Cuckoo Sandbox

Category	Started On	Completed On	Duration	Cuckoo Version
FILE	2022-10-17 23:34:10.357182	2022-10-17 23:35:59.108635	108 seconds	2.0-dev

Machine	Label	Manager	Started On	Shutdown On
win7cuckoo	win7 Clone 1	VirtualBox	2022-10-17 23:34:10	2022-10-17 23:35:58

File Details

File name	31a586cb4f2a6249fa09d8a8d8319b07e5ef9345.docx
File size	13141 bytes
File type	Zip archive data, at least v1.0 to extract
CRC32	0911AA93
MD5	8e3a266d005ade557910d537a1a43bd5
SHA1	31a586cb4f2a6249fa09d8a8d8319b07e5ef9345
SHA256	8ee31c81cb8597119913a057c8aeac469580259d08b23763759df266a4af72bf
SHA512	186d3e21a1dbe22a5fb0c9c508ab97e1ca53c87f48b0c55c2661567546a845b69fca77a1d6db20d3e954ccb8fd2396eecbaffebc63b70e2c52958ac2b511637d
Ssdeep	None
PEiD	None matched
Yara	contains_base64 (This rule finds for base64 strings)
VirusTotal	File not found on VirusTotal

MetaFlows Scores

Metaflows Analysis Results (Signatures=50, Anomalies=0, PEiD=0, Yara=0, VT[1666064178]=0): Snort Events=0, AV Events=0
Total Score=50

Dropped File/Buffer Yara Signatures:
21aa549c148abf7e_winword.exe_rules.xml: contains_base64

Signatures

raises_exception details

Roaming_Profile_Modified details

Startup_File_Accessed details

nolookup_communication details

applcation_raises_exception details

creates_doc details

Screenshots

No screenshots available.

Static Analysis

Strings

Dropped Files

2299739645346b04_~$normal.dotm

File name	2299739645346b04_~$normal.dotm
File size	162 bytes
File type	data
MD5	71082b969e0f5610d1d7476c2e827995
SHA1	7cc118a97aa3f8be77db7a41acbe605c620157b5
SHA256	2299739645346b049b542899128d0f2816c331d0cc92120e5e3f7d07b7e6141d
SHA512	58fc86e683eb9eb3229acb0b65466d89c1e4ffa7cf71691b88413e33fb15086d8b1e119df0b512399386d9b088c368c81770e2d3e82d260c0714f0a8c0696a96
Ssdeep	None
Yara	None matched
VirusTotal	Search for Analysis

af2163597bfdead9_eae47db7-c5bc-429b-bb4f-2b14484d634a

File name	af2163597bfdead9_eae47db7-c5bc-429b-bb4f-2b14484d634a
File size	148264 bytes
File type	XML document text
MD5	dc85a1fcf8ab0125dd33140aef420b90
SHA1	ed5ea6e17a8f7cf88252c8731c1ff72cdbfb9a29
SHA256	af2163597bfdead954fdc550dc4a6975674405e9c25e5613b90b62531b08fa15
SHA512	bc94a0cb4a09ed2ad18924c0f61723bd4a353670e6e0a4d3a5676f8361573ddaa5687cb1a93a1338ef4f249eb3f8b55074e1f6ad1270e2a98dde43ddd175f250
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings) Big_Numbers1 (Looks for big numbers 32:sized) memory_shylock ()
VirusTotal	Search for Analysis

4826c0d860af884d_~wrs{ae57862c-c1f9-47ec-a00e-f52020672765}.tmp

File name	4826c0d860af884d_~wrs{ae57862c-c1f9-47ec-a00e-f52020672765}.tmp
File size	1024 bytes
File type	data
MD5	5d4d94ee7e06bbb0af9584119797b23a
SHA1	dbb111419c704f116efa8e72471dd83e86e49677
SHA256	4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1
SHA512	95f83ae84cafcced5eaf504546725c34d5f9710e5ca2d11761486970f2fbeccb25f9cf50bbfc272bd75e1a66a18b7783f09e1c1454afda519624bc2bb2f28ba4
Ssdeep	None
Yara	None matched
VirusTotal	Search for Analysis

