Malware Analysis Report

2025-08-05 21:12

Sample ID 240410-lhy46aaf99
Target 0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b
SHA256 0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b
Tags
macro
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b

Threat Level: Likely malicious

The file 0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b was found to be: Likely malicious.

Malicious Activity Summary

macro

Suspicious Office macro

Drops startup file

Deletes itself

Process spawned suspicious child process

Drops file in Windows directory

Office loads VBA resources, possible macro or embedded object present

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of UnmapMainImage

NTFS ADS

Enumerates system info in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-10 09:32

Signatures

Suspicious Office macro

macro
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-10 09:32

Reported

2024-04-10 09:35

Platform

win7-20240221-en

Max time kernel

122s

Max time network

126s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.doc"

Signatures

Process spawned suspicious child process

Description Indicator Process Target
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process N/A C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AD1130DB-11E6-485E-83C7-7560DCE95EB3}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Word8.0" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AD1130DB-11E6-485E-83C7-7560DCE95EB3}\2.0 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\ = "Font" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\TypeLib\{AD1130DB-11E6-485E-83C7-7560DCE95EB3}\2.0\FLAGS C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\TypeLib\{AD1130DB-11E6-485E-83C7-7560DCE95EB3}\2.0\ = "Microsoft Forms 2.0 Object Library" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2248 wrote to memory of 2052 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2248 wrote to memory of 2052 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2248 wrote to memory of 2052 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2248 wrote to memory of 2052 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2248 wrote to memory of 1516 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE
PID 2248 wrote to memory of 1516 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE
PID 2248 wrote to memory of 1516 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE
PID 2248 wrote to memory of 1516 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE
PID 2248 wrote to memory of 1516 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE
PID 2248 wrote to memory of 1516 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE
PID 2248 wrote to memory of 1516 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE
PID 1516 wrote to memory of 2596 N/A C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Windows\SysWOW64\dwwin.exe
PID 1516 wrote to memory of 2596 N/A C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Windows\SysWOW64\dwwin.exe
PID 1516 wrote to memory of 2596 N/A C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Windows\SysWOW64\dwwin.exe
PID 1516 wrote to memory of 2596 N/A C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Windows\SysWOW64\dwwin.exe

Processes

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.doc"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE

"C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1328

C:\Windows\SysWOW64\dwwin.exe

C:\Windows\system32\dwwin.exe -x -s 1328

Network

N/A

Files

memory/2248-0-0x000000002FC51000-0x000000002FC52000-memory.dmp

memory/2248-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2248-2-0x0000000070FDD000-0x0000000070FE8000-memory.dmp

memory/2248-7-0x00000000056E0000-0x00000000057E0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\31F37FEB.wmf

MD5 fe97064665ebe15dd56dde1edd2df969
SHA1 fc1133b9d239822dc7e52d48b242dc5dedd3393f
SHA256 b7f0b658e073b348819687bef0a3971ceab0f29c4c405eb650936f32420cd0d8
SHA512 5b81d88df4a0627d51ce5b0cd3852b4a16299f099026d998763ea374b9f4a5b877faf25c5be1d9ccfb3223f079b382a027a99d82f862607e4455f7bb3fd365b7

memory/2248-22-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-23-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-27-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-28-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-30-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-32-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-31-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-35-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-42-0x00000000063E0000-0x00000000064E0000-memory.dmp

memory/2248-43-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-50-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-52-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-51-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-54-0x00000000063E0000-0x00000000064E0000-memory.dmp

memory/2248-53-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-49-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-56-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-57-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-48-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-59-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-67-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-72-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-73-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-76-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-75-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-77-0x000000006AE80000-0x000000006B0E7000-memory.dmp

memory/2248-84-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-83-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-82-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-81-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-80-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-79-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-78-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-74-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-71-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-69-0x00000000006B0000-0x00000000007B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\259428586.cvr

MD5 c084bc06b1b4238191f6cc43381f50b5
SHA1 567d4b270e34a5c645d34a43f6f23b8a6d73dfdd
SHA256 764d34e5643b3e6842bd7dfa2d3938be30132d23f9c0f6824b3f2f3c1433e82b
SHA512 6df80127b1984652f4c2c9f5a10c6e44f70944d6753ded1497a9d91ec5d66e0ee0dbe980f9cd976d601a1a1ce3c23e98092db14710015d9ea8325625ba088a6a

memory/2248-68-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-66-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-65-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-64-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-63-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-62-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2596-87-0x0000000000330000-0x0000000000331000-memory.dmp

memory/2248-61-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-58-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-47-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-46-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-45-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-36-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-34-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-33-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-29-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-26-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-24-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-25-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-88-0x0000000070FDD000-0x0000000070FE8000-memory.dmp

memory/2248-89-0x00000000056E0000-0x00000000057E0000-memory.dmp

memory/2248-90-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/2248-91-0x00000000063E0000-0x00000000064E0000-memory.dmp

memory/2248-94-0x00000000006B0000-0x00000000007B0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-10 09:32

Reported

2024-04-10 09:35

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

159s

Command Line

C:\Windows\Explorer.EXE

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\windowsupdateconf.lnk C:\Windows\system32\expand.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Temp\~WRD0000.tmp\:Zone.Identifier:$DATA C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeAuditPrivilege N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.doc" /o ""

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\expand.exe

expand "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateConf.lnk" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdateConf.lnk"

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 14.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 28.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 api.github.com udp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 210.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
US 8.8.8.8:53 8.167.79.40.in-addr.arpa udp

