eternity | 65fe796ff29aa6f7fd2ec6e7fee276259371a2f0b76e62b180dabd162a161397

Resubmissions

12-02-2025 15:52

250212-ta9vpaykat 10

11-02-2025 14:21

250211-rpddxswndx 10

Analysis

max time kernel
485s
max time network
486s
platform
windows11-21h2_x64
resource
win11-20250210-en
resource tags

arch:x64arch:x86image:win11-20250210-enlocale:en-usos:windows11-21h2-x64system
submitted
12-02-2025 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Как заработать миллион.docm
Size

466KB
MD5

3c151ed6a605746afb9d5bab9041ab8f
SHA1

0f016fecf45c95d084a163e4f9fc00438fb5f32c
SHA256

65fe796ff29aa6f7fd2ec6e7fee276259371a2f0b76e62b180dabd162a161397
SHA512

62f5006ee122ce913959f63bf880f800a54e6d2ab73aeae5b8546b0a54366c200c131500521b7f97fc3a893b6a43f966b6e757db880563b0ea018bdff02d6a0d
SSDEEP

12288:ENwGmmFE0ToU190Wf57vqd6RCP6n4mBEhB/F7fBf5U:I7mOrTo03Lqd6ybmwB/FlBU

Score

10^/10

eternity collection defense_evasion discovery persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

eternity

http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Eternity family
eternity

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	2344	4836	certutil.exe	81
Parent C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE is not expected to spawn this process	5016	648	certutil.exe	101

Downloads MZ/PE file 1 IoCs

flow	pid	Process
25	984	Process not Found

Executes dropped EXE 3 IoCs

pid	Process
1548	oe39e861fc2efb967c73b4c7b.exe
3020	oe39e861fc2efb967c73b4c7b.exe
2624	oe39e861fc2efb967c73b4c7b.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	oe39e861fc2efb967c73b4c7b.exe
Key opened	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	oe39e861fc2efb967c73b4c7b.exe
Key opened	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	oe39e861fc2efb967c73b4c7b.exe
Key opened	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	oe39e861fc2efb967c73b4c7b.exe
Key opened	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	oe39e861fc2efb967c73b4c7b.exe
Key opened	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	oe39e861fc2efb967c73b4c7b.exe
Key opened	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	oe39e861fc2efb967c73b4c7b.exe
Key opened	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	oe39e861fc2efb967c73b4c7b.exe
Key opened	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	oe39e861fc2efb967c73b4c7b.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
5016	certutil.exe
2344	certutil.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
13	pastebin.com
135	pastebin.com
163	pastebin.com
12	pastebin.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com
129	ip-api.com
159	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\WF.msc	mmc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2908	MicrosoftEdgeUpdate.exe
5968	cmd.exe
6032	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 12 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3432	netsh.exe
4076	netsh.exe
4160	netsh.exe
1756	cmd.exe
4740	netsh.exe
3668	netsh.exe
3960	cmd.exe
2112	cmd.exe
3472	netsh.exe
2668	cmd.exe
3724	cmd.exe
4336	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	oe39e861fc2efb967c73b4c7b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	oe39e861fc2efb967c73b4c7b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	oe39e861fc2efb967c73b4c7b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	oe39e861fc2efb967c73b4c7b.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	oe39e861fc2efb967c73b4c7b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	oe39e861fc2efb967c73b4c7b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133838494916295173"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = 00000000ffffffff	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{DE2B70EC-9BF7-4A93-BD3D-243F7881D492}\FFlags = "1092616193"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\1\0\0	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\SniffedFolderType = "Generic"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\MRUListEx = ffffffff	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{DE2B70EC-9BF7-4A93-BD3D-243F7881D492}\IconSize = "48"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{DE2B70EC-9BF7-4A93-BD3D-243F7881D492}\GroupView = "0"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\SniffedFolderType = "Generic"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = 0100000000000000ffffffff	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 78003100000000004a5af7501100557365727300640009000400efbec5522d604c5a937e2e0000006c0500000000010000000000000000003a000000000072be960055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\NodeSlot = "7"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	WINWORD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6032	PING.EXE

