Malware Analysis Report

2025-03-15 07:56

Sample ID 240805-13d22stfme
Target 5767890e00907cf5497fd81d5be470eb66172af14802ae1fff17da79f718d148
SHA256 5767890e00907cf5497fd81d5be470eb66172af14802ae1fff17da79f718d148
Tags
macro macro_on_action discovery persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

5767890e00907cf5497fd81d5be470eb66172af14802ae1fff17da79f718d148

Threat Level: Likely malicious

The file 5767890e00907cf5497fd81d5be470eb66172af14802ae1fff17da79f718d148 was found to be: Likely malicious.

Malicious Activity Summary

macro macro_on_action discovery persistence

Suspicious Office macro

Office macro that triggers on suspicious action

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in Windows directory

System Location Discovery: System Language Discovery

Office loads VBA resources, possible macro or embedded object present

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-05 22:10

Signatures

Office macro that triggers on suspicious action

macro macro_on_action
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious Office macro

macro
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-05 22:10

Reported

2024-08-05 22:11

Platform

win7-20240708-en

Max time kernel

58s

Max time network

32s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5767890e00907cf5497fd81d5be470eb66172af14802ae1fff17da79f718d148.doc"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\Users\Public\ctrlpanel.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ctrlpanel = "c:\\Users\\Public" \??\c:\Users\Public\ctrlpanel.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Office loads VBA resources, possible macro or embedded object present

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Processes

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5767890e00907cf5497fd81d5be470eb66172af14802ae1fff17da79f718d148.doc"

\??\c:\Users\Public\ctrlpanel.exe

c:\Users\Public\ctrlpanel.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

Country Destination Domain Proto
US 8.8.8.8:53 crl.microsoft.com udp
GB 173.222.211.58:80 crl.microsoft.com tcp

Files

memory/1080-0-0x000000002F801000-0x000000002F802000-memory.dmp

memory/1080-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/1080-2-0x0000000073CFD000-0x0000000073D08000-memory.dmp

memory/1080-64-0x00000000059D0000-0x0000000005AD0000-memory.dmp

memory/1080-109-0x00000000059D0000-0x0000000005AD0000-memory.dmp

memory/1080-77-0x00000000059D0000-0x0000000005AD0000-memory.dmp

memory/1080-102-0x00000000059D0000-0x0000000005AD0000-memory.dmp

memory/1080-111-0x00000000059D0000-0x0000000005AD0000-memory.dmp

memory/1080-110-0x00000000059D0000-0x0000000005AD0000-memory.dmp

\Users\Public\ctrlpanel.exe

MD5 40d2ccd570bd898cc31af1cbfe5fb08e
SHA1 41d81d3275f8fe7be023b9731519cdf359743818
SHA256 10e720fbcf797a2f40fbaa214b3402df14b7637404e5e91d7651bd13d28a69d8
SHA512 0753eec8f21c4681559b82327c93098d2d74732df05d2304a8428dc7af0ff13d49079eacd0dc29d9b32ba5e5095cac6b9fa62a82f77e3ca3bb5986b64fe9195d

memory/3048-171-0x000000001AED0000-0x000000001AFB0000-memory.dmp

memory/3048-182-0x000000001AD50000-0x000000001ADC0000-memory.dmp

memory/3048-184-0x000000001ADC0000-0x000000001ADD0000-memory.dmp

memory/2856-185-0x0000000003B40000-0x0000000003B42000-memory.dmp

memory/3048-186-0x000000001AFB0000-0x000000001AFC2000-memory.dmp

memory/1080-187-0x0000000073CFD000-0x0000000073D08000-memory.dmp

memory/1080-188-0x00000000059D0000-0x0000000005AD0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-05 22:10

Reported

2024-08-05 22:11

Platform

win10v2004-20240802-en

Max time kernel

60s

Max time network

61s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5767890e00907cf5497fd81d5be470eb66172af14802ae1fff17da79f718d148.doc" /o ""

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\Users\Public\ctrlpanel.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ctrlpanel = "c:\\Users\\Public" \??\c:\Users\Public\ctrlpanel.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5088 wrote to memory of 2580 N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE \??\c:\Users\Public\ctrlpanel.exe
PID 5088 wrote to memory of 2580 N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE \??\c:\Users\Public\ctrlpanel.exe