21aa549c148abf7e_winword.exe_rules.xml

File name	21aa549c148abf7e_winword.exe_rules.xml
File size	600871 bytes
File type	XML document text
MD5	893012637852c27656008efbcbdba485
SHA1	69454ff98f5c392b270ce3a49da5b1336f5124e7
SHA256	21aa549c148abf7eddfce0d1172679bedadd1a485003b261a897da1990475879
SHA512	c873e5aef59f00c2e58280128ffc5ed12b681d6f3c523abd1e4730da364fd0934431bfb1851ce270796922c6ade9aec512970fc3ab2137373023dc683fe9328f
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings) Str_Win32_Internet_API (Match Windows Inet API call) Big_Numbers1 (Looks for big numbers 32:sized)
VirusTotal	Search for Analysis

f9c8f7d2247f443e_~wrs{afe2c8d4-6238-475e-b83c-041403e1a32d}.tmp

File name	f9c8f7d2247f443e_~wrs{afe2c8d4-6238-475e-b83c-041403e1a32d}.tmp
File size	9728 bytes
File type	data
MD5	3dd6d4388cd9e29015e359b3f8ab1a39
SHA1	d2ab0cb4f30105bdfbbf202c289c39b49e7c0b8e
SHA256	f9c8f7d2247f443e9f2a19299fbaf7b0328639577ef7c1d682f58942e7f79856
SHA512	cb664a116d31fecc336f7076a3e69eee13ca4b1657774cbaec3891d65366da55d31f2d36f32fb80ec494ae7ec0dabda81f7be4f7b65df7bd6b3f21d1ef99495a
Ssdeep	None
Yara	None matched
VirusTotal	Search for Analysis

cb3ccbb76031e5e0_3c428b1a3e5f57d887ec4b864fac5dcc

File name	cb3ccbb76031e5e0_3c428b1a3e5f57d887ec4b864fac5dcc
File size	914 bytes
File type	data
MD5	e4a68ac854ac5242460afd72481b2a44
SHA1	df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256	cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512	5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings)
VirusTotal	Search for Analysis

7b7143b78d3fde77_3c428b1a3e5f57d887ec4b864fac5dcc

File name	7b7143b78d3fde77_3c428b1a3e5f57d887ec4b864fac5dcc
File size	252 bytes
File type	data
MD5	67c98001c273de5d0dfdde57a92e7f79
SHA1	92c12a2fa74a14a4aa6699926fdcec95be7a1ace
SHA256	7b7143b78d3fde7772fb5ca928d8564b2a9409fa38224183818a15b4e6be4336
SHA512	90f41e0255903dbd9cd81319b2d4780244e8deb82e5bfa803c139df3aefd5a30019b6b9905cd9045ec1fd997f3142836b0890a25f659fd30e8fdde93b464cdde
Ssdeep	None
Yara	None matched
VirusTotal	Search for Analysis

Network Analysis

Hosts Involved

IP Address
104.75.133.129
172.64.149.82
20.224.201.79
23.101.14.229
23.99.109.44
70.186.27.24
70.186.27.9
8.8.8.8

DNS Requests

Domain	IP Address
vortex-win.data.microsoft.com	20.189.173.13
armmf.adobe.com	184.26.128.223
ocos-office365-s2s.msedge.net	13.107.5.88
dns.msftncsi.com	131.107.255.255
officeclient.microsoft.com	52.109.13.31
ctldl.windowsupdate.com	23.1.234.57
ols.officeapps.live.com	52.109.2.6
teredo.ipv6.microsoft.com	54.241.176.34
nexusrules.officeapps.live.com	20.224.254.73
cacerts.digicert.com	104.18.38.174
ipv6.msftncsi.com
config.edge.skype.com	13.107.42.16
nexus.officeapps.live.com	20.25.84.51

HTTP Requests

URL	Data
http://cacerts.digicert.com/DigiCertGlobalRootG2.crt	GET /DigiCertGlobalRootG2.crt HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/3679CA35668772304D30A5FB873B0FA77BB70D54.crt?911320f9b04be75f	GET /msdownload/update/v3/static/trustedr/en/3679CA35668772304D30A5FB873B0FA77BB70D54.crt?911320f9b04be75f HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: ctldl.windowsupdate.com

