Cuckoo Sandbox

Category	Started On	Completed On	Duration	Cuckoo Version
FILE	2022-07-09 13:13:59.882090	2022-07-09 13:15:48.493265	108 seconds	2.0-dev

Machine	Label	Manager	Started On	Shutdown On
win7cuckoo	win7 Clone 1	VirtualBox	2022-07-09 13:14:00	2022-07-09 13:15:48

File Details

File name	a0cb9ab9c9f6ae4d944add38e41ade9c2c905882.doc
File size	52224 bytes
File type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Title: CALIFORNIA STATE UNIVERSITY SAN BERNARDINO, Author: Enrique Murillo, Template: Normal, Last Saved By: , Revision Number: 3, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:00, Last Printed: Wed Sep 9 01:39:00 2009, Create Time/Date: Tue Apr 6 00:48:00 2021, Last Saved Time/Date: Tue Apr 6 00:49:00 2021, Number of Pages: 1, Number of Words: 76, Number of Characters: 439, Security: 0
CRC32	90B94D13
MD5	8bf84f0771ee564a73a19a8fde58b4ff
SHA1	a0cb9ab9c9f6ae4d944add38e41ade9c2c905882
SHA256	432789f1fda2503a8e2c08ce713ffe3bc28f38424fd56d30d58d276653e9dd1e
SHA512	62b400d28b54aad1abca5ae56ab753866ab44f837709df7e0e1f43e40aeda9c675c58ce108e92026d62df40505092bb1252cfb18bad0f3524e7e858ed2852a8b
Ssdeep	None
PEiD	None matched
Yara	contains_base64 (This rule finds for base64 strings) Big_Numbers0 (Looks for big numbers 20:sized) maldoc_OLE_file_magic_number () office_document_vba (Office document with embedded VBA) Contains_VBA_macro_code (Detect a MS Office document with embedded VBA macro code)
VirusTotal	File not found on VirusTotal

MetaFlows Scores

Metaflows Analysis Results (Signatures=50, Anomalies=0, PEiD=0, Yara=0, VT[1657386967]=0): Snort Events=0, AV Events=0
Total Score=50

Dropped File/Buffer Yara Signatures:
d130bb309f39b42c_winword.exe_rules.xml: contains_base64

Signatures

raises_exception details

Roaming_Profile_Modified details

Startup_File_Accessed details

nolookup_communication details

applcation_raises_exception details

creates_doc details

Screenshots

No screenshots available.

Static Analysis

Strings

Dropped Files

7817fde63e9a4c27_~$cb9ab9c9f6ae4d944add38e41ade9c2c905882.doc

File name	7817fde63e9a4c27_~$cb9ab9c9f6ae4d944add38e41ade9c2c905882.doc
File size	162 bytes
File type	data
MD5	01c649f51e2f01ee0425852970c92bec
SHA1	bea12c0b734e04604ea8035e990fecd09db02490
SHA256	7817fde63e9a4c276079a686c81b923f0f7bf3a8078584b7f47a1279636e6528
SHA512	7f60783bf77ee7c2b76baf8cd47793a1fb09da274f4722ca87019ec8df07aada880a6f0d0603237839dbb317e06d5db6ad8b339e694513c0a3845fe54882aa21
Ssdeep	None
Yara	None matched
VirusTotal	Search for Analysis

4826c0d860af884d_~wrs{e656a43c-6c1b-4673-bbe8-97402b83d4ef}.tmp

File name	4826c0d860af884d_~wrs{e656a43c-6c1b-4673-bbe8-97402b83d4ef}.tmp
File size	1024 bytes
File type	data
MD5	5d4d94ee7e06bbb0af9584119797b23a
SHA1	dbb111419c704f116efa8e72471dd83e86e49677
SHA256	4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1
SHA512	95f83ae84cafcced5eaf504546725c34d5f9710e5ca2d11761486970f2fbeccb25f9cf50bbfc272bd75e1a66a18b7783f09e1c1454afda519624bc2bb2f28ba4
Ssdeep	None
Yara	None matched
VirusTotal	Search for Analysis

d130bb309f39b42c_winword.exe_rules.xml

File name	d130bb309f39b42c_winword.exe_rules.xml
File size	602026 bytes
File type	XML document text
MD5	0283b85882c83c8489965bde23692413
SHA1	05191441b02f8519827a74290d079e6651cada4b
SHA256	d130bb309f39b42c9041e0f4b95cf5d7dd6ea2abed776d78363be3a2ced7e901
SHA512	b5cdaef8e3d88e6bcc7af44d3cec4fcaff71f943a7b04540baf6bf5d9da9a8b3e548ad237ac2959a9cdd66ccff53b5d6ceff4b0996ad02e55ec0cf13f50160c8
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings) Str_Win32_Internet_API (Match Windows Inet API call) Big_Numbers1 (Looks for big numbers 32:sized)
VirusTotal	Search for Analysis