Processes

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5767890e00907cf5497fd81d5be470eb66172af14802ae1fff17da79f718d148.doc" /o ""

\??\c:\Users\Public\ctrlpanel.exe

c:\Users\Public\ctrlpanel.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3264,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 240.76.109.52.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 13.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
GB 2.16.167.163:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
US 8.8.8.8:53 163.167.16.2.in-addr.arpa udp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 57.211.222.173.in-addr.arpa udp
GB 2.16.167.163:443 metadata.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
GB 173.222.211.57:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

memory/5088-2-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

memory/5088-1-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

memory/5088-4-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

memory/5088-5-0x00007FFE07FCD000-0x00007FFE07FCE000-memory.dmp

memory/5088-3-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

memory/5088-0-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

memory/5088-6-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

memory/5088-9-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

memory/5088-11-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

memory/5088-14-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

memory/5088-13-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

memory/5088-15-0x00007FFDC7400000-0x00007FFDC7410000-memory.dmp

memory/5088-12-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

memory/5088-16-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

memory/5088-10-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

memory/5088-8-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

memory/5088-7-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

memory/5088-17-0x00007FFDC7400000-0x00007FFDC7410000-memory.dmp

memory/5088-92-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

\??\c:\Users\Public\ctrlpanel.exe

MD5 40d2ccd570bd898cc31af1cbfe5fb08e
SHA1 41d81d3275f8fe7be023b9731519cdf359743818
SHA256 10e720fbcf797a2f40fbaa214b3402df14b7637404e5e91d7651bd13d28a69d8
SHA512 0753eec8f21c4681559b82327c93098d2d74732df05d2304a8428dc7af0ff13d49079eacd0dc29d9b32ba5e5095cac6b9fa62a82f77e3ca3bb5986b64fe9195d

memory/2580-201-0x000000001B580000-0x000000001B668000-memory.dmp

memory/2580-209-0x000000001BF20000-0x000000001BFC6000-memory.dmp

memory/2580-210-0x000000001C4A0000-0x000000001C96E000-memory.dmp

memory/2580-211-0x000000001CB10000-0x000000001CBAC000-memory.dmp

memory/2580-212-0x0000000000C10000-0x0000000000C18000-memory.dmp

memory/2580-213-0x000000001CE50000-0x000000001CEC2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\56996B53-53BB-4B84-8765-DB82311961CB

MD5 fb43f63af400a23e3b19dac287eb39e7
SHA1 d0d8d07aa61e7dadd672d9c5860577f42e99e662
SHA256 6c697d4bf294b6d0e6c106488b62617c0ed7418b9025d68c224a42827715a791
SHA512 12dec5fd2b18aa918604946c7bc5db521fb7f98d495713067a83b3b0802be33172ef8b93f16aea50a2ad5a75e9c433e8419eb313e0d8b34d01f2b0fff9d1f6a6

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

MD5 5d1a844d057a6cbb5eced7ba20a40f12
SHA1 6f04aca0dd0f5f83f71c0dd7d9e5466e3c2c69ad
SHA256 0ec099484bf2d25d5661f78c6fc5fe7d45df2d55e62458974900e1d876136f40
SHA512 1f25ae33689ee6d3255622e37f6cec69a130d9e1c878f460d8e69181fe0eab3d98a14d5331024812fe7ea8aac2558821dfa5b9c6a4b08f96b84b546246fe7ad4

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

MD5 474709871ea40ccef965e128aaff1e79
SHA1 17207ca388ce8d6b2219814125595cd7def5faa8
SHA256 6a329e7fe7b877457592de62e3e6fb7403e4ed1d57f9b88890a94155e3acd296
SHA512 41c0e2009b02521d6c9f53727bebe52bd703897e24159d5d3fbb218ce89338e0d2980b8f3bad1d82d1b86db9dc4b52d3ddc58b342e62447b8ba479878c3bcd34

memory/2580-233-0x000000001CC40000-0x000000001CC52000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\LimitCheckpoint.doc