Suspicious behavior: AddClipboardFormatListener 7 IoCs

pid	Process
4836	WINWORD.EXE
4836	WINWORD.EXE
648	WINWORD.EXE
648	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
4780	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1548	oe39e861fc2efb967c73b4c7b.exe
3020	oe39e861fc2efb967c73b4c7b.exe
2624	oe39e861fc2efb967c73b4c7b.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
2692	chrome.exe
2692	chrome.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
648	WINWORD.EXE
4212	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe
2692	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1548	oe39e861fc2efb967c73b4c7b.exe
Token: SeDebugPrivilege	3020	oe39e861fc2efb967c73b4c7b.exe
Token: SeDebugPrivilege	2624	oe39e861fc2efb967c73b4c7b.exe
Token: SeShutdownPrivilege	1108	control.exe
Token: SeCreatePagefilePrivilege	1108	control.exe
Token: SeDebugPrivilege	4212	taskmgr.exe
Token: SeSystemProfilePrivilege	4212	taskmgr.exe
Token: SeCreateGlobalPrivilege	4212	taskmgr.exe
Token: 33	4284	mmc.exe
Token: SeIncBasePriorityPrivilege	4284	mmc.exe
Token: 33	4284	mmc.exe
Token: SeIncBasePriorityPrivilege	4284	mmc.exe
Token: 33	4284	mmc.exe
Token: SeIncBasePriorityPrivilege	4284	mmc.exe
Token: 33	4284	mmc.exe
Token: SeIncBasePriorityPrivilege	4284	mmc.exe
Token: 33	4284	mmc.exe
Token: SeIncBasePriorityPrivilege	4284	mmc.exe
Token: 33	4284	mmc.exe
Token: SeIncBasePriorityPrivilege	4284	mmc.exe
Token: 33	4284	mmc.exe
Token: SeIncBasePriorityPrivilege	4284	mmc.exe
Token: 33	4284	mmc.exe
Token: SeIncBasePriorityPrivilege	4284	mmc.exe
Token: 33	4284	mmc.exe
Token: SeIncBasePriorityPrivilege	4284	mmc.exe
Token: 33	4284	mmc.exe
Token: SeIncBasePriorityPrivilege	4284	mmc.exe
Token: 33	4284	mmc.exe
Token: SeIncBasePriorityPrivilege	4284	mmc.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe
Token: SeShutdownPrivilege	2692	chrome.exe
Token: SeCreatePagefilePrivilege	2692	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4836	WINWORD.EXE
4780	explorer.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
4212	taskmgr.exe
2692	chrome.exe
2692	chrome.exe

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
4836	WINWORD.EXE
4836	WINWORD.EXE
4836	WINWORD.EXE
4836	WINWORD.EXE
648	WINWORD.EXE
648	WINWORD.EXE
648	WINWORD.EXE
648	WINWORD.EXE
648	WINWORD.EXE
648	WINWORD.EXE
648	WINWORD.EXE
648	WINWORD.EXE
648	WINWORD.EXE
648	WINWORD.EXE
648	WINWORD.EXE
648	WINWORD.EXE
648	WINWORD.EXE
648	WINWORD.EXE
648	WINWORD.EXE
648	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
4284	mmc.exe
4284	mmc.exe
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE
1624	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 2344	4836	WINWORD.EXE	84
PID 4836 wrote to memory of 2344	4836	WINWORD.EXE	84
PID 4836 wrote to memory of 1548	4836	WINWORD.EXE	86
PID 4836 wrote to memory of 1548	4836	WINWORD.EXE	86
PID 1548 wrote to memory of 3960	1548	oe39e861fc2efb967c73b4c7b.exe	89
PID 1548 wrote to memory of 3960	1548	oe39e861fc2efb967c73b4c7b.exe	89
PID 3960 wrote to memory of 4900	3960	cmd.exe	91
PID 3960 wrote to memory of 4900	3960	cmd.exe	91
PID 3960 wrote to memory of 3432	3960	cmd.exe	92
PID 3960 wrote to memory of 3432	3960	cmd.exe	92
PID 3960 wrote to memory of 860	3960	cmd.exe	93
PID 3960 wrote to memory of 860	3960	cmd.exe	93
PID 1548 wrote to memory of 2112	1548	oe39e861fc2efb967c73b4c7b.exe	94
PID 1548 wrote to memory of 2112	1548	oe39e861fc2efb967c73b4c7b.exe	94
PID 2112 wrote to memory of 3868	2112	cmd.exe	96
PID 2112 wrote to memory of 3868	2112	cmd.exe	96
PID 2112 wrote to memory of 3472	2112	cmd.exe	97
PID 2112 wrote to memory of 3472	2112	cmd.exe	97
PID 2112 wrote to memory of 3564	2112	cmd.exe	98
PID 2112 wrote to memory of 3564	2112	cmd.exe	98
PID 648 wrote to memory of 5016	648	WINWORD.EXE	109
PID 648 wrote to memory of 5016	648	WINWORD.EXE	109
PID 648 wrote to memory of 3020	648	WINWORD.EXE	111
PID 648 wrote to memory of 3020	648	WINWORD.EXE	111
PID 3020 wrote to memory of 2668	3020	oe39e861fc2efb967c73b4c7b.exe	112
PID 3020 wrote to memory of 2668	3020	oe39e861fc2efb967c73b4c7b.exe	112
PID 2668 wrote to memory of 2972	2668	cmd.exe	114
PID 2668 wrote to memory of 2972	2668	cmd.exe	114
PID 2668 wrote to memory of 4076	2668	cmd.exe	115
PID 2668 wrote to memory of 4076	2668	cmd.exe	115
PID 2668 wrote to memory of 3944	2668	cmd.exe	116
PID 2668 wrote to memory of 3944	2668	cmd.exe	116
PID 3020 wrote to memory of 3724	3020	oe39e861fc2efb967c73b4c7b.exe	117
PID 3020 wrote to memory of 3724	3020	oe39e861fc2efb967c73b4c7b.exe	117
PID 3724 wrote to memory of 2028	3724	cmd.exe	119
PID 3724 wrote to memory of 2028	3724	cmd.exe	119
PID 3724 wrote to memory of 4160	3724	cmd.exe	120
PID 3724 wrote to memory of 4160	3724	cmd.exe	120
PID 3724 wrote to memory of 1568	3724	cmd.exe	121
PID 3724 wrote to memory of 1568	3724	cmd.exe	121
PID 2624 wrote to memory of 1756	2624	oe39e861fc2efb967c73b4c7b.exe	131
PID 2624 wrote to memory of 1756	2624	oe39e861fc2efb967c73b4c7b.exe	131
PID 1756 wrote to memory of 3332	1756	cmd.exe	133
PID 1756 wrote to memory of 3332	1756	cmd.exe	133
PID 1756 wrote to memory of 4740	1756	cmd.exe	134
PID 1756 wrote to memory of 4740	1756	cmd.exe	134
PID 1756 wrote to memory of 244	1756	cmd.exe	135
PID 1756 wrote to memory of 244	1756	cmd.exe	135
PID 2624 wrote to memory of 4336	2624	oe39e861fc2efb967c73b4c7b.exe	136
PID 2624 wrote to memory of 4336	2624	oe39e861fc2efb967c73b4c7b.exe	136
PID 4336 wrote to memory of 3760	4336	cmd.exe	138
PID 4336 wrote to memory of 3760	4336	cmd.exe	138
PID 4336 wrote to memory of 3668	4336	cmd.exe	139
PID 4336 wrote to memory of 3668	4336	cmd.exe	139
PID 4336 wrote to memory of 3864	4336	cmd.exe	140
PID 4336 wrote to memory of 3864	4336	cmd.exe	140
PID 4780 wrote to memory of 4284	4780	explorer.exe	145
PID 4780 wrote to memory of 4284	4780	explorer.exe	145
PID 4780 wrote to memory of 4212	4780	explorer.exe	147
PID 4780 wrote to memory of 4212	4780	explorer.exe	147
PID 1624 wrote to memory of 3692	1624	WINWORD.EXE	149
PID 1624 wrote to memory of 3692	1624	WINWORD.EXE	149
PID 2692 wrote to memory of 3512	2692	chrome.exe	151
PID 2692 wrote to memory of 3512	2692	chrome.exe	151