Files

memory/3524-0-0x00007FFB63050000-0x00007FFB63060000-memory.dmp

memory/3524-1-0x00007FFB63050000-0x00007FFB63060000-memory.dmp

memory/3524-2-0x00007FFB63050000-0x00007FFB63060000-memory.dmp

memory/3524-3-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

memory/3524-6-0x00007FFB63050000-0x00007FFB63060000-memory.dmp

memory/3524-5-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

memory/3524-7-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

memory/3524-4-0x00007FFB63050000-0x00007FFB63060000-memory.dmp

memory/3524-8-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

memory/3524-9-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

memory/3524-10-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

memory/3524-11-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

memory/3524-12-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

memory/3524-13-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

memory/3524-14-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

memory/3524-15-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

memory/3524-16-0x00007FFB606F0000-0x00007FFB60700000-memory.dmp

memory/3524-17-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

memory/3524-18-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

memory/3524-19-0x00007FFB606F0000-0x00007FFB60700000-memory.dmp

memory/3524-29-0x000001AE7A2D0000-0x000001AE7A4D0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\FBF60AF5.wmf

MD5 fe97064665ebe15dd56dde1edd2df969
SHA1 fc1133b9d239822dc7e52d48b242dc5dedd3393f
SHA256 b7f0b658e073b348819687bef0a3971ceab0f29c4c405eb650936f32420cd0d8
SHA512 5b81d88df4a0627d51ce5b0cd3852b4a16299f099026d998763ea374b9f4a5b877faf25c5be1d9ccfb3223f079b382a027a99d82f862607e4455f7bb3fd365b7

memory/3524-43-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

memory/3524-57-0x000001AE76AE0000-0x000001AE77AB0000-memory.dmp

memory/3524-90-0x000001AE76AE0000-0x000001AE77AB0000-memory.dmp

memory/3524-113-0x00007FFB78D80000-0x00007FFB78FD9000-memory.dmp

memory/3524-118-0x000001AE76AE0000-0x000001AE77AB0000-memory.dmp

memory/3352-125-0x0000000002580000-0x0000000002581000-memory.dmp

memory/3352-126-0x00000000084C0000-0x0000000008542000-memory.dmp

memory/3524-128-0x0000000180000000-0x0000000180097000-memory.dmp

memory/3352-135-0x00000000084C0000-0x0000000008542000-memory.dmp

memory/3352-137-0x0000000180000000-0x000000018001B000-memory.dmp

\??\c:\users\admin\appdata\local\temp\windowsupdateconf.lnk

MD5 b6dd036749beb8035b4d733de1aaae1d
SHA1 ddd8cf574775c4fcba6ebca9783229f6c19401e6
SHA256 8c3451acc329c747c6660fa53c6fd20c40617750c7dad9c688c0cf25523d3ef4
SHA512 73f1a6c63dd68ec5b6f5ef72f9dcf274a75139373d672386327af82425b2b455aee6db884e44b8b30de9dc79e6458b8dee02c13b78b60986261654a5afb9fc9b

C:\Users\Admin\AppData\Local\Temp\~WRD0000.tmp

MD5 b56c39d20fc1487e247e6cb8aa0b65c4
SHA1 a37b52c7f8c7adb55188aeb5994066ae38f87e1c
SHA256 e8790e6ddde06338f69d272d2a6b18c0bd56d011f49e94ad5ba3964fc9ea2db5
SHA512 50ee3afe32a10feacc8d57719925c566bc6b1a602f73904b34c0625f560cd9586f61db8b3626c0ed0269f3a3705707bd858ffe36084c9e142e25583d4e6d8510

memory/3524-164-0x000001AE7A2D0000-0x000001AE7A4D0000-memory.dmp

memory/3524-165-0x000001AE76AE0000-0x000001AE77AB0000-memory.dmp

memory/3524-166-0x000001AE76AE0000-0x000001AE77AB0000-memory.dmp

memory/3524-167-0x000001AE76AE0000-0x000001AE77AB0000-memory.dmp

memory/3352-173-0x00000000084C0000-0x0000000008542000-memory.dmp

memory/4720-174-0x000002B2D7100000-0x000002B2D7154000-memory.dmp

memory/4720-182-0x000002B2D7100000-0x000002B2D7154000-memory.dmp

memory/4720-185-0x000002B2D7100000-0x000002B2D7154000-memory.dmp

C:\Wíndows\system32\wuaueng.dll

MD5 490c885dc7ba0f32c07ddfe02a04bbb9
SHA1 294690c1aee8dc7723858dafcb2a0ed273296641
SHA256 829eceee720b0a3e505efbd3262c387b92abdf46183d51a50489e2b157dac3b1
SHA512 127f014d18b926433d56bfee85b350fe36cc26a1442ef8f16cf1c9e6cce95c2f83a8609b9d29e53b7b5617739f760ba4263bd6222870fd25309a16d46000d29c

memory/3352-187-0x0000000002140000-0x000000000217C000-memory.dmp

memory/3352-193-0x0000000002180000-0x00000000021A6000-memory.dmp

memory/3524-231-0x00007FFB63050000-0x00007FFB63060000-memory.dmp

memory/3524-232-0x00007FFB63050000-0x00007FFB63060000-memory.dmp

memory/3524-233-0x00007FFB63050000-0x00007FFB63060000-memory.dmp

memory/3524-234-0x00007FFB63050000-0x00007FFB63060000-memory.dmp

memory/3524-235-0x00007FFBA2FD0000-0x00007FFBA31C5000-memory.dmp

memory/3524-236-0x0000000180000000-0x0000000180097000-memory.dmp