MD5 078b242b7e405a83cc0a11d20acb44ea
SHA1 d1be0c769d1ddc21a4125632398937c9f3f118bd
SHA256 c80e606a53a388387a970e2a3b81865d52e3bb2e9702ac5d661199f5dc8c2d25
SHA512 61e1efa29237a1408a4a69f19f84ba7611cde0fced24c568189dc4963c648f876e6f7f31826326bb0bc198e5a5b57cd31faec218715768f66b0b0a7c76255bea

C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db-wal

MD5 1034246204cda19fd49517decabf9e3f
SHA1 8b427e0d17859e3b4a8e3c52a999c3668a6b4f4d
SHA256 0f25063148cec8dd27900c9aef16340657a33f2fb7e64be4807195f4eb274b75
SHA512 941b1ed0911b6dbb826880a4ae5c7fa61f32cdc1818d97278360edf146ffbbef3aec1cef530eff82aa92624f7de926aac5f52e9f657ca1a81c45f25375cd58ce

C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog

MD5 06882dba871a5576143b5813a2e28dd2
SHA1 3939b68cd5adcaab377053ba4444c17f913df895
SHA256 266007a5fe563299f43105c3b716fd2414e2d49bc667e2295ba1de2cd8e8d695
SHA512 3e3069c62c7383f03aa4f6fd44c08d94d573ddba6fdca9ba94f34523613bd280269b04898f9828b8cb301a1b929f7ce98fc5874c5673c606d696111559ed4ff6

C:\Users\Admin\AppData\Local\Temp\NewClose.doc

MD5 7ab05187f60e0161c445d0a5d49429f5
SHA1 df558010347cb87b2b5c7d7b365431e5d71ffbdd
SHA256 90ef64d2e5d67e42e425d391b20701e2f08562fff94a56d7ab15d8ce1e6525ac
SHA512 698b1cd69a255b8d53f3db30c69dc33658d716d91338db271062a60c7441862b257cd430e28ec25dda9d663bc8103a60fc1e2d2d5290405fddfcf55a26765637

C:\Users\Admin\AppData\Local\Temp\TracePublish.doc

MD5 e71659e37047edcd0a2b05b27f22d1a5
SHA1 ee937ab3de1e77268c4e21ebae399aab8c47b67d
SHA256 36ad7c7ea4cb62c817b0b72ad8204b159b9d8ed74714fb7e3cc8f59b05b25a4a
SHA512 8b0458b043c5d4f047ff4871042c16bd7f7e4a7ab83f74eae8edd8c339b6b1c7e238dde4cecf0278642fe081cd0de200771e91fd60149cde048fa401a3bb9ecf

C:\Users\Admin\AppData\Local\Temp\UnblockSend.doc

MD5 0a0a28bd69e057801bdd1b36577937b7
SHA1 c814e90993cbd845faefd254744910d2c9228eed
SHA256 9805bb94a00bd79060ce5c40cc58c43309bb61f257c34a50294eda5e748f768c
SHA512 7755d62ffd252df5d973befc2d0fe07b3094c053a4c993db9af805e54f7dd6fa28bca7f1b21c8a43baa52d7ac6382a25896e3781db162429fe9fb9c53231ba69

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 3c7d2dfe744217ae978125707589f242
SHA1 c46809e728e1dcbaa4c484f2b8b16696ffd5ab79
SHA256 f8ed4f0f18f4b38a4c1c0e3962b29d9245bf884ad985b42c0d665605b51fdbea
SHA512 89749c3291fe848b968c11a4d9828fcd8c9f48c0419ed532d3c42404ae8449b594070e89aeaf885969d08ae15961ce186e01f0d8f08525f0ae742983c8a81de1

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 097fa6e256d7726b68e22a980841ae10
SHA1 ecf25463576f24c3e9ff59695c434a2fe249458f
SHA256 0af6892a1280e40e0c485f48e56f3cf723f2472f01c639f33cf1820584097d8f
SHA512 67d251748b14d208641500dfaef4fe49e1842fbe3b93897154b6b4192daa0afb18aebade8d6bab3d6dc20c181e2aac3897df3e1d22cb6cf657c2363784fb3a16

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl

MD5 51d32ee5bc7ab811041f799652d26e04
SHA1 412193006aa3ef19e0a57e16acf86b830993024a
SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851216[[fn=apasixtheditionofficeonline]].xsl