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	oe39e861fc2efb967c73b4c7b.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1003530991-2962315046-3000157291-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	oe39e861fc2efb967c73b4c7b.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Как заработать миллион.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\System32\certutil.exe
  "C:\Windows\System32\certutil.exe" -decode C:\Users\Admin\AppData\Local\Temp\Q19c152890436667fb228d84cd21489 C:\Users\Admin\AppData\Local\Temp\oe39e861fc2efb967c73b4c7b.exe
  2⤵
  - Process spawned unexpected child process
  - Deobfuscate/Decode Files or Information
  PID:2344
- C:\Users\Admin\AppData\Local\Temp\oe39e861fc2efb967c73b4c7b.exe
  "C:\Users\Admin\AppData\Local\Temp\oe39e861fc2efb967c73b4c7b.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4900
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3432
  - - C:\Windows\system32\findstr.exe
      findstr All
      4⤵
      PID:860
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3868
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="65001" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3472
  - - C:\Windows\system32\findstr.exe
      findstr Key
      4⤵
      PID:3564
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\oe39e861fc2efb967c73b4c7b.exe"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5968
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:6016
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6032

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTkzQzI1NjQtRUZFRC00NThELUExRTMtMkU1REIzRTAzRjUwfSIgdXNlcmlkPSJ7RjY5NThBMzUtQTA3NS00RURDLUI2N0ItMzA1MzQ5QTAyNzkyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OEY2NTJDNEUtQTY2OC00RDY1LTg2ODgtMkY3NEE5MTk2NjdBfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjIiIGluc3RhbGxkYXRldGltZT0iMTczOTE4NDcxMiIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNjU1NjY2MDQzMDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ2NzU1MDg5MDgiLz48L2FwcD48L3JlcXVlc3Q-
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2908

C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\System32\certutil.exe
  "C:\Windows\System32\certutil.exe" -decode C:\Users\Admin\AppData\Local\Temp\Q19c152890436667fb228d84cd21489 C:\Users\Admin\AppData\Local\Temp\oe39e861fc2efb967c73b4c7b.exe
  2⤵
  - Process spawned unexpected child process
  - Deobfuscate/Decode Files or Information
  PID:5016
- C:\Users\Admin\AppData\Local\Temp\oe39e861fc2efb967c73b4c7b.exe
  "C:\Users\Admin\AppData\Local\Temp\oe39e861fc2efb967c73b4c7b.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2972
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4076
  - - C:\Windows\system32\findstr.exe
      findstr All
      4⤵
      PID:3944
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3724
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2028
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile name="65001" key=clear
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4160
  - - C:\Windows\system32\findstr.exe
      findstr Key
      4⤵
      PID:1568

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
PID:4432

C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3692

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4916

C:\Users\Admin\AppData\Local\Temp\oe39e861fc2efb967c73b4c7b.exe
"C:\Users\Admin\AppData\Local\Temp\oe39e861fc2efb967c73b4c7b.exe"
1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2624
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3332
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4740
- - C:\Windows\system32\findstr.exe
    findstr All
    3⤵
    PID:244
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3760
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="65001" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3668
- - C:\Windows\system32\findstr.exe
    findstr Key
    3⤵
    PID:3864

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:3696

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\system32\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\system32\WF.msc"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4284
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /7
  2⤵
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4212