6b141ce56cf281bf_3c428b1a3e5f57d887ec4b864fac5dcc

File name	6b141ce56cf281bf_3c428b1a3e5f57d887ec4b864fac5dcc
File size	252 bytes
File type	data
MD5	01000c8c3ef863f1975cbaa88f309b40
SHA1	ec2064179aff94e395a0df916ea2127a5422590e
SHA256	6b141ce56cf281bfe58f660148a773735b62bf459a73ff834ee8d9f33e90e2a2
SHA512	62c526144fe34fd42d761b1141738ea2a4928e452bc0a59d67d4b8afb9f8d4500fe2131e47175a160a3399ea2080464c4a105df9ac83abb6a3167bbf03902b24
Ssdeep	None
Yara	None matched
VirusTotal	Search for Analysis

cb3ccbb76031e5e0_3c428b1a3e5f57d887ec4b864fac5dcc

File name	cb3ccbb76031e5e0_3c428b1a3e5f57d887ec4b864fac5dcc
File size	914 bytes
File type	data
MD5	e4a68ac854ac5242460afd72481b2a44
SHA1	df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256	cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512	5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings)
VirusTotal	Search for Analysis

c4fed2e2cb163767_2107aee1-21cc-4e16-ae1c-e9a548456ced

File name	c4fed2e2cb163767_2107aee1-21cc-4e16-ae1c-e9a548456ced
File size	149418 bytes
File type	XML document text
MD5	086b7ca4e26d1ff4553490caa4e1224f
SHA1	e40b5e681530767c913bd23e46b6bf868fa69834
SHA256	c4fed2e2cb163767b7d56592b80010d594c612561e7b89eab0091ccb3399acd1
SHA512	a9c457b136cfdcf0231ccc6fe08c436f91b20af6d8af090e860eaaa9abbab4f5987fbcfcaad883218a314919111dd9b655784cd01f821f6936d3116baf778d7d
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings) Big_Numbers1 (Looks for big numbers 32:sized) memory_shylock ()
VirusTotal	Search for Analysis

Network Analysis

Hosts Involved

IP Address
104.18.38.174
104.75.133.129
23.101.14.229
23.99.109.44
70.186.27.24
70.186.27.9
8.252.68.126
8.8.8.8

DNS Requests

Domain	IP Address
nexus.officeapps.live.com	52.109.12.23
armmf.adobe.com	23.3.84.164
cacerts.digicert.com	172.64.149.82
dns.msftncsi.com	131.107.255.255
ols.officeapps.live.com	52.109.2.11
config.edge.skype.com	13.107.42.16
teredo.ipv6.microsoft.com	54.241.176.34
vortex-win.data.microsoft.com	104.208.16.89
ipv6.msftncsi.com
officeclient.microsoft.com	52.109.2.151
ocos-office365-s2s.msedge.net	13.107.5.88
nexusrules.officeapps.live.com	52.109.8.19
ctldl.windowsupdate.com	209.197.3.8

HTTP Requests

URL	Data
http://cacerts.digicert.com/DigiCertGlobalRootG2.crt	GET /DigiCertGlobalRootG2.crt HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/3679CA35668772304D30A5FB873B0FA77BB70D54.crt?911320f9b04be75f	GET /msdownload/update/v3/static/trustedr/en/3679CA35668772304D30A5FB873B0FA77BB70D54.crt?911320f9b04be75f HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: ctldl.windowsupdate.com
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?99597122bcf08015	GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?99597122bcf08015 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: ctldl.windowsupdate.com