MD5 5632c4a81d2193986acd29eadf1a2177
SHA1 e8ff4fdfeb0002786fce1cf8f3d25f8e9631e346
SHA256 06de709513d7976690b3dd8f5fdf1e59cf456a2dfba952b97eacc72fe47b238b
SHA512 676ce1957a374e0f36634aa9cffbcfb1e1befe1b31ee876483b10763ea9b2d703f2f3782b642a5d7d0945c5149b572751ebd9abb47982864834ef61e3427c796

memory/5088-729-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TCDA387.tmp\sist02.xsl

MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

C:\Users\Admin\AppData\Local\Temp\cabA45B.tmp

MD5 69edb3bf81c99fe8a94bba03408c5ae1
SHA1 1ac85b369a976f35244beefa9c06787055c869c1
SHA256 cebe759bc4509700e3d23c6a5df8d889132a60ebc92260a74947eaa1089e2789
SHA512 bea70229a21fba3fd6d47a3dc5becba3eaa0335c08d486fab808344bfaa2f7b24dd9a14a0f070e13a42be45de3ff54d32cf38b43192996d20df4176964e81a53

C:\Users\Admin\AppData\Local\Temp\cabA471.tmp

MD5 205af51604ef96ef1e8e60212541f742
SHA1 d436fe689f8ef51fba898454cf509ddb049c1545
SHA256 df3fff163924d08517b41455f2d06788ba4e49c68337d15ecf329be48cf7da2d
SHA512 bcba80ed0e36f7abc1aef19e6ff6eb654b9e91268e79ca8f421cb8add6c2b0268ad6c45e6cc06652f59235084ecda3ba2851a38e6bcd1a0387eb3420c6ec94ac

C:\Users\Admin\AppData\Local\Temp\cabA470.tmp

MD5 f10df902980f1d5beea96b2c668408a7
SHA1 92d341581b9e24284b7c29e5623f8028dbbaafe9
SHA256 e0100320a4f63e07c77138a89ea24a1cbd69784a89fe3bf83e35576114b4ce02
SHA512 00a8fbcd17d791289ac8f12dc3c404b0afd240278492df74d2c5f37609b11d91a26d737be95d3fe01cdbc25eedc6da0c2d63a2ccc4ab208d6e054014083365fb

C:\Users\Admin\AppData\Local\Temp\cabA46F.tmp

MD5 6d787b1e223db6b91b69238062cca872
SHA1 a02f3d847d1f8973e854b89d4558413ea2e349f7
SHA256 da2f261c3c82e229a097a9302c8580f014bb6442825db47c008da097cfce0ee4
SHA512 9856d88d5c63cd6ebcf26e5d7521f194fa6b6e7bf55dd2e0238457a1b760eb8fb0d573a6e85e819bf8e5be596537e99bc8c2dce7ec6e2809a43490caccd44169

C:\Users\Admin\AppData\Local\Temp\cabA46E.tmp

MD5 c455c4bc4bec9e0da67c4d1e53e46d5a
SHA1 7674600c387114b0f98ec925be74e811fb25c325
SHA256 40e9af9284ff07fdb75c33a11a794f5333712baa4a6cf82fa529fbaf5ad0fed0
SHA512 08166f6cb3f140e4820f86918f59295cad8b4a17240c206dcba8b46088110bdf4e4adbab9f6380315ad4590ca7c8ecdc9afac6bd1935b17afb411f325fe81720

C:\Users\Admin\AppData\Local\Temp\cabA46D.tmp

MD5 62863124cdcda135ecc0e722782cb888
SHA1 2543b8a9d3b2304bb73d2adbec60db040b732055
SHA256 23ccfb7206a8f77a13080998ec6ef95b59b3c3e12b72b2d2ad4e53b0b26bb8c3
SHA512 2734d1119dc14b7dfb417f217867ef8ce8e73d69c332587278c0896b91247a40c289426a1a53f1796ccb42190001273d35525fcea8ba2932a69a581972a1ef00

C:\Users\Admin\AppData\Local\Temp\cabA46B.tmp

MD5 92a819d434a8aaea2c65f0cc2f33bb3a
SHA1 85c3f1801effea1ea10a8429b0875fc30893f2c8
SHA256 5d13f9907ac381d19f0a7552fd6d9fc07c9bd42c0f9ce017fff75587e1890375
SHA512 01339e04130e08573df7dbdfe25d82ed1d248b8d127bb90d536ecf4a26f5554e793e51e1a1800f61790738cc386121e443e942544246c60e47e25756f0c810a3