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Как заработать миллион.docx" /o ""
1⤵
PID:3084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b9bdcc40,0x7ff9b9bdcc4c,0x7ff9b9bdcc58
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1956,i,5645777191985911823,8154950118275356931,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1804,i,5645777191985911823,8154950118275356931,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=1988 /prefetch:3
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2168,i,5645777191985911823,8154950118275356931,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=2212 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3144,i,5645777191985911823,8154950118275356931,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3212,i,5645777191985911823,8154950118275356931,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3568,i,5645777191985911823,8154950118275356931,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4656,i,5645777191985911823,8154950118275356931,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=4692 /prefetch:8
  2⤵
  PID:5168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4780,i,5645777191985911823,8154950118275356931,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4904,i,5645777191985911823,8154950118275356931,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4640,i,5645777191985911823,8154950118275356931,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=4064 /prefetch:8
  2⤵
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4992,i,5645777191985911823,8154950118275356931,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:5356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4672,i,5645777191985911823,8154950118275356931,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3472,i,5645777191985911823,8154950118275356931,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3524,i,5645777191985911823,8154950118275356931,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4708,i,5645777191985911823,8154950118275356931,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3608,i,5645777191985911823,8154950118275356931,262144 --variations-seed-version=20250209-180322.678000 --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:3256

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012

Filesize
215KB

MD5
0e9976cf5978c4cad671b37d68b935ef

SHA1
9f38e9786fbab41e6f34c2dcc041462eb11eccbc

SHA256
5e8e21f87c0a104d48abc589812e6f4e48655cabe4356cda9e3c1ceee0acaa4e

SHA512
2faa6fff6b47e20fd307a206827dc7ff4892fce8b55b59b53d3e45b7dcf5fd34cebc4776b63da5aa4d0e0408344bd4602d26d09e7a456dd286e93b768cbfaa51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e4330fdb63011021ea99846bacc7febc

SHA1
5590d73073de7f6372a9b5ddfca2822834fcfb1f

SHA256
4b7e75b5d31615734184bc7a64f6b3a4670d025565a76f891f139b99d026fd57

SHA512
84404c1fb7ef1b9f8c03e078d519289db5bcb8b570055d934ada5954920f7c34b1c6e13aea1d73c44035ec3413102fd85068ae85ad1543a8129ba3585239e2d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
61b1bbfb54fcc30d8a7e3c2c3b5bd1eb

SHA1
2723b2f0c3f6ae0d86e3b63bd51b4050cd40d7c3

SHA256
83737bf7d39958d8fdebe82fbbf0dbe952302a704a9bc8939f43d593c5d73087

SHA512
a7238928decd9ced151ae2b18f4f2d9c17582913988b1bb3d8b8634c0f5d2535c22e8868d32a6cbddcb59459f2327de0f6212af329bf9a4cf72b772f89f7bbf7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
cacc356a806d664d49e173c0585b3567

SHA1
da6a92629db6bc9eb60f6a73d656928b1b5beb6a

SHA256
27b2f9563fff4675df9aa9c31f6184d95d98577788484b81b53046ba5a2cdad7

SHA512
22a1c803f15b52db774c6de25fa1f5250d4fa6513bfe3cb93775964706e02850c49022268e8c41aea85c71fd9f8bd33a9dfd27ac0982790573c0e2d043ba4cc0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
22397decc7f4eccf2ea795a13d6bf7f6

SHA1
8aa1eae150a4d70e9ff6137e6c1dd92c61920bf0

SHA256
e0c2ab2c2ba8e937a39d4042403cdd64580a92360caf290c58353d5d31be6266

SHA512
e203085101e7f7b2c8e77f4b6efe9cdb7c03fcf06a80b4f9af05e5a88ed37c712c367bf041c5ff40ae539a9f0f05b5070af36df93a6f8585982e20466fc43f90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
34f8b05d7a9c6bba09927b3988a70345

SHA1
7deef9aac7f114f96019306df645fffed2f06f78

SHA256
d9179f252df9870c1bf010734d41d9838122efaf2f62d1d27caff8f43ab96dee

SHA512
06a898008b648dbc7b9ab0a68e076bdc96c0c842480d6c84e70f93f128d24653de685d41ecbeba3428befd294f5a3462acade9bffe597818b713934d82429ce9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
53270eb848c0df2ce148090be1cd5c90

SHA1
be242c2a9f50f51bb57766d4000ada4f8a7cfb5e

SHA256
112cd590649440a4531f7c355a0a5cf12f20e67982630af14e2806e919d35c84

SHA512
bd732dc4e6905502fbaed88599e0053246ca1112e47f4484eb828202f77afebbde681e7dc058074b3f3210332a76d18fc691f0e7c6506d3529681b47877243be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a2fdbebf276610c18e86bfa01a9a57cf

SHA1
4b1ba70bbc9a3297d3c55874019ad7e3927d20eb

SHA256
e3bb38bfbb21d1baf29da21096f0368eb6d72f20cb726c2ad4f6ef69d18c65dd

SHA512
723ec27f444febe99c89ab3bc8d578067b9c41d59c8f9b4a8e2c8398efe182c65031fb587277958d33929f5920c54caf5414803b6c759f116be7fd2befe24f17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
38e009f4c2563855f0b2280ee0a6aae7

SHA1
05ae5756174b2e83732e0a32a4e2a0ece9c7f2b4

SHA256
c81eca7a88d7549732c969522d1f6bf6071d224ac0b936a0d17005e134aec0d6

SHA512
2b813f0e2a666e5e0a82dfddfbc1b4f5bddd85adf6582c26ed8e65366b56f3f46f36416820a5bb071f13ff0956fb6e0acf8385b7eff78e6eb16ff76139b3d18e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a1a583533e703636a522bb9c3b0a8c13