Behavior Summary

File-Written

C:\Users\Harry Dresden\AppData\Local\Temp\~$cb9ab9c9f6ae4d944add38e41ade9c2c905882.doc
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E656A43C-6C1B-4673-BBE8-97402B83D4EF}.tmp
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\2107AEE1-21CC-4E16-AE1C-E9A548456CED

File-Opened

C:\Users\Harry Dresden\AppData\Local\Temp
C:\
C:\Windows\System32\mscoree.dll
C:\Windows\SysWOW64\en-US\CRYPT32.dll.mui
C:\Windows\Fonts\tahoma.ttf
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\Templates\Normal.dotm
C:\Users\Harry Dresden\Favorites\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft
C:\Windows\Fonts\arial.ttf
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\C642E3AC-C787-461C-8130-49BC8B3B8E54
C:\Users\Harry Dresden\
C:\Users\Harry Dresden\AppData\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0
C:\Windows\WindowsShell.Manifest
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO40UIRES.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\OTele\{B873B1AD-6171-49BF-89FE-C4666F2C8444} (0) - 3872 - winword.exe - OTeleMediumCost.dat
C:\Program Files (x86)\Microsoft Office\root\Office16\1033\WWINTL.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\83917C1B-CFCF-4F12-BA76-7138123D93FC
C:\Users\Harry Dresden\Links\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\51792303-9B41-4132-AD62-E72F4D1C08D6
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache
C:\Windows\SysWOW64\en-US\USER32.dll.mui
C:\Users\Harry Dresden\Videos\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\1430F911-5AD3-4749-AFAC-24A34E4FD4A9
C:\Users\Harry Dresden\AppData\Roaming
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\68CF3A26-FE19-459A-A97F-7DAFCB3AD924
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\1033\msointl30.dll
C:\Windows\Fonts\calibril.ttf
C:\Windows\System32\oleaccrc.dll
C:\Program Files (x86)\Microsoft Office\root\Office16\
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\
C:\Program Files (x86)\Common Files\Microsoft Shared\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso20win32client.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\60B61A8B-72E6-431D-B56F-E4939E48D96C
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\7611C3D4-0673-442E-850F-6C64C041E91E
C:\Users\Harry Dresden\AppData\Roaming\Microsoft
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\OTele\{B873B1AD-6171-49BF-89FE-C4666F2C8444} (0) - 3872 - winword.exe - OTele.dat
C:\Windows\Fonts\arialbd.ttf
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSORES.DLL
C:\Users\Harry Dresden\AppData\LocalLow
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\B146098F-4064-49C1-985D-AEC3D779A81B
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers
C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
C:\Windows\System32\en-US\d2d1.dll.mui
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\459A34E0-3D69-4909-8E7B-40D4C989545E
C:\Users\Harry Dresden\Pictures\desktop.ini
C:\Program Files (x86)\
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\Cultures\OFFICE.ODF
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\BEE1372A-C6B0-45A5-B2DF-946BCF71815A
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\27AE1074-21E3-40FA-AE57-4027C89A1728
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\Office\16.0\62e47556\Proofing\RoamingCustom.dic
C:\Users\Harry Dresden\Searches\desktop.ini
C:\Windows\SysWOW64\shell32.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\2B6C7C22-BAAE-4D80-8E6A-3176CC4E5946
C:\Users\Harry Dresden\Downloads\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\2B482C5D-3A63-457D-BC30-53A361F3C4C2
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\D5CA04B0-F36E-4671-9B61-C281C22245A8
C:\Windows\Fonts\timesbd.ttf
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\
C:\Users\Harry Dresden\Contacts\desktop.ini
C:\Program Files (x86)\Microsoft Office\root\Office16\STARTUP\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\88DDE652-0345-4105-81DB-355519848C29
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content
C:\Windows\SysWOW64\en-US\setupapi.dll.mui
C:\Windows\Microsoft.NET\Framework\v4.0.30319\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\5DD973A5-6B8F-40E7-93DC-F099B3954B65
C:\Users\Harry Dresden\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat
C:\Users\Harry Dresden
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\0136C3E2-C15B-4825-B21D-FD8681596A3A
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSO.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\7DF8FCF3-C8C9-4CF7-8416-171D71D0C04A
C:\Windows\System32\en-US\shdocvw.dll.mui
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\Templates\
C:\Program Files (x86)\Microsoft Office\root\Office16\OART.DLL