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851219[[fn=gostname]].xsl

MD5 9888a214d362470a6189deff775be139
SHA1 32b552eb3c73cd7d0d9d924c96b27a86753e0f97
SHA256 c64ed5c2a323c00e84272ad3a701caebe1dcceb67231978de978042f09635fa7
SHA512 8a75fc2713003fa40b9730d29c786c76a796f30e6ace12064468dd2bb4bf97ef26ac43ffe1158ab1db06ff715d2e6cde8ef3e8b7c49aa1341603ce122f311073

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl

MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

C:\Users\Admin\AppData\Local\Temp\cabA4DA.tmp

MD5 91aadbec4171cfa8292b618492f5ef34
SHA1 a47deb62a21056376dd8f862e1300f1e7dc69d1d
SHA256 7e1a90cdb2ba7f03abcb4687f0931858bf57e13552e0e4e54ec69a27325011ea
SHA512 1978280c699f7f739cd9f6a81f2b665643bd0be42ce815d22528f0d57c5a646fc30aae517d4a0a374efb8bd3c53eb9b3d129660503a82ba065679bbbb39bd8d5

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851220[[fn=gosttitle]].xsl

MD5 f425d8c274a8571b625ee66a8ce60287
SHA1 29899e309c56f2517c7d9385ecdbb719b9e2a12b
SHA256 dd7b7878427276af5dbf8355ece0d1fe5d693df55af3f79347f9d20ae50db938
SHA512 e567f283d903fa533977b30fd753aa1043b9dde48a251a9ac6777a3b67667443fead0003765a630d0f840b6c275818d2f903b6cb56136bedcc6d9bdd20776564

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx

MD5 5a53f55dd7da8f10a8c0e711f548b335
SHA1 035e685927da2fecb88de9caf0becec88bc118a7
SHA256 66501b659614227584da04b64f44309544355e3582f59dbca3c9463f67b7e303
SHA512 095bd5d1aca2a0ca3430de2f005e1d576ac9387e096d32d556e4348f02f4d658d0e22f2fc4aa5bf6c07437e6a6230d2abf73bbd1a0344d73b864bc4813d60861

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851222[[fn=ieee2006officeonline]].xsl

MD5 0c9731c90dd24ed5ca6ae283741078d0
SHA1 bdd3d7e5b0de9240805ea53ef2eb784a4a121064
SHA256 abce25d1eb3e70742ec278f35e4157edb1d457a7f9d002ac658aaa6ea4e4dcdf
SHA512 a39e6201d6b34f37c686d9bd144ddd38ae212eda26e3b81b06f1776891a90d84b65f2abc5b8f546a7eff3a62d35e432af0254e2f5bfe4aa3e0cf9530d25949c0

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851226[[fn=turabian]].xsl

MD5 f079ec5e2ccb9cd4529673bcdfb90486
SHA1 fba6696e6fa918f52997193168867dd3aebe1ad6
SHA256 3b651258f4d0ee1bffc7fb189250ded1b920475d1682370d6685769e3a9346db
SHA512 4fffa59863f94b3778f321da16c43b92a3053e024bdd8c5317077ea1ecc7b09f67ece3c377db693f3432bf1e2d947ec5bf8e88e19157ed08632537d8437c87d6

C:\Users\Admin\AppData\Local\Temp\cabA88E.tmp

MD5 1d6f8e73a0662a48d332090a4c8c898f
SHA1 cf9ad4f157772f5edc0fddeefd9b05958b67549c
SHA256 8077c92c66d15d7e03fbff3a48bd9576b80f698a36a44316eaba81ee8043b673
SHA512 5c03a99ecd747fbc7a15f082df08c0d26383db781e1f70771d4970e354a962294ce11be53becaad6746ab127c5b194a93b7e1b139c12e6e45423b3a509d771fc