SHA1
158bfe13ba85914e59a8a80244f94449eba9e7d3

SHA256
fd7c8c05c34fbd96fad01647afea9233c689f28606d8014dd1914373da5daf0b

SHA512
5b36c76822d4b521a049a8feda99091c1b2a912a2ac56832fc470e1e2f8a62f321fc76c6fed0709d491839fe0ae27ab51a180d335dbd1b736b2bf9d4bf635fde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e2d3eae1a61509d25af6cea2c3f0da2e

SHA1
4590a6c7e13c0fc4557145416d189fca849e7b78

SHA256
09cd9d3eeec797e748162270fa5e1924569c1bd0825de423549ccb64a22d09e9

SHA512
fcc7dcd49cab07a1e580c150bbe8d1d276e9bb6a05d492cab4019c2defd1947a180ce9f718946bc8a99a9ab784d07a75f1bfb484bd93631d91fa61eabc5a6b43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8f3cfc842911f83ae8b1f62dd65a2607

SHA1
5abb65881b3e6964d64ae1664ea25c5fb2edc5e5

SHA256
50ea87af48c9dfc2048eb5120d37d713da49de97b0e50bd2486b3ca4398c1d10

SHA512
7aa6074048ed2282d5ef1d84e9e0a2fc58252991a1e93e5039835be36b2ef40d930fa5d72c7d3639cf3d43b13bc1217210e125f3ca3e2febd30868c7678a687f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b6ca0c8955c22eedd0f9c4d9eb86cdbb

SHA1
a4a1992cf6481cec3cbb21656a44e777c1b88e49

SHA256
29c5389cc5f848a05641b018692bc8f9cd7832a780c0bec7ce5e8f5809e60f7e

SHA512
9dfb67bffbc3b19ab4bf3dd4af9d5c911ee908b191a2fee391ee88066334892b24ead734dd5da1a6b6a3ca0a1e0efaf6927c325cd5a138d2b4180d6396d671c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c4ba31f59aaec0db0a7aea0e94947fd3

SHA1
78999be2c0015dbaace6fbb48a837cd1abab4328

SHA256
3046cea20f4fd8ba9773ec6353d03ee3c7d666190e7cdbe2e6c6a095d20541fc

SHA512
35788411da599e1bd74f201ae55a64adf0498eda37f3b1b54e9f9e9fae6db5873226c02a191a200b2fbc630abe65f120e787431ba8d271e90b43e8b355e645bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
13KB

MD5
0eef4f4886573985612149360f51f717

SHA1
267f2e822427bd2d2c85c86511088f9ee3194af0

SHA256
c119c1452ff5ea090210570fd325bd72b5bf07afc0d9aa5bd6998c363109c2c5

SHA512
70dc193dccc0f25ba5ed03d2f857766d9b5b301c6b6f772acf2e2cd6ab1c331e86e9a3032196fa5a59629f3d7651816fbb5adf579ffeab8b3ef389f78802b706

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
3a91f360c35276a02832d6c568dc2a74

SHA1
4d85b850b6db1fe438117026614fb3e3054c13a8

SHA256
9c2a401803d2aace510bcfeae296c6eb6fd860323adf85e88f3bf2b76fc88e1f

SHA512
623beb681d23d3783ce5f67d30fe41e68b21151f5625b9634999d5c7dd6ce3e91303d487a8b9123dd13fdf3abf46c16d98544a7309af11a02d8c6a30932892ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
246KB

MD5
9d56ce29f45dcf0afc75b8713a43f43a

SHA1
3b195c4ca8d23dc6ed267e43803fbcbd4bef26af

SHA256
3ac80faef5514192366b2a7d17b834cc43cd6fe1541ab989b1c10de17bc04e20

SHA512
55158bc0482b82502e30d56f62eb42f47c757a45d4aee4c9aa33465aba074a4761b48445b4c75df3645f33bb68f83a222ce148369419320ce922475b80a96300

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
124KB

MD5
58bc58c4044ffb1e188b57c02e2cab53

SHA1
5e4f57389a5ece7d81c94b575176131474615097

SHA256
1ce984b191814148c26f8ff30bb209b216e2b91d58bb510c0c6c8ea222017292

SHA512
8b7ee23ff3d4fb7d718374447ca2879e66251d52851426d8cfc034cf86267e28df8660deb531a4ff164182120a5359d1a3ffef9274415cd1ed0feb666aca4a1a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
246KB

MD5
ffd29b249b9e15480c8443f4f31a0e59

SHA1
d95e0fa3396c43900f5e9b0ccf52a4cf22777566

SHA256
94228cc139fdd542dd33f18135c6b938926a42c244afe745b9afae9ae8a6fa27

SHA512
bfd49241c9b7eee26b90448a2eaeb65088173b8779eeccd7aca649d3b32f33495225374f5a71df4f36c2ffe141e17f8293be0c6d33a43b0598781d11ad913915

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.json

Filesize
21B

MD5
f1b59332b953b3c99b3c95a44249c0d2

SHA1
1b16a2ca32bf8481e18ff8b7365229b598908991

SHA256
138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c

SHA512
3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.GovernedChannelStates.json