Behavior Summary

File-Written

C:\Users\Harry Dresden\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\EAE47DB7-C5BC-429B-BB4F-2B14484D634A
C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{AE57862C-C1F9-47EC-A00E-F52020672765}.tmp
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml
C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{AFE2C8D4-6238-475E-B83C-041403E1A32D}.tmp
C:\Users\Harry Dresden\AppData\Local\Temp\~$a586cb4f2a6249fa09d8a8d8319b07e5ef9345.docx
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

File-Opened

C:\Users\Harry Dresden\AppData\Local\Temp
C:\
C:\Windows\System32\mscoree.dll
C:\Windows\SysWOW64\en-US\CRYPT32.dll.mui
C:\Windows\Fonts\tahoma.ttf
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\Templates\Normal.dotm
C:\Users\Harry Dresden\Favorites\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft
C:\Windows\Fonts\arial.ttf
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\C642E3AC-C787-461C-8130-49BC8B3B8E54
C:\Users\Harry Dresden\
C:\Users\Harry Dresden\AppData\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0
C:\Windows\WindowsShell.Manifest
C:\Windows\Fonts\simsun.ttc
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO40UIRES.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\OTele\{B873B1AD-6171-49BF-89FE-C4666F2C8444} (0) - 3872 - winword.exe - OTeleMediumCost.dat
C:\Program Files (x86)\Microsoft Office\root\Office16\1033\WWINTL.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\83917C1B-CFCF-4F12-BA76-7138123D93FC
C:\Users\Harry Dresden\Links\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\51792303-9B41-4132-AD62-E72F4D1C08D6
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache
C:\Windows\SysWOW64\en-US\USER32.dll.mui
C:\Users\Harry Dresden\Videos\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\1430F911-5AD3-4749-AFAC-24A34E4FD4A9
C:\Users\Harry Dresden\AppData\Roaming
C:\Users\Harry Dresden\AppData\Local\Temp\31a586cb4f2a6249fa09d8a8d8319b07e5ef9345.docx
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\1033\msointl30.dll
C:\Windows\Fonts\calibril.ttf
C:\Windows\System32\oleaccrc.dll
C:\Program Files (x86)\Microsoft Office\root\Office16\
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\
C:\Program Files (x86)\Common Files\Microsoft Shared\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso20win32client.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\60B61A8B-72E6-431D-B56F-E4939E48D96C
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\7611C3D4-0673-442E-850F-6C64C041E91E
C:\Users\Harry Dresden\AppData\Roaming\Microsoft
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\OTele\{B873B1AD-6171-49BF-89FE-C4666F2C8444} (0) - 3872 - winword.exe - OTele.dat
C:\Windows\Fonts\arialbd.ttf
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSORES.DLL
C:\Users\Harry Dresden\AppData\LocalLow
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\B146098F-4064-49C1-985D-AEC3D779A81B
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers
C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
C:\Windows\System32\en-US\d2d1.dll.mui
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\459A34E0-3D69-4909-8E7B-40D4C989545E
C:\Users\Harry Dresden\Pictures\desktop.ini
C:\Program Files (x86)\
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\Cultures\OFFICE.ODF
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\BEE1372A-C6B0-45A5-B2DF-946BCF71815A
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\27AE1074-21E3-40FA-AE57-4027C89A1728
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\Office\16.0\62e47556\Proofing\RoamingCustom.dic
C:\Users\Harry Dresden\Searches\desktop.ini
C:\Windows\SysWOW64\shell32.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\2B6C7C22-BAAE-4D80-8E6A-3176CC4E5946
C:\Users\Harry Dresden\Downloads\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\2B482C5D-3A63-457D-BC30-53A361F3C4C2
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\D5CA04B0-F36E-4671-9B61-C281C22245A8
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\
C:\Users\Harry Dresden\Contacts\desktop.ini
C:\Program Files (x86)\Microsoft Office\root\Office16\STARTUP\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\88DDE652-0345-4105-81DB-355519848C29
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content
C:\Windows\SysWOW64\en-US\setupapi.dll.mui
C:\Windows\Microsoft.NET\Framework\v4.0.30319\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\5DD973A5-6B8F-40E7-93DC-F099B3954B65
C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat
C:\Users\Harry Dresden
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\0136C3E2-C15B-4825-B21D-FD8681596A3A
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSO.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\7DF8FCF3-C8C9-4CF7-8416-171D71D0C04A