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox

MD5 031c246ffe0e2b623bbbd231e414e0d2
SHA1 a57ca6134779d54691a4efd344bc6948e253e0ba
SHA256 2d76c8d1d59edb40d1fbbc6406a06577400582d1659a544269500479b6753cf7
SHA512 6a784c28e12c3740300883a0e690f560072a3ea8199977cbd7f260a21e8346b82ba8a4f78394d3bb53fa2e98564b764c2d0232c40b25fb6085c36d20d70a39d1

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851221[[fn=harvardanglia2008officeonline]].xsl

MD5 33a829b4893044e1851725f4daf20271
SHA1 dac368749004c255fb0777e79f6e4426e12e5ec8
SHA256 c40451cadf8944a9625dd690624ea1ba19cecb825a67081e8144ad5526116924
SHA512 41c1f65e818c2757e1a37f5255e98f6edeac4214f9d189ad09c6f7a51f036768c1a03d6cfd5845a42c455ee189d13bb795673ace3b50f3e1d77daff400f4d708

C:\Users\Admin\AppData\Local\Temp\cabA87E.tmp

MD5 8b29fab506fd65c21c9cd6fe6bbbc146
SHA1 ce1b8a57bb3c682f6a0afc32955dafd360720fdf
SHA256 773ac516c9b9b28058128ec9be099f817f3f90211ac70dc68077599929683d6f
SHA512 afa82ccbc0aef9fae4e728e4212e9c6eb2396d7330ccbe57f8979377d336b4dacf4f3bf835d04abcebcdb824b9a9147b4a7b5f12b8addadf42ab2c34a7450ade

C:\Users\Admin\AppData\Local\Temp\cabA86C.tmp

MD5 53ee9da49d0b84357038ecf376838d2e
SHA1 ab03f46783b2227f312187dd84dc0c517510de20
SHA256 9e46b8ba0bad6e534af33015c86396c33c5088d3ae5389217a5e90ba68252374
SHA512 751300c76ece4901801b1f9f51eaca7a758d5d4e6507e227558aaaaf8e547c3d59fa56153fea96b6b2d7eb08c7af2e4d5568ace7e798d1a86cede363efbecf7c

C:\Users\Admin\AppData\Local\Temp\cabA89F.tmp

MD5 9c9f49a47222c18025cc25575337a965
SHA1 e42edb33471d7c1752dcc42c06dd3f9fda8b25f0
SHA256 ada7eff0676d9cce1935d5485f3dde35c594d343658fb1da42cb5a48fc3fc16a
SHA512 9fdcbab988cbe97bfd931b727d31ba6b8ecf795d0679a714b9afbc2c26e7dcf529e7a51289c7a1ae7ef04f4a923c2d7966d5af7c0bc766dcd0fca90251576794

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx

MD5 529795e0b55926752462cbf32c14e738
SHA1 e72dff8354df2cb6a5698f14bbd1805d72feeaff
SHA256 8d341d1c24176dc6b67104c2af90fabd3bff666ccc0e269381703d7659a6fa05
SHA512 a51f440f1e19c084d905b721d0257f7eee082b6377465cb94e677c29d4e844fd8021d0b6ba26c0907b72b84157c60a3efedfd96c16726f6abea8d896d78b08ce

C:\Users\Admin\AppData\Local\Temp\cabAB64.tmp

MD5 f256aca509b4c6c0144d278c7036b0a8
SHA1 93f6106d0759afd0061f73b876aa9cab05aa8ef6
SHA256 ad26761d59f1fa9783c2f49184a2e8fe55fcd46cd3c49ffc099c02310649dc67
SHA512 08c57661f8cc9b547bbe42b4a5f8072b979e93346679ade23ca685c0085f7bc14c26707b3d3c02f124359ebb640816e13763c7546ff095c96d2bb090320f3a95

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx

MD5 5af1581e9e055b6e323129e4b07b1a45
SHA1 b849f85bcaf0e1c58fa841ffae3476d20d33f2dd
SHA256 bdc9fbf81fbe91f5bf286b2cea00ee76e70752f7e51fe801146b79f9adcb8e98
SHA512 11bfef500daec099503e8cdb3b4de4ede205201c0985db4ca5ebba03471502d79d6616d9e8f471809f6f388d7cbb8b0d0799262cbe89feb13998033e601cee09