C:\Users\Harry Dresden\Saved Games\desktop.ini
C:\Windows\System32\en-US\webservices.dll.mui
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\41998CBE-23F6-4A35-9D07-30563B2494C7
C:\Windows\Fonts\SEGOEUISL.TTF
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\ECB4A42C-1CD2-416B-A8EE-28711F2E4748
C:\Windows\Fonts\
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso40uiwin32client.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\71FD5FF9-FB04-4B94-95CF-F362AB85F4C7
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSO99LRES.DLL
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\Word\STARTUP\
C:\Users\Harry Dresden\AppData\Local
C:\Windows\SysWOW64\en-US\SETUPAPI.dll.mui
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\
C:\ProgramData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\D8906D2F-B5FB-47A7-A48C-64280468337B
C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
C:\Windows\AppPatch\sysmain.sdb
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso99Lwin32client.dll
C:\Users\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\OTele\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\DC7D18FE-1987-4CC1-A220-8C2AB3F89FE4
C:\Users\Harry Dresden\Music\desktop.ini
C:\Users
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\F3721A83-BE42-474E-A0FE-86C399B43BD1
C:\Windows\System32\shdocvw.dll
C:\Windows\Microsoft.NET\Framework\
C:\Users\Harry Dresden\AppData\Local\Temp\a0cb9ab9c9f6ae4d944add38e41ade9c2c905882.doc
C:\Users\desktop.ini
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\1033\MSOINTL.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\141E62F4-A1F6-4895-AAD3-8A2A95D4A1E2
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\80B9ABAF-5777-40C6-9BCA-7FF88408BA18
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\A42028F2-CFF8-48B7-B283-04ADC903CA42
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\02F53DDF-4F31-4BA0-97DE-29F451F29819
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\218BD889-250F-4009-AC70-37A89D831B8B
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\
C:\Windows\Fonts\staticcache.dat
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\166A7C48-F18B-4F49-AD05-CA648AF56FB1
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\12E38A7D-EDAC-40BC-8980-4A83DF7AAB2E
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso30win32client.dll
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\Templates
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\3F7A38BA-8B2B-4C7D-817A-A29170E7C939
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\mso98win32client.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\6E4E86D9-CE48-4E5A-BDC2-529EA93CE6D2
C:\Users\Harry Dresden\AppData\Local\
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\
C:\Windows\Fonts\arialbi.ttf
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\4A1D1BE3-CA4C-4C42-AE17-C9AD7D0BDD26
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\54235051-D104-456C-B62E-7BBA73FA48DC
C:\Users\Harry Dresden\Desktop\desktop.ini
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
C:\Windows\System32
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\B3F75FA2-5E0D-426B-BC60-74C92AEBECEB
C:\Windows\
C:\Users\Harry Dresden\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\D5741299-7A7A-4BE1-86B6-ADB88C449156
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\398C73D5-F266-4B67-A792-8EFC910B2A68
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\SystemCertificates\My
C:\Program Files (x86)\Microsoft Office\root\Office16\WWLIB.DLL
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\D81F3CE6-A0F2-4E05-91A2-9A4B8276F8BE
C:\Program Files (x86)\Microsoft Office\root\Office16\CHART.DLL
C:\Windows\Fonts\segoeui.ttf
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\
C:\Users\Harry Dresden\Documents\desktop.ini
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\62CA747E-A81B-485E-B093-BF90DBBAE9EC
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\p.pfx.ms\49196BB5-66DD-4A41-B334-5325D2D5E6C5
C:\Users\Harry Dresden\AppData\Roaming\Microsoft\Proof\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\clienttemplates.content.office.net\FEE4C9D3-C3C3-4DD8-9A8A-E5EE2FB996B2
C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7.DLL
C:\Windows\System32\
C:\Windows\Fonts\times.ttf
C:\Users\Harry Dresden\AppData\Local\Temp\
C:\Users\Harry Dresden\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\cdn.odc.officeapps.live.com\C88FD7A6-07CC-42CE-ABF8-77F23D1FCFAC
C:\Users\Harry Dresden\AppData

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 480, Parent PID: 384

"C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE" C:\Users\HARRYD~1\AppData\Local\Temp\a0cb9ab9c9f6ae4d944add38e41ade9c2c905882.doc PID: 2396, Parent PID: 2196

Volatility

Nothing to display.