C:\Windows\System32\en-US\shdocvw.dll.mui
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\Templates\
C:\Program Files (x86)\Microsoft Office\root\Office16\OART.DLL
C:\Users\Harry Dresden\Saved Games\desktop.ini
C:\Windows\System32\en-US\webservices.dll.mui
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\41998CBE-23F6-4A35-9D07-30563B2494C7
C:\Windows\Fonts\SEGOEUISL.TTF
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\ECB4A42C-1CD2-416B-A8EE-28711F2E4748
C:\Windows\Fonts\
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso40uiwin32client.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\71FD5FF9-FB04-4B94-95CF-F362AB85F4C7
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO99LRES.DLL
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\Word\STARTUP\
C:\Users\Harry Dresden\AppData\Local
C:\Windows\SysWOW64\en-US\SETUPAPI.dll.mui
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\
C:\ProgramData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\D8906D2F-B5FB-47A7-A48C-64280468337B
C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
C:\Windows\AppPatch\sysmain.sdb
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso99Lwin32client.dll
C:\Users\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\C88FD7A6-07CC-42CE-ABF8-77F23D1FCFAC
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\DC7D18FE-1987-4CC1-A220-8C2AB3F89FE4
C:\Users\Harry Dresden\Music\desktop.ini
C:\Users
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\F3721A83-BE42-474E-A0FE-86C399B43BD1
C:\Windows\System32\shdocvw.dll
C:\Windows\Microsoft.NET\Framework\
C:\Users\desktop.ini
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\1033\MSOINTL.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\141E62F4-A1F6-4895-AAD3-8A2A95D4A1E2
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\80B9ABAF-5777-40C6-9BCA-7FF88408BA18
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\A42028F2-CFF8-48B7-B283-04ADC903CA42
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\02F53DDF-4F31-4BA0-97DE-29F451F29819
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\218BD889-250F-4009-AC70-37A89D831B8B
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\
C:\Windows\Fonts\staticcache.dat
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\166A7C48-F18B-4F49-AD05-CA648AF56FB1
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\12E38A7D-EDAC-40BC-8980-4A83DF7AAB2E
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso30win32client.dll
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\Templates
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\3F7A38BA-8B2B-4C7D-817A-A29170E7C939
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso98win32client.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\6E4E86D9-CE48-4E5A-BDC2-529EA93CE6D2
C:\Users\Harry Dresden\AppData\Local\
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\4A1D1BE3-CA4C-4C42-AE17-C9AD7D0BDD26
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\54235051-D104-456C-B62E-7BBA73FA48DC
C:\Users\Harry Dresden\Desktop\desktop.ini
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
C:\Windows\System32
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\B3F75FA2-5E0D-426B-BC60-74C92AEBECEB
C:\Windows\
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\68CF3A26-FE19-459A-A97F-7DAFCB3AD924
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\D5741299-7A7A-4BE1-86B6-ADB88C449156
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\OTele\
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\398C73D5-F266-4B67-A792-8EFC910B2A68
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My
C:\Program Files (x86)\Microsoft Office\root\Office16\WWLIB.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\D81F3CE6-A0F2-4E05-91A2-9A4B8276F8BE
C:\Program Files (x86)\Microsoft Office\root\Office16\CHART.DLL
C:\Windows\Fonts\segoeui.ttf
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\
C:\Users\Harry Dresden\Documents\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\62CA747E-A81B-485E-B093-BF90DBBAE9EC
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\49196BB5-66DD-4A41-B334-5325D2D5E6C5
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\Proof\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\FEE4C9D3-C3C3-4DD8-9A8A-E5EE2FB996B2
C:\Windows\System32\
C:\Windows\Fonts\times.ttf
C:\Users\Harry Dresden\AppData\Local\Temp\
C:\Users\Harry Dresden\AppData

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 480, Parent PID: 384

"C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE" C:\Users\HARRYD~1\AppData\Local\Temp\31a586cb4f2a6249fa09d8a8d8319b07e5ef9345.docx PID: 3556, Parent PID: 748

Volatility

Nothing to display.