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRD2906.doc

MD5 9db5ae16d1633602ae7aec973ef1e4be
SHA1 84ec451906f68a39e29016d45dcf5f8e8fab717f
SHA256 e18e840b73ac3afbe09b0109d4e11b5d505100671b5c80ee0c09ef55ed24b6c1
SHA512 3dacf9f5796f519da33958aabfead4be5356438a85324dbd2726c937bbcf5fc9829499b6f338ce194c150c21e84e58ced30aaa8cd27531ad05af5a5a86eaded5

memory/5088-954-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\cabB169.tmp

MD5 e033ccbc7ba787a2f824ce0952e57d44
SHA1 eeea573bea217878cd9e47d7ea94e56bdaffe22a
SHA256 d250eb1f93b43efb7654b831b4183c9caec2d12d4efee8607fee70b9fab20730
SHA512 b807b024b32e7f975aed408b77563a6b47865eece32e8ba993502d9874b56580ecc9d9a3fefa057fdd36fb8d519b6e184db0593a65cc0acf5e4accbede0f9417

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851225[[fn=mlaseventheditionofficeonline]].xsl

MD5 377b3e355414466f3e3861bce1844976
SHA1 0b639a3880aca3fd90fa918197a669cc005e2ba4
SHA256 4ac5b26c5e66e122de80243ef621ca3e1142f643dd2ad61b75ff41cfee3dffaf
SHA512 b050ad52a8161f96cbdc880dd1356186f381b57159f5010489b04528db798db955f0c530465ab3ecd5c653586508429d98336d6eb150436f1a53abee0697aeb9

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx

MD5 4a1657a3872f9a77ec257f41b8f56b3d
SHA1 4ddea85c649a2c1408b5b08a15def49baa608a0b
SHA256 c17103ade455094e17ac182ad4b4b6a8c942fd3acb381f9a5e34e3f8b416ae60
SHA512 7a2932639e06d79a5ce1d3c71091890d9e329ca60251e16ae4095e4a06c6428b4f86b7fffa097bf3eefa064370a4d51ca3df8c89eafa3b1f45384759dec72922

C:\Users\Admin\AppData\Local\Temp\cabB1E8.tmp

MD5 0ebc45aa0e67cc435d0745438371f948
SHA1 5584210c4a8b04f9c78f703734387391d6b5b347
SHA256 3744bfa286cfcff46e51e6a68823a23f55416cd6619156b5929fed1f7778f1c7
SHA512 31761037c723c515c1a9a404e235fe0b412222cb239b86162d17763565d0ccb010397376fb9b61b38a6aebdd5e6857fd8383045f924af8a83f2c9b9af6b81407

C:\Users\Admin\AppData\Local\Temp\cabB258.tmp

MD5 51804e255c573176039f4d5b55c12ab2
SHA1 a4822e5072b858a7cca7de948caa7d2268f1bb4b
SHA256 3c6f66790c543d4e9d8e0e6f476b1acadf0a5fcdd561b8484d8dddadfdf8134b
SHA512 2ac8b1e433c9283377b725a03ae72374663fec81abba4c049b80409819bb9613e135fcd640ed433701795bdf4d5822461d76a06859c4084e7bae216d771bb091

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851224[[fn=iso690nmerical]].xsl

MD5 3bf8591e1d808bccad8ee2b822cc156b
SHA1 9cc1e5efd715bd0eae5af983fb349bac7a6d7ba0
SHA256 7194396e5c833e6c8710a2e5d114e8e24338c64ec9818d51a929d57a5e4a76c8
SHA512 d434a4c15da3711a5daaf5f7d0a5e324b4d94a04b3787ca35456bfe423eac9d11532bb742cde6e23c16fa9fd203d3636bd198b41c7a51e7d3562d5306d74f757

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851217[[fn=chicago]].xsl

MD5 9ac6de7b629a4a802a41f93db2c49747
SHA1 3d6e929aa1330c869d83f2bf8ebebacd197fb367
SHA256 52984bc716569120d57c8e6a360376e9934f00cf31447f5892514ddccf546293
SHA512 5736f14569e0341afb5576c94b0a7f87e42499cec5927aac83bb5a1f77b279c00aea86b5f341e4215076d800f085d831f34e4425ad9cfd52c7ae4282864b1e73

C:\Users\Admin\AppData\Local\Temp\cabB259.tmp

MD5 d3c9036e4e1159e832b1b4d2e9d42bf0
SHA1 966e04b7a8016d7fdafe2c611957f6e946fab1b9
SHA256 434576eb1a16c2d14d666a33edde76717c896d79f45df56742afd90acb9f21ce
SHA512 d28d7f467f072985bcfcc6449ad16d528d531eb81912d4c3d956cf8936f96d474b18e7992b16d6834e9d2782470d193a17598cab55a7f9eb0824bc3f069216b6

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRD3164.doc

MD5 38457d79510e201d50ddf207c960c23d
SHA1 ec4a98513651bbe6ad7087cbc8d4acea7e07174c
SHA256 8bad487779577bc8473c31e7e16252cdd2bfddf0545a56cafc8a1cf4474b411d
SHA512 5d59177c7c327c214c823d4a7537490e168e460126d5c61ff48ca32414206b86acbd969333116fd0398552c06cc57569f1f602f12ae01e99ff09cb6744b7d3e2

C:\Users\Admin\AppData\Local\Temp\cabB327.tmp

MD5 748a53c6bdd5ce97bd54a76c7a334286
SHA1 7dd9eedb13ac187e375ad70f0622518662c61d9f
SHA256 9af92b1671772e8e781b58217dab481f0afbcf646de36bc1bffc7d411d14e351
SHA512 ec8601d1a0dbd5d79c67af2e90fad44bbc0b890412842bf69065a2c7cb16c12b1c5ff594135c7b67b830779645801da20c9be8d629b6ad8a3ba656e0598f0540

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx

MD5 35200e94ceb3bb7a8b34b4e93e039023
SHA1 5bb55edaa4cdf9d805e36c36fb092e451bddb74d
SHA256 6ce04e8827abaea9b292048c5f84d824de3cefdb493101c2db207bd4475af1fd
SHA512 ed80cee7c22d10664076ba7558a79485aa39be80582cec9a222621764dae5efa70f648f8e8c5c83b6fe31c2a9a933c814929782a964a47157505f4ae79a3e2f9

C:\Users\Admin\AppData\Local\Temp\cabB4AF.tmp

MD5 4efa48ec307eaf2f9b346a073c67fcfb
SHA1 76a7e1234ff29a2b18c968f89082a14c9c851a43
SHA256 3ee9ae1f8dab4c498bd561d8fcc66d83e58f11b7bb4b2776df99f4cda4b850c2
SHA512 2705644d501d85a821e96732776f61641fe82820fd6a39ffaf54a45ad126c886dc36c1398cdbdbb5fe282d9b09d27f9bfe7f26a646f926da55dff28e61fbd696

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox

MD5 7bc0a35807cd69c37a949bbd51880ff5
SHA1 b5870846f44cad890c6eff2f272a037da016f0d8
SHA256 bd3a013f50ebf162aac4ced11928101554c511bd40c2488cf9f5842a375b50ca
SHA512 b5b785d693216e38b5ab3f401f414cadaccdcb0dca4318d88fe1763cd3bab8b7670f010765296613e8d3363e47092b89357b4f1e3242f156750be86f5f7e9b8d

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRD3422.doc

MD5 e88402a02c8f342155afe0b09781e283
SHA1 c3b888ceeca586a0579108b9173b0b97f6ed1940
SHA256 6597611552597c7e7d556992927ff107319bc6a89990d7d2a55fad279eb133cf
SHA512 093ea828b44822df981f7801d4bc39fb7620a331ddc4a88ce8b4c8198cfadf4ff312e41951e1f42eac923c47ef7a907eac8b377122e7e3bcf5b0276b807f7a33

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRD3648.doc

MD5 4a3a84d68505278429345e39e79474a0
SHA1 8512dbc9d897abca7460eb45073839e3b4726a4e
SHA256 cfc2533f5ba12783bc00e1fc051f149bc05eb5e5bfd0d1c55969f8c7409edf7f
SHA512 81da4cd694cccebf5bb01f08e2c8bcedcc12d4c206125f3bab14e54a42d7ba5e5348c596d0d70642ff9a3708304c509908188f894f7ef525c09d244de3cc2cee