Filesize
417B

MD5
c56ff60fbd601e84edd5a0ff1010d584

SHA1
342abb130dabeacde1d8ced806d67a3aef00a749

SHA256
200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c

SHA512
acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.Settings.json

Filesize
87B

MD5
e4e83f8123e9740b8aa3c3dfa77c1c04

SHA1
5281eae96efde7b0e16a1d977f005f0d3bd7aad0

SHA256
6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31

SHA512
bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyHistoryStats.json

Filesize
14B

MD5
6ca4960355e4951c72aa5f6364e459d5

SHA1
2fd90b4ec32804dff7a41b6e63c8b0a40b592113

SHA256
88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3

SHA512
8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\odc.officeapps.live.com\86293CB4-B906-464C-8524-97E8124F69FD

Filesize
397B

MD5
2f82426450332b558a61ae9ca551abd9

SHA1
abdbf8f8bdd7572bcdefbd1e0b7da8d3cf17144d

SHA256
57d6315a8f1f11aaa111a9956ddd0d560f791f757c379ed77bbb5a1b5b577f52

SHA512
dbc43dab6cbde98647c5a88cd508a1528ef79c030286cf82cb4cb03c4af81930ad1c3b2644ead9eceea27cd5772324f42a51f04f1693102254567205a6abf0b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\odc.officeapps.live.com\F9E7FD65-DD91-4FD8-B78F-CBDD76C9C3B2

Filesize
1KB

MD5
85ad173999ed440af6120f3b4fd436fa

SHA1
eebe3bae40b0c82db581b905e2a4c4a90055c9b3

SHA256
2fb3e7ca57b5ec8657ff2b909c74dee246e7ed2b30abd60dec96fc4fb88bd165

SHA512
3c506252a27bc4a3d718fc2ad89036850ee3c9d5fd79966fc5e28debe1844d96e8d2777e160e8537034129fd8109dff027bf5eb4a082c99d0db93730ec31427e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\729E4D9A-5CD7-4368-B35A-AD50E9EB763B

Filesize
177KB

MD5
1b97125191d6fa99aa976698e94dd0b6

SHA1
c4f0f1fbd5bdc6d36bdbd1a3fc4c9780933122ae

SHA256
fdbf73105857440642b019713ba408cc951e2c25b72742136dd4f5c2de5961f0

SHA512
9d1396cacd4f0cab512879f5e83c90071ed135da1cf75356cb0b9f86e47808c48375d27b329231a183da2e0bf152cb5fafcb292bd706f3c765c9793270af06c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml

Filesize
332KB

MD5
35b533e1ab6f7764115a6a03d177d730

SHA1
edee35c8f09f74408f9869e15ecb1d151e0f07a1

SHA256
cbece3cb024f93ffd2954b6ef06514a6cd88c3231a5f17fa914b644b6534e8f5

SHA512
157a71d27c75559f87b6f689ce3b22b81c12842528bd5e752ee5afcaa0aae4299e6104a3cdd17d6cc7099e7ea47d105c86687295668138eb7c0d3c7b48b41d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog

Filesize
10KB

MD5
88bad2fb12573504d09ddafa7b5ce155

SHA1
6a06153a00878535527e67ba7323e2c7ae15f62d

SHA256
dd4bcc3dd42e67729fb83baadbcf9e3ede4c81a5b280b7429a6abe87c8e99554

SHA512
cb8daecd5d4922e1662e53a9530f8e64dcd31706d0994442d5e9ac525d2fd34e6bae1c49b17dd985b33e5d1032dc6a69837ce2bc68b5e5a3709c3ba71b024221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog

Filesize
15KB

MD5
80d53aab9b870c66ac519a0c9d1be857

SHA1
60c72b30cf60fe551a1ec854da6f00d93e2ad60e

SHA256
b53a6d0b8d0b126cecd1ed1fa6093f686ea6debaa12ecc9463fe7910f522bc39

SHA512
49aa3442c70b02cd41df74a031ac8f68271193f52ed90532a830cc1f098d456913219782598833adfa1e5dad98ea5487f58a54777ff41f2ef26fa2615f36530e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db

Filesize
24KB

MD5
ac993a0eb60afe20511223b3c59ba718

SHA1
43191e30458e2ef36d56e72d65c03916fe55fbc3

SHA256
ab542cb807ab6ea723446bde0127148fd4fd1dd3653a70b187c84a0a98658ece

SHA512
4709b500d14de170de0f7514f89ab5ad0e3e1a186d388ef7c6b87e07303ec747377b52237b3b64e85ced55b25e0fc0f68fa4e443aa6bca17e57216d994265302

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db

Filesize
36KB

MD5
cb769ac350a1b1e93ce257fa32bb99bc

SHA1
b86928953e14d1d182b9e6700c96fc048ab12cf4

SHA256
d132c23e141b45241498ab774db002ccc379ad4224aa0911fc2929b291d884b0

SHA512
b805e281da61d4314649c27d79c3de92e2f8c40e7e410ec60662ea5d1910d5acb5e8c854b295efe2e7872558cbdbabfbfcce0397aaee6e0a587cc4caf9bc43e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
79c3081c67e9d4e94d4e7d0b84377fd8

SHA1
b6d52ff7e1f53459b18d0ecf270740e9a8830c49

SHA256
ea4e4a2865a1a4e5f3c1011a3a085e55b31c82958a432ecc4b52ba343abedb87

SHA512
0721a085272762549870a8cbf2768b007fef93eca6c6c265917e45e894debcf90b02ffe733e247609b6fd95242472ac160211c1b54cf9a104ee460b072499207

