00000-0x0000000005E66000-memory.dmp

Filesize
408KB

Download
memory/3716-159-0x0000000005530000-0x0000000005B58000-memory.dmp

Filesize
6.2MB

Download
memory/3716-158-0x0000000004EC0000-0x0000000004EF6000-memory.dmp

Filesize
216KB

Download
memory/3716-156-0x0000000000000000-mapping.dmp

Download
memory/3716-169-0x0000000006460000-0x000000000647E000-memory.dmp

Filesize
120KB

Download
memory/3716-167-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Filesize
408KB

Download
memory/3716-166-0x0000000005490000-0x00000000054B2000-memory.dmp

Filesize
136KB

Download
memory/3716-174-0x00000000075F0000-0x000000000761C000-memory.dmp

Filesize
176KB

Download
memory/4812-144-0x0000000000000000-mapping.dmp

Download