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

Filesize
14KB

MD5
6cef711d6dfaec415f050a038c52fecd

SHA1
6bab24c237101950351542250be469bc19e4724a

SHA256
961ec0121a57c66de3c7ba5828230041cf14cfcce23e1e19eda4e519f448fb05

SHA512
cecacf4e9f70089f94602466af070aef010189ef449529f2c140d89c2cf84c28e3d0862e9c71219dc3502357594fd45ccb5329761fbd7a4ae3282e80f501ebe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{A502DB31-0FEB-42A3-8120-4B5A59673FFF}.tmp

Filesize
1024B

MD5
5d4d94ee7e06bbb0af9584119797b23a

SHA1
dbb111419c704f116efa8e72471dd83e86e49677

SHA256
4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1

SHA512
95f83ae84cafcced5eaf504546725c34d5f9710e5ca2d11761486970f2fbeccb25f9cf50bbfc272bd75e1a66a18b7783f09e1c1454afda519624bc2bb2f28ba4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\Как заработать миллион.docx

Filesize
466KB

MD5
3c151ed6a605746afb9d5bab9041ab8f

SHA1
0f016fecf45c95d084a163e4f9fc00438fb5f32c

SHA256
65fe796ff29aa6f7fd2ec6e7fee276259371a2f0b76e62b180dabd162a161397

SHA512
62f5006ee122ce913959f63bf880f800a54e6d2ab73aeae5b8546b0a54366c200c131500521b7f97fc3a893b6a43f966b6e757db880563b0ea018bdff02d6a0d

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\9fc40fef-aa65-4efa-8beb-a4830e9c6554.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Q19c152890436667fb228d84cd21489

Filesize
448KB

MD5
7a02f6a1b5994b6f125d0d4e59e2476b

SHA1
5b4893957fbba79b9d167137b9864cb2073ad68c

SHA256
e337223a29d9e895111353bbd62bf5e253699160f3894400dc228b88a09bab78

SHA512
7797b96824eeccf46c1c8b767bac711022ad3ec3cc53b43b3b78c9ec4ad55da2b2b30edfc5af3fcb2897ca35c2b83a49ee8fb4ef4cc65a32521fc39c6bf2805a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCDC62B.tmp\sist02.xsl

Filesize
245KB

MD5
f883b260a8d67082ea895c14bf56dd56

SHA1
7954565c1f243d46ad3b1e2f1baf3281451fc14b

SHA256
ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

SHA512
d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

Download Submit
C:\Users\Admin\AppData\Local\Temp\oe39e861fc2efb967c73b4c7b.exe

Filesize
336KB

MD5
47615cb40373de40aaf86d99d8b4970f

SHA1
b6ebf2ec54cee7c6e907f0fa4a69f59651d0f26b

SHA256
d7bada568e0619861960b365bda34d4fddfcbd96e3be8b2a6580f51bed2f682d

SHA512
eabdf336417076ab77db792d17a4b5670174c0dcd549d5ef86de3a86b6d2468a2f97fafcbe2c7e27854e99f6b053d6618d3fe6149f92fdcd8a96108c610531ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
678B

MD5
296876f6e2ee08a6e6ed2db3977bd6ed

SHA1
710ccba23ab2e205e55458656a11b5347b1e7b06

SHA256
69777c9aae546149d7c80009d135af513b5eeee818d739779406ba0c4743ac36

SHA512
7fcb69b2aac70dd191f8d75cd42dbfc455c671e36419e3ed4961300ba9ff7813039d6cad8806bc2a9d901658159e59644dfd6c76f95e9e09f074dc4d02b6f07f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
678B

MD5
105d80a6001969dec9acb4913fb5bf90

SHA1
fac4d2e2511ee3947f404ae0fc4504ec25b924fe

SHA256
51dc42aa711b43f329e53092f0e95c0825bc2ed9ddf5bd5a96bfe4a954c57685

SHA512
7c82984896910cb5822c2ef25c32385ed5d6524dcc57386e9d898dd4fe161eee4ea803f21be398993169ab2c859446d3aec97556cf933be7fda5dd9c1e147a58

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
678B

MD5
dd37c047611df8cb080d9642e857d2dd

SHA1
44e21d1cee1418a6944c9b3627f316cd7842cdf6

SHA256
4fb4e43ec3a1c6000f01a8573649f342b440bcc8c3c62fc547a3e119d8cd8ae4

SHA512
58bb188f86ddd255a63f1b0a302d9cf913b71c9b547cf01fc0db5d3442300495ae4fb8215e660aaef04f44222a9d47fb88bae65a9ec20d644f525af2709f9a30

Download Submit
memory/648-78-0x00007FF99FB80000-0x00007FF99FB90000-memory.dmp

Filesize
64KB

Download
memory/648-83-0x00007FF99FB80000-0x00007FF99FB90000-memory.dmp

Filesize
64KB

Download
memory/1548-37-0x000001D0D8610000-0x000001D0D866A000-memory.dmp

Filesize
360KB

Download
memory/1548-38-0x000001D0F2E50000-0x000001D0F2EA0000-memory.dmp

Filesize
320KB

Download
memory/4212-639-0x000001ED992C0000-0x000001ED992C1000-memory.dmp

Filesize
4KB

Download
memory/4212-646-0x000001ED992C0000-0x000001ED992C1000-memory.dmp

Filesize
4KB

Download
memory/4212-638-0x000001ED992C0000-0x000001ED992C1000-memory.dmp

Filesize
4KB

Download
memory/4212-640-0x000001ED992C0000-0x000001ED992C1000-memory.dmp

Filesize
4KB

Download
memory/4212-645-0x000001ED992C0000-0x000001ED992C1000-memory.dmp

Filesize
4KB

Download
memory/4212-647-0x000001ED992C0000-0x000001ED992C1000-memory.dmp

Filesize
4KB

Download
memory/4212-650-0x000001ED992C0000-0x000001ED992C1000-memory.dmp

Filesize
4KB

Download
memory/4212-649-0x000001ED992C0000-0x000001ED992C1000-memory.dmp

Filesize
4KB

Download
memory/4212-648-0x000001ED992C0000-0x000001ED992C1000-memory.dmp

Filesize
4KB

Download
memory/4212-644-0x000001ED992C0000-0x000001ED992C1000-memory.dmp

Filesize
4KB

Download
memory/4284-636-0x000000001D980000-0x000000001DE66000-memory.dmp

Filesize
4.9MB

Download
memory/4836-18-0x00007FF9E2340000-0x00007FF9E2549000-memory.dmp

Filesize
2.0MB

Download
memory/4836-23-0x00007FF9E2340000-0x00007FF9E2549000-memory.dmp

Filesize
2.0MB

Download
memory/4836-71-0x00007FF9A23D0000-0x00007FF9A23E0000-memory.dmp

Filesize
64KB

Download
memory/4836-42-0x00007FF9E23E3000-0x00007FF9E23E4000-memory.dmp

Filesize
4KB

Download
memory/4836-41-0x00007FF9E2340000-0x00007FF9E2549000-memory.dmp

Filesize
2.0MB

Download
memory/4836-69-0x00007FF9A23D0000-0x00007FF9A23E0000-memory.dmp

Filesize
64KB

Download
memory/4836-72-0x00007FF9E2340000-0x00007FF9E2549000-memory.dmp

Filesize
2.0MB

Download
memory/4836-1-0x00007FF9E23E3000-0x00007FF9E23E4000-memory.dmp

Filesize
4KB

Download
memory/4836-15-0x00007FF9E2340000-0x00007FF9E2549000-memory.dmp

Filesize
2.0MB

Download
memory/4836-16-0x00007FF9E2340000-0x00007FF9E2549000-memory.dmp

Filesize
2.0MB

Download
memory/4836-70-0x00007FF9A23D0000-0x00007FF9A23E0000-memory.dmp

Filesize
64KB

Download
memory/4836-19-0x00007FF9E2340000-0x00007FF9E2549000-memory.dmp

Filesize
2.0MB

Download
memory/4836-20-0x00007FF9E2340000-0x00007FF9E2549000-memory.dmp

Filesize
2.0MB

Download
memory/4836-21-0x00007FF9E2340000-0x00007FF9E2549000-memory.dmp

Filesize
2.0MB

Download
memory/4836-22-0x00007FF9E2340000-0x00007FF9E2549000-memory.dmp

Filesize
2.0MB

Download
memory/4836-68-0x00007FF9A23D0000-0x00007FF9A23E0000-memory.dmp

Filesize
64KB

Download
memory/4836-17-0x00007FF9E2340000-0x00007FF9E2549000-memory.dmp

Filesize
2.0MB

Download
memory/4836-14-0x00007FF99FB80000-0x00007FF99FB90000-memory.dmp

Filesize
64KB

Download
memory/4836-13-0x00007FF9E2340000-0x00007FF9E2549000-memory.dmp

Filesize
2.0MB

Download
memory/4836-10-0x00007FF9E2340000-0x00007FF9E2549000-memory.dmp

Filesize
2.0MB

Download
memory/4836-12-0x00007FF99FB80000-0x00007FF99FB90000-memory.dmp

Filesize
64KB

Download
memory/4836-11-0x00007FF9E2340000-0x00007FF9E2549000-memory.dmp

Filesize
2.0MB

Download
memory/4836-8-0x00007FF9E2340000-0x00007FF9E2549000-memory.dmp

Filesize
2.0MB

Download
memory/4836-9-0x00007FF9E2340000-0x00007FF9E2549000-memory.dmp

Filesize
2.0MB

Download
memory/4836-6-0x00007FF9A23D0000-0x00007FF9A23E0000-memory.dmp

Filesize
64KB

Download
memory/4836-7-0x00007FF9E2340000-0x00007FF9E2549000-memory.dmp

Filesize
2.0MB

Download
memory/4836-4-0x00007FF9A23D0000-0x00007FF9A23E0000-memory.dmp

Filesize
64KB

Download
memory/4836-5-0x00007FF9E2340000-0x00007FF9E2549000-memory.dmp

Filesize
2.0MB

Download
memory/4836-2-0x00007FF9A23D0000-0x00007FF9A23E0000-memory.dmp

Filesize
64KB

Download
memory/4836-3-0x00007FF9A23D0000-0x00007FF9A23E0000-memory.dmp

Filesize
64KB

Download
memory/4836-0-0x00007FF9A23D0000-0x00007FF9A23E0000-memory.dmp

Filesize
64